xmrig | cb3b3e628c8d30caf258718948f989772a5eb1affc3ab55c53e655e044a1d96d

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
Size

2.2MB
MD5

7b5292bcaf66259c185561fb55b3f2f3
SHA1

b0ddc5a209242c09475f44acfd57c810768a6660
SHA256

cb3b3e628c8d30caf258718948f989772a5eb1affc3ab55c53e655e044a1d96d
SHA512

9ace27d05921939bd8e281715a209dee9c82f54b7b8494c519878050fc5ad197625d3063ba4916618a16d1e5113f7620e83fa1a9e4e4683f6c22f46ff1da6330
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9V:NABI

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2688-8-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2592-37-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2980-40-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2516-43-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2720-260-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2980-539-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2432-82-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/1728-73-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2404-56-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2680-47-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2536-46-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2720-42-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2536-1148-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig
behavioral1/memory/2680-1149-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2432-6322-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2688-6748-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2508-6749-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2980-6752-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/320-6751-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2592-6750-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2680-6755-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2720-6761-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2516-6765-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2404-6766-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2536-6767-0x000000013FCA0000-0x0000000140092000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2144	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2688	curQGpe.exe
2516	FWLtihN.exe
2592	bUnpDPh.exe
2980	hslgaow.exe
2720	QgWrQKz.exe
2536	PZlCGoE.exe
2680	TEqCcdw.exe
2404	ZeJNQMo.exe
2508	hLGjKDu.exe
2860	YUcDrIA.exe
320	XApuONZ.exe
2432	OvWFBWD.exe
2640	wuMZTEb.exe
2472	WkRXefk.exe
2276	AfQuAfi.exe
2176	hiVpFVs.exe
1268	ZSuuUzk.exe
2152	liCibvB.exe
1992	NbgjmiU.exe
2880	yAxYymb.exe
3060	gyJkxJX.exe
1836	fTxnQmt.exe
1964	urWAuiF.exe
604	ggcVaII.exe
1408	VHqoXLH.exe
1936	VSHYSWm.exe
396	FQQRNzj.exe
2344	qxMCytX.exe
408	iKAnvVv.exe
792	OkrQFTf.exe
1864	uRXEZse.exe
1176	XiBtjRD.exe
2712	iTjdMje.exe
2348	iTXgDYQ.exe
3016	xtDFdNu.exe
2312	YqXUxNP.exe
852	lNqAPtg.exe
960	hWONcTX.exe
1320	NjXRrhb.exe
596	aJBjwGT.exe
1648	LHmOJJx.exe
1988	qeeaMgs.exe
1000	kStgubb.exe
1244	FQxWZjz.exe
2768	nYzapqO.exe
1668	QgdPLDE.exe
2052	fLtycUW.exe
1428	CCqsQld.exe
2752	owTytjW.exe
2740	gpYetuW.exe
1012	xxGzImI.exe
2932	zHOTlqd.exe
2676	ExIbAOR.exe
1640	NRlcBtX.exe
2572	ijEwidm.exe
2436	pMovdGs.exe
2488	GOWZgPe.exe
2820	qKVkQtk.exe
1368	ZBKLwzT.exe
1164	gxMHGcZ.exe
1568	xKguWvl.exe
1540	dDwGBWG.exe
1632	iGpZCmE.exe
1400	xXpuLle.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1728-1-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x000c000000015cd2-3.dat	upx
behavioral1/memory/2688-8-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0007000000015fa6-18.dat	upx
behavioral1/memory/2592-37-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2980-40-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2516-43-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x0006000000016d06-52.dat	upx
behavioral1/memory/2508-58-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/files/0x0006000000016d18-68.dat	upx
behavioral1/files/0x0006000000016d29-77.dat	upx
behavioral1/memory/2860-65-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/files/0x0006000000016d81-96.dat	upx
behavioral1/files/0x0006000000016d85-109.dat	upx
behavioral1/files/0x0006000000017472-166.dat	upx
behavioral1/files/0x0016000000005586-119.dat	upx
behavioral1/files/0x00060000000173df-191.dat	upx
behavioral1/memory/2720-260-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2980-539-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x0005000000018674-188.dat	upx
behavioral1/files/0x0006000000017510-179.dat	upx
behavioral1/files/0x000600000001864a-176.dat	upx
behavioral1/files/0x000600000001748d-169.dat	upx
behavioral1/files/0x00060000000173c5-164.dat	upx
behavioral1/files/0x000600000001745d-160.dat	upx
behavioral1/files/0x00060000000173dc-152.dat	upx
behavioral1/files/0x000600000001737e-147.dat	upx
behavioral1/files/0x0006000000016f7e-137.dat	upx
behavioral1/files/0x000d00000001865b-184.dat	upx
behavioral1/files/0x00060000000173e7-157.dat	upx
behavioral1/files/0x000600000001738c-140.dat	upx
behavioral1/files/0x000600000001737b-130.dat	upx
behavioral1/files/0x0007000000016da9-122.dat	upx
behavioral1/files/0x0006000000016e56-114.dat	upx
behavioral1/files/0x0006000000016d31-85.dat	upx
behavioral1/memory/2432-82-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x0006000000016d21-76.dat	upx
behavioral1/memory/1728-73-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/320-72-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/files/0x0006000000016d10-64.dat	upx
behavioral1/files/0x0008000000016cfd-50.dat	upx
behavioral1/memory/2404-56-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2680-47-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2536-46-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2720-42-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x0007000000016122-41.dat	upx
behavioral1/files/0x00090000000161ee-36.dat	upx
behavioral1/files/0x0007000000016013-35.dat	upx
behavioral1/files/0x0007000000015f23-22.dat	upx
behavioral1/files/0x0031000000015d39-17.dat	upx
behavioral1/memory/2536-1148-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx
behavioral1/memory/2680-1149-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2432-6322-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2688-6748-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2508-6749-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2980-6752-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/320-6751-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2592-6750-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2680-6755-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2720-6761-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2516-6765-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2404-6766-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2536-6767-0x000000013FCA0000-0x0000000140092000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ikZJwbo.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\JGMbYUW.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\nURDxsZ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\PnyhwYZ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YcDTbBt.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\rNpxBBI.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ALLWMpu.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\RHOTKKH.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ogIWliH.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\UccApBS.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\tpRpDwS.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\AgqtCbg.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\LJGPKJK.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\izUWgvV.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\BGfDsCg.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\EAmYzer.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\xPLtsbt.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\AEZkyts.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\qKLWLcc.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ZLDaRDQ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\qipbnna.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\qMjCHpA.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\lplPzPr.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\qFndNji.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ZICFuba.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\LxrBHKN.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\dgWvklA.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\dXIFyra.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\cfFJWdt.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\cRpBHOz.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\gFwSeHs.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\totPwPn.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ymZUlSC.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\XiRmaNI.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\AWUaVWB.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\JcfRXtl.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\NSqcukW.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\VvNveja.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\PmYIepU.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\voiuyMJ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\sizLxkJ.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\AXjAXRW.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\lYVbHxa.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\QwMcpOe.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\UzFNfbU.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\eLyCphh.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\fjozsly.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\exTodPu.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\YuVCKhy.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\RjKWmFP.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\ZnECfjm.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\PLSjMzn.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\rQrjosh.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\QQhGyiB.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\MObrvTo.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\FdVnZki.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\fDjtqnU.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\sznRHqT.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\hCEnfjL.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\QgYZGkn.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\oFwTRMu.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\tvikhuo.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\VZzoehW.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
File created	C:\Windows\System\iYOxash.exe	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2144	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
Token: SeDebugPrivilege	2144	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2144	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2144	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2144	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	30
PID 1728 wrote to memory of 2688	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2688	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2688	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	31
PID 1728 wrote to memory of 2516	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2516	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2516	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	32
PID 1728 wrote to memory of 2592	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2592	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2592	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	33
PID 1728 wrote to memory of 2536	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2536	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2536	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	34
PID 1728 wrote to memory of 2980	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2980	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2980	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	35
PID 1728 wrote to memory of 2680	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2680	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2680	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	36
PID 1728 wrote to memory of 2720	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2720	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2720	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	37
PID 1728 wrote to memory of 2404	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2404	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2404	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	38
PID 1728 wrote to memory of 2508	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2508	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2508	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	39
PID 1728 wrote to memory of 2860	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	40
PID 1728 wrote to memory of 2860	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	40
PID 1728 wrote to memory of 2860	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	40
PID 1728 wrote to memory of 320	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	41
PID 1728 wrote to memory of 320	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	41
PID 1728 wrote to memory of 320	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	41
PID 1728 wrote to memory of 2432	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2432	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2432	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	42
PID 1728 wrote to memory of 2640	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2640	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2640	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	43
PID 1728 wrote to memory of 2472	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	44
PID 1728 wrote to memory of 2472	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	44
PID 1728 wrote to memory of 2472	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	44
PID 1728 wrote to memory of 2276	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	45
PID 1728 wrote to memory of 2276	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	45
PID 1728 wrote to memory of 2276	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	45
PID 1728 wrote to memory of 2176	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	46
PID 1728 wrote to memory of 2176	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	46
PID 1728 wrote to memory of 2176	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	46
PID 1728 wrote to memory of 1268	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	47
PID 1728 wrote to memory of 1268	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	47
PID 1728 wrote to memory of 1268	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	47
PID 1728 wrote to memory of 2152	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2152	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	48
PID 1728 wrote to memory of 2152	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	48
PID 1728 wrote to memory of 1992	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	49
PID 1728 wrote to memory of 1992	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	49
PID 1728 wrote to memory of 1992	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	49
PID 1728 wrote to memory of 3060	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	50
PID 1728 wrote to memory of 3060	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	50
PID 1728 wrote to memory of 3060	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	50
PID 1728 wrote to memory of 2880	1728	7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe	51

C:\Users\Admin\AppData\Local\Temp\7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7b5292bcaf66259c185561fb55b3f2f3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System\curQGpe.exe
  C:\Windows\System\curQGpe.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FWLtihN.exe
  C:\Windows\System\FWLtihN.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\bUnpDPh.exe
  C:\Windows\System\bUnpDPh.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\PZlCGoE.exe
  C:\Windows\System\PZlCGoE.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\hslgaow.exe
  C:\Windows\System\hslgaow.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\TEqCcdw.exe
  C:\Windows\System\TEqCcdw.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\QgWrQKz.exe
  C:\Windows\System\QgWrQKz.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ZeJNQMo.exe
  C:\Windows\System\ZeJNQMo.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\hLGjKDu.exe
  C:\Windows\System\hLGjKDu.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\YUcDrIA.exe
  C:\Windows\System\YUcDrIA.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\XApuONZ.exe
  C:\Windows\System\XApuONZ.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\OvWFBWD.exe
  C:\Windows\System\OvWFBWD.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\wuMZTEb.exe
  C:\Windows\System\wuMZTEb.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\WkRXefk.exe
  C:\Windows\System\WkRXefk.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\AfQuAfi.exe
  C:\Windows\System\AfQuAfi.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\hiVpFVs.exe
  C:\Windows\System\hiVpFVs.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ZSuuUzk.exe
  C:\Windows\System\ZSuuUzk.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\liCibvB.exe
  C:\Windows\System\liCibvB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\NbgjmiU.exe
  C:\Windows\System\NbgjmiU.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\gyJkxJX.exe
  C:\Windows\System\gyJkxJX.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\yAxYymb.exe
  C:\Windows\System\yAxYymb.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\urWAuiF.exe
  C:\Windows\System\urWAuiF.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\fTxnQmt.exe
  C:\Windows\System\fTxnQmt.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\VSHYSWm.exe
  C:\Windows\System\VSHYSWm.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\ggcVaII.exe
  C:\Windows\System\ggcVaII.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\OkrQFTf.exe
  C:\Windows\System\OkrQFTf.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\VHqoXLH.exe
  C:\Windows\System\VHqoXLH.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\iTjdMje.exe
  C:\Windows\System\iTjdMje.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\FQQRNzj.exe
  C:\Windows\System\FQQRNzj.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\iTXgDYQ.exe
  C:\Windows\System\iTXgDYQ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\qxMCytX.exe
  C:\Windows\System\qxMCytX.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\xtDFdNu.exe
  C:\Windows\System\xtDFdNu.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\iKAnvVv.exe
  C:\Windows\System\iKAnvVv.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\YqXUxNP.exe
  C:\Windows\System\YqXUxNP.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\uRXEZse.exe
  C:\Windows\System\uRXEZse.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\lNqAPtg.exe
  C:\Windows\System\lNqAPtg.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\XiBtjRD.exe
  C:\Windows\System\XiBtjRD.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\NjXRrhb.exe
  C:\Windows\System\NjXRrhb.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\hWONcTX.exe
  C:\Windows\System\hWONcTX.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\aJBjwGT.exe
  C:\Windows\System\aJBjwGT.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\LHmOJJx.exe
  C:\Windows\System\LHmOJJx.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\qeeaMgs.exe
  C:\Windows\System\qeeaMgs.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\kStgubb.exe
  C:\Windows\System\kStgubb.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\FQxWZjz.exe
  C:\Windows\System\FQxWZjz.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\nYzapqO.exe
  C:\Windows\System\nYzapqO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\QgdPLDE.exe
  C:\Windows\System\QgdPLDE.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\fLtycUW.exe
  C:\Windows\System\fLtycUW.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\CCqsQld.exe
  C:\Windows\System\CCqsQld.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\owTytjW.exe
  C:\Windows\System\owTytjW.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\gpYetuW.exe
  C:\Windows\System\gpYetuW.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\xxGzImI.exe
  C:\Windows\System\xxGzImI.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ExIbAOR.exe
  C:\Windows\System\ExIbAOR.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\zHOTlqd.exe
  C:\Windows\System\zHOTlqd.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ijEwidm.exe
  C:\Windows\System\ijEwidm.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\NRlcBtX.exe
  C:\Windows\System\NRlcBtX.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\pMovdGs.exe
  C:\Windows\System\pMovdGs.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\GOWZgPe.exe
  C:\Windows\System\GOWZgPe.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\qKVkQtk.exe
  C:\Windows\System\qKVkQtk.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ZBKLwzT.exe
  C:\Windows\System\ZBKLwzT.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\gxMHGcZ.exe
  C:\Windows\System\gxMHGcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\xKguWvl.exe
  C:\Windows\System\xKguWvl.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\dDwGBWG.exe
  C:\Windows\System\dDwGBWG.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\iGpZCmE.exe
  C:\Windows\System\iGpZCmE.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\xXpuLle.exe
  C:\Windows\System\xXpuLle.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\vTtshmA.exe
  C:\Windows\System\vTtshmA.exe
  2⤵
  PID:1128
- C:\Windows\System\lKnRYDX.exe
  C:\Windows\System\lKnRYDX.exe
  2⤵
  PID:2968
- C:\Windows\System\VzGtWOd.exe
  C:\Windows\System\VzGtWOd.exe
  2⤵
  PID:860
- C:\Windows\System\ldBDqye.exe
  C:\Windows\System\ldBDqye.exe
  2⤵
  PID:2032
- C:\Windows\System\tDkuDKE.exe
  C:\Windows\System\tDkuDKE.exe
  2⤵
  PID:2876
- C:\Windows\System\HGWhYuu.exe
  C:\Windows\System\HGWhYuu.exe
  2⤵
  PID:1956
- C:\Windows\System\QbvXcwu.exe
  C:\Windows\System\QbvXcwu.exe
  2⤵
  PID:1744
- C:\Windows\System\xjuuNPL.exe
  C:\Windows\System\xjuuNPL.exe
  2⤵
  PID:600
- C:\Windows\System\RrzHLBY.exe
  C:\Windows\System\RrzHLBY.exe
  2⤵
  PID:1216
- C:\Windows\System\ORJrGdD.exe
  C:\Windows\System\ORJrGdD.exe
  2⤵
  PID:704
- C:\Windows\System\maErpdS.exe
  C:\Windows\System\maErpdS.exe
  2⤵
  PID:3048
- C:\Windows\System\RAcLBzJ.exe
  C:\Windows\System\RAcLBzJ.exe
  2⤵
  PID:2208
- C:\Windows\System\crNMGpr.exe
  C:\Windows\System\crNMGpr.exe
  2⤵
  PID:1476
- C:\Windows\System\OQfhGEQ.exe
  C:\Windows\System\OQfhGEQ.exe
  2⤵
  PID:3012
- C:\Windows\System\rMRwDUD.exe
  C:\Windows\System\rMRwDUD.exe
  2⤵
  PID:3008
- C:\Windows\System\gDUekbS.exe
  C:\Windows\System\gDUekbS.exe
  2⤵
  PID:1624
- C:\Windows\System\sQTQOVm.exe
  C:\Windows\System\sQTQOVm.exe
  2⤵
  PID:2976
- C:\Windows\System\DLDFaHG.exe
  C:\Windows\System\DLDFaHG.exe
  2⤵
  PID:900
- C:\Windows\System\IRiTXhV.exe
  C:\Windows\System\IRiTXhV.exe
  2⤵
  PID:2908
- C:\Windows\System\gNVSdWE.exe
  C:\Windows\System\gNVSdWE.exe
  2⤵
  PID:2588
- C:\Windows\System\bTHwaca.exe
  C:\Windows\System\bTHwaca.exe
  2⤵
  PID:2604
- C:\Windows\System\ypVGtnH.exe
  C:\Windows\System\ypVGtnH.exe
  2⤵
  PID:2524
- C:\Windows\System\vwQmIil.exe
  C:\Windows\System\vwQmIil.exe
  2⤵
  PID:2280
- C:\Windows\System\rXBPAmM.exe
  C:\Windows\System\rXBPAmM.exe
  2⤵
  PID:2580
- C:\Windows\System\CyocmRs.exe
  C:\Windows\System\CyocmRs.exe
  2⤵
  PID:2084
- C:\Windows\System\KDBsGHO.exe
  C:\Windows\System\KDBsGHO.exe
  2⤵
  PID:2956
- C:\Windows\System\THTUrdR.exe
  C:\Windows\System\THTUrdR.exe
  2⤵
  PID:2624
- C:\Windows\System\uNknTiB.exe
  C:\Windows\System\uNknTiB.exe
  2⤵
  PID:2584
- C:\Windows\System\HPOqUOO.exe
  C:\Windows\System\HPOqUOO.exe
  2⤵
  PID:1352
- C:\Windows\System\bRdRnXW.exe
  C:\Windows\System\bRdRnXW.exe
  2⤵
  PID:1616
- C:\Windows\System\tywJLDE.exe
  C:\Windows\System\tywJLDE.exe
  2⤵
  PID:1520
- C:\Windows\System\NLWTDom.exe
  C:\Windows\System\NLWTDom.exe
  2⤵
  PID:340
- C:\Windows\System\vngygWR.exe
  C:\Windows\System\vngygWR.exe
  2⤵
  PID:2728
- C:\Windows\System\kKbLrho.exe
  C:\Windows\System\kKbLrho.exe
  2⤵
  PID:2848
- C:\Windows\System\jYqKfkv.exe
  C:\Windows\System\jYqKfkv.exe
  2⤵
  PID:3040
- C:\Windows\System\MUFvKjV.exe
  C:\Windows\System\MUFvKjV.exe
  2⤵
  PID:1676
- C:\Windows\System\LUFANeS.exe
  C:\Windows\System\LUFANeS.exe
  2⤵
  PID:2360
- C:\Windows\System\XxOLGuw.exe
  C:\Windows\System\XxOLGuw.exe
  2⤵
  PID:1620
- C:\Windows\System\QrnJJHb.exe
  C:\Windows\System\QrnJJHb.exe
  2⤵
  PID:3036
- C:\Windows\System\NKRTsne.exe
  C:\Windows\System\NKRTsne.exe
  2⤵
  PID:284
- C:\Windows\System\wADaWhM.exe
  C:\Windows\System\wADaWhM.exe
  2⤵
  PID:2200
- C:\Windows\System\MRQLgBB.exe
  C:\Windows\System\MRQLgBB.exe
  2⤵
  PID:1256
- C:\Windows\System\gOeqeiK.exe
  C:\Windows\System\gOeqeiK.exe
  2⤵
  PID:2596
- C:\Windows\System\XGbwFiJ.exe
  C:\Windows\System\XGbwFiJ.exe
  2⤵
  PID:2672
- C:\Windows\System\lmjcDxm.exe
  C:\Windows\System\lmjcDxm.exe
  2⤵
  PID:3092
- C:\Windows\System\MeDOIfx.exe
  C:\Windows\System\MeDOIfx.exe
  2⤵
  PID:3108
- C:\Windows\System\QbZNBaK.exe
  C:\Windows\System\QbZNBaK.exe
  2⤵
  PID:3124
- C:\Windows\System\terVEOR.exe
  C:\Windows\System\terVEOR.exe
  2⤵
  PID:3140
- C:\Windows\System\hthylZE.exe
  C:\Windows\System\hthylZE.exe
  2⤵
  PID:3156
- C:\Windows\System\yKcjcfS.exe
  C:\Windows\System\yKcjcfS.exe
  2⤵
  PID:3172
- C:\Windows\System\CXcplWe.exe
  C:\Windows\System\CXcplWe.exe
  2⤵
  PID:3192
- C:\Windows\System\lOqCGQk.exe
  C:\Windows\System\lOqCGQk.exe
  2⤵
  PID:3208
- C:\Windows\System\dllojQW.exe
  C:\Windows\System\dllojQW.exe
  2⤵
  PID:3224
- C:\Windows\System\TldvLvj.exe
  C:\Windows\System\TldvLvj.exe
  2⤵
  PID:3240
- C:\Windows\System\RABmNPY.exe
  C:\Windows\System\RABmNPY.exe
  2⤵
  PID:3256
- C:\Windows\System\jrdJHjO.exe
  C:\Windows\System\jrdJHjO.exe
  2⤵
  PID:3324
- C:\Windows\System\TVSYsSr.exe
  C:\Windows\System\TVSYsSr.exe
  2⤵
  PID:3372
- C:\Windows\System\LXAIOJx.exe
  C:\Windows\System\LXAIOJx.exe
  2⤵
  PID:3396
- C:\Windows\System\QrkkGhO.exe
  C:\Windows\System\QrkkGhO.exe
  2⤵
  PID:3432
- C:\Windows\System\MRWkDVZ.exe
  C:\Windows\System\MRWkDVZ.exe
  2⤵
  PID:3460
- C:\Windows\System\AxhCdXk.exe
  C:\Windows\System\AxhCdXk.exe
  2⤵
  PID:3500
- C:\Windows\System\miVIFfp.exe
  C:\Windows\System\miVIFfp.exe
  2⤵
  PID:3520
- C:\Windows\System\KzvnmEo.exe
  C:\Windows\System\KzvnmEo.exe
  2⤵
  PID:3548
- C:\Windows\System\hzJxjqo.exe
  C:\Windows\System\hzJxjqo.exe
  2⤵
  PID:3568
- C:\Windows\System\emXUBbl.exe
  C:\Windows\System\emXUBbl.exe
  2⤵
  PID:3588
- C:\Windows\System\zSijCTg.exe
  C:\Windows\System\zSijCTg.exe
  2⤵
  PID:3608
- C:\Windows\System\pukqwPi.exe
  C:\Windows\System\pukqwPi.exe
  2⤵
  PID:3628
- C:\Windows\System\yoBQjVX.exe
  C:\Windows\System\yoBQjVX.exe
  2⤵
  PID:3648
- C:\Windows\System\CTBbuSk.exe
  C:\Windows\System\CTBbuSk.exe
  2⤵
  PID:3668
- C:\Windows\System\xbnFiXu.exe
  C:\Windows\System\xbnFiXu.exe
  2⤵
  PID:3688
- C:\Windows\System\vaITOWT.exe
  C:\Windows\System\vaITOWT.exe
  2⤵
  PID:3708
- C:\Windows\System\zcaAhBS.exe
  C:\Windows\System\zcaAhBS.exe
  2⤵
  PID:3728
- C:\Windows\System\FegzIDx.exe
  C:\Windows\System\FegzIDx.exe
  2⤵
  PID:3748
- C:\Windows\System\YjvdwVe.exe
  C:\Windows\System\YjvdwVe.exe
  2⤵
  PID:3772
- C:\Windows\System\iIGNmfL.exe
  C:\Windows\System\iIGNmfL.exe
  2⤵
  PID:3788
- C:\Windows\System\vvLBeEB.exe
  C:\Windows\System\vvLBeEB.exe
  2⤵
  PID:3808
- C:\Windows\System\IlFlIBv.exe
  C:\Windows\System\IlFlIBv.exe
  2⤵
  PID:3828
- C:\Windows\System\CzuIcqL.exe
  C:\Windows\System\CzuIcqL.exe
  2⤵
  PID:3844
- C:\Windows\System\BcnFTSC.exe
  C:\Windows\System\BcnFTSC.exe
  2⤵
  PID:3868
- C:\Windows\System\wBFglTY.exe
  C:\Windows\System\wBFglTY.exe
  2⤵
  PID:3888
- C:\Windows\System\qEfyATb.exe
  C:\Windows\System\qEfyATb.exe
  2⤵
  PID:3912
- C:\Windows\System\XIGJQpD.exe
  C:\Windows\System\XIGJQpD.exe
  2⤵
  PID:3928
- C:\Windows\System\sbDwMqj.exe
  C:\Windows\System\sbDwMqj.exe
  2⤵
  PID:3948
- C:\Windows\System\HuOejQX.exe
  C:\Windows\System\HuOejQX.exe
  2⤵
  PID:3976
- C:\Windows\System\FHviFpE.exe
  C:\Windows\System\FHviFpE.exe
  2⤵
  PID:3992
- C:\Windows\System\hjnLJWI.exe
  C:\Windows\System\hjnLJWI.exe
  2⤵
  PID:4016
- C:\Windows\System\nJglFyM.exe
  C:\Windows\System\nJglFyM.exe
  2⤵
  PID:4036
- C:\Windows\System\nuZYlZv.exe
  C:\Windows\System\nuZYlZv.exe
  2⤵
  PID:4056
- C:\Windows\System\XSkPeCB.exe
  C:\Windows\System\XSkPeCB.exe
  2⤵
  PID:4072
- C:\Windows\System\wTFlhSh.exe
  C:\Windows\System\wTFlhSh.exe
  2⤵
  PID:4088
- C:\Windows\System\jAWCKem.exe
  C:\Windows\System\jAWCKem.exe
  2⤵
  PID:1580
- C:\Windows\System\FFlIgdK.exe
  C:\Windows\System\FFlIgdK.exe
  2⤵
  PID:2872
- C:\Windows\System\liNNbbG.exe
  C:\Windows\System\liNNbbG.exe
  2⤵
  PID:1160
- C:\Windows\System\ziWmbzW.exe
  C:\Windows\System\ziWmbzW.exe
  2⤵
  PID:1588
- C:\Windows\System\rTXRCqg.exe
  C:\Windows\System\rTXRCqg.exe
  2⤵
  PID:2636
- C:\Windows\System\WhuGBZO.exe
  C:\Windows\System\WhuGBZO.exe
  2⤵
  PID:1792
- C:\Windows\System\PdsbrMk.exe
  C:\Windows\System\PdsbrMk.exe
  2⤵
  PID:1844
- C:\Windows\System\cDQkYOi.exe
  C:\Windows\System\cDQkYOi.exe
  2⤵
  PID:2608
- C:\Windows\System\pYbqMbT.exe
  C:\Windows\System\pYbqMbT.exe
  2⤵
  PID:3200
- C:\Windows\System\zWzKNaU.exe
  C:\Windows\System\zWzKNaU.exe
  2⤵
  PID:3264
- C:\Windows\System\NKvpqdw.exe
  C:\Windows\System\NKvpqdw.exe
  2⤵
  PID:3284
- C:\Windows\System\bxxcCIn.exe
  C:\Windows\System\bxxcCIn.exe
  2⤵
  PID:3304
- C:\Windows\System\LnokrIV.exe
  C:\Windows\System\LnokrIV.exe
  2⤵
  PID:3316
- C:\Windows\System\kgQYMla.exe
  C:\Windows\System\kgQYMla.exe
  2⤵
  PID:1452
- C:\Windows\System\TgcaMfa.exe
  C:\Windows\System\TgcaMfa.exe
  2⤵
  PID:3268
- C:\Windows\System\rxjqYgr.exe
  C:\Windows\System\rxjqYgr.exe
  2⤵
  PID:3380
- C:\Windows\System\lasNZsZ.exe
  C:\Windows\System\lasNZsZ.exe
  2⤵
  PID:3392
- C:\Windows\System\FeqSXSW.exe
  C:\Windows\System\FeqSXSW.exe
  2⤵
  PID:1896
- C:\Windows\System\MExEpKq.exe
  C:\Windows\System\MExEpKq.exe
  2⤵
  PID:3448
- C:\Windows\System\fCyjOWN.exe
  C:\Windows\System\fCyjOWN.exe
  2⤵
  PID:3444
- C:\Windows\System\AGhUgwY.exe
  C:\Windows\System\AGhUgwY.exe
  2⤵
  PID:656
- C:\Windows\System\xaxMnCF.exe
  C:\Windows\System\xaxMnCF.exe
  2⤵
  PID:3488
- C:\Windows\System\YNPeTQQ.exe
  C:\Windows\System\YNPeTQQ.exe
  2⤵
  PID:1132
- C:\Windows\System\YIeyCSn.exe
  C:\Windows\System\YIeyCSn.exe
  2⤵
  PID:2684
- C:\Windows\System\kOvSJkv.exe
  C:\Windows\System\kOvSJkv.exe
  2⤵
  PID:1796
- C:\Windows\System\hjotmCK.exe
  C:\Windows\System\hjotmCK.exe
  2⤵
  PID:1888
- C:\Windows\System\bvyiggS.exe
  C:\Windows\System\bvyiggS.exe
  2⤵
  PID:2180
- C:\Windows\System\TSJGRmy.exe
  C:\Windows\System\TSJGRmy.exe
  2⤵
  PID:2228
- C:\Windows\System\EGthCag.exe
  C:\Windows\System\EGthCag.exe
  2⤵
  PID:1576
- C:\Windows\System\ltBZvQF.exe
  C:\Windows\System\ltBZvQF.exe
  2⤵
  PID:864
- C:\Windows\System\QeKGxNW.exe
  C:\Windows\System\QeKGxNW.exe
  2⤵
  PID:2936
- C:\Windows\System\uJFifjz.exe
  C:\Windows\System\uJFifjz.exe
  2⤵
  PID:3080
- C:\Windows\System\kuwfCxh.exe
  C:\Windows\System\kuwfCxh.exe
  2⤵
  PID:3184
- C:\Windows\System\avnNYfg.exe
  C:\Windows\System\avnNYfg.exe
  2⤵
  PID:3492
- C:\Windows\System\uYDcXij.exe
  C:\Windows\System\uYDcXij.exe
  2⤵
  PID:3528
- C:\Windows\System\GEfEaBS.exe
  C:\Windows\System\GEfEaBS.exe
  2⤵
  PID:3556
- C:\Windows\System\OyxQrnP.exe
  C:\Windows\System\OyxQrnP.exe
  2⤵
  PID:3560
- C:\Windows\System\TrClerK.exe
  C:\Windows\System\TrClerK.exe
  2⤵
  PID:3580
- C:\Windows\System\rMuErRf.exe
  C:\Windows\System\rMuErRf.exe
  2⤵
  PID:3624
- C:\Windows\System\GTiWHeG.exe
  C:\Windows\System\GTiWHeG.exe
  2⤵
  PID:3620
- C:\Windows\System\uuwcNvH.exe
  C:\Windows\System\uuwcNvH.exe
  2⤵
  PID:3684
- C:\Windows\System\eFepBQB.exe
  C:\Windows\System\eFepBQB.exe
  2⤵
  PID:3696
- C:\Windows\System\QwbZJkF.exe
  C:\Windows\System\QwbZJkF.exe
  2⤵
  PID:3720
- C:\Windows\System\PbgQABQ.exe
  C:\Windows\System\PbgQABQ.exe
  2⤵
  PID:3736
- C:\Windows\System\YXhuoJS.exe
  C:\Windows\System\YXhuoJS.exe
  2⤵
  PID:2856
- C:\Windows\System\NaEIUFx.exe
  C:\Windows\System\NaEIUFx.exe
  2⤵
  PID:3784
- C:\Windows\System\BbRnSbj.exe
  C:\Windows\System\BbRnSbj.exe
  2⤵
  PID:3820
- C:\Windows\System\YpQNJcC.exe
  C:\Windows\System\YpQNJcC.exe
  2⤵
  PID:3852
- C:\Windows\System\DzVZOoV.exe
  C:\Windows\System\DzVZOoV.exe
  2⤵
  PID:3880
- C:\Windows\System\xMRThiC.exe
  C:\Windows\System\xMRThiC.exe
  2⤵
  PID:1040
- C:\Windows\System\hjeDFUP.exe
  C:\Windows\System\hjeDFUP.exe
  2⤵
  PID:3920
- C:\Windows\System\lVwtuwk.exe
  C:\Windows\System\lVwtuwk.exe
  2⤵
  PID:3924
- C:\Windows\System\bOhOIcz.exe
  C:\Windows\System\bOhOIcz.exe
  2⤵
  PID:3968
- C:\Windows\System\BgRLSzK.exe
  C:\Windows\System\BgRLSzK.exe
  2⤵
  PID:1880
- C:\Windows\System\kfDgcfS.exe
  C:\Windows\System\kfDgcfS.exe
  2⤵
  PID:1144
- C:\Windows\System\pWXviec.exe
  C:\Windows\System\pWXviec.exe
  2⤵
  PID:3988
- C:\Windows\System\RDFbfFY.exe
  C:\Windows\System\RDFbfFY.exe
  2⤵
  PID:2196
- C:\Windows\System\pxaHJCv.exe
  C:\Windows\System\pxaHJCv.exe
  2⤵
  PID:4004
- C:\Windows\System\YsJVgQX.exe
  C:\Windows\System\YsJVgQX.exe
  2⤵
  PID:4044
- C:\Windows\System\yvSkZde.exe
  C:\Windows\System\yvSkZde.exe
  2⤵
  PID:2644
- C:\Windows\System\hboTqol.exe
  C:\Windows\System\hboTqol.exe
  2⤵
  PID:2364
- C:\Windows\System\IhHrFzB.exe
  C:\Windows\System\IhHrFzB.exe
  2⤵
  PID:1700
- C:\Windows\System\OdUhYTd.exe
  C:\Windows\System\OdUhYTd.exe
  2⤵
  PID:3168
- C:\Windows\System\HDjUAXh.exe
  C:\Windows\System\HDjUAXh.exe
  2⤵
  PID:3308
- C:\Windows\System\PxDxAOP.exe
  C:\Windows\System\PxDxAOP.exe
  2⤵
  PID:1940
- C:\Windows\System\TFPEGWq.exe
  C:\Windows\System\TFPEGWq.exe
  2⤵
  PID:2256
- C:\Windows\System\BNXypQh.exe
  C:\Windows\System\BNXypQh.exe
  2⤵
  PID:1232
- C:\Windows\System\mFAjNzR.exe
  C:\Windows\System\mFAjNzR.exe
  2⤵
  PID:1564
- C:\Windows\System\kpDMWRy.exe
  C:\Windows\System\kpDMWRy.exe
  2⤵
  PID:1420
- C:\Windows\System\kMJvtpL.exe
  C:\Windows\System\kMJvtpL.exe
  2⤵
  PID:2540
- C:\Windows\System\KzgVDfZ.exe
  C:\Windows\System\KzgVDfZ.exe
  2⤵
  PID:2500
- C:\Windows\System\BAgKZzA.exe
  C:\Windows\System\BAgKZzA.exe
  2⤵
  PID:3232
- C:\Windows\System\wNSLZEA.exe
  C:\Windows\System\wNSLZEA.exe
  2⤵
  PID:2076
- C:\Windows\System\MfpoGFR.exe
  C:\Windows\System\MfpoGFR.exe
  2⤵
  PID:3384
- C:\Windows\System\zdXkenj.exe
  C:\Windows\System\zdXkenj.exe
  2⤵
  PID:2172
- C:\Windows\System\DkoNzWg.exe
  C:\Windows\System\DkoNzWg.exe
  2⤵
  PID:1548
- C:\Windows\System\IGZbuha.exe
  C:\Windows\System\IGZbuha.exe
  2⤵
  PID:580
- C:\Windows\System\ymhvyTl.exe
  C:\Windows\System\ymhvyTl.exe
  2⤵
  PID:3424
- C:\Windows\System\KSVhrcd.exe
  C:\Windows\System\KSVhrcd.exe
  2⤵
  PID:3480
- C:\Windows\System\suRWyWs.exe
  C:\Windows\System\suRWyWs.exe
  2⤵
  PID:2388
- C:\Windows\System\iIFejAt.exe
  C:\Windows\System\iIFejAt.exe
  2⤵
  PID:3636
- C:\Windows\System\eRpnauh.exe
  C:\Windows\System\eRpnauh.exe
  2⤵
  PID:3680
- C:\Windows\System\kDWxCif.exe
  C:\Windows\System\kDWxCif.exe
  2⤵
  PID:3796
- C:\Windows\System\eNBlNnT.exe
  C:\Windows\System\eNBlNnT.exe
  2⤵
  PID:3840
- C:\Windows\System\rcYDgzs.exe
  C:\Windows\System\rcYDgzs.exe
  2⤵
  PID:3532
- C:\Windows\System\TbNNWth.exe
  C:\Windows\System\TbNNWth.exe
  2⤵
  PID:3936
- C:\Windows\System\bbyZVsy.exe
  C:\Windows\System\bbyZVsy.exe
  2⤵
  PID:380
- C:\Windows\System\APOzvws.exe
  C:\Windows\System\APOzvws.exe
  2⤵
  PID:2708
- C:\Windows\System\UKVzExB.exe
  C:\Windows\System\UKVzExB.exe
  2⤵
  PID:4048
- C:\Windows\System\peXHnAm.exe
  C:\Windows\System\peXHnAm.exe
  2⤵
  PID:1500
- C:\Windows\System\zupGMOn.exe
  C:\Windows\System\zupGMOn.exe
  2⤵
  PID:2616
- C:\Windows\System\OKGFtyD.exe
  C:\Windows\System\OKGFtyD.exe
  2⤵
  PID:2656
- C:\Windows\System\CqebJCG.exe
  C:\Windows\System\CqebJCG.exe
  2⤵
  PID:3876
- C:\Windows\System\YhqmrvX.exe
  C:\Windows\System\YhqmrvX.exe
  2⤵
  PID:3908
- C:\Windows\System\TeeQjRH.exe
  C:\Windows\System\TeeQjRH.exe
  2⤵
  PID:3984
- C:\Windows\System\RwMyrjk.exe
  C:\Windows\System\RwMyrjk.exe
  2⤵
  PID:4028
- C:\Windows\System\ZJCnKYB.exe
  C:\Windows\System\ZJCnKYB.exe
  2⤵
  PID:944
- C:\Windows\System\EjRhOJc.exe
  C:\Windows\System\EjRhOJc.exe
  2⤵
  PID:2072
- C:\Windows\System\EAcMVEP.exe
  C:\Windows\System\EAcMVEP.exe
  2⤵
  PID:3724
- C:\Windows\System\BxdBAwW.exe
  C:\Windows\System\BxdBAwW.exe
  2⤵
  PID:2504
- C:\Windows\System\NMnwxLE.exe
  C:\Windows\System\NMnwxLE.exe
  2⤵
  PID:1884
- C:\Windows\System\SsqeQqw.exe
  C:\Windows\System\SsqeQqw.exe
  2⤵
  PID:2496
- C:\Windows\System\sVkXpwH.exe
  C:\Windows\System\sVkXpwH.exe
  2⤵
  PID:1572
- C:\Windows\System\CVBUusF.exe
  C:\Windows\System\CVBUusF.exe
  2⤵
  PID:3220
- C:\Windows\System\cbmoBib.exe
  C:\Windows\System\cbmoBib.exe
  2⤵
  PID:3296
- C:\Windows\System\ZIuVAnZ.exe
  C:\Windows\System\ZIuVAnZ.exe
  2⤵
  PID:3348
- C:\Windows\System\PFMUTyB.exe
  C:\Windows\System\PFMUTyB.exe
  2⤵
  PID:2832
- C:\Windows\System\pVpKwfo.exe
  C:\Windows\System\pVpKwfo.exe
  2⤵
  PID:2984
- C:\Windows\System\tbKZQVc.exe
  C:\Windows\System\tbKZQVc.exe
  2⤵
  PID:3940
- C:\Windows\System\tUwaCXp.exe
  C:\Windows\System\tUwaCXp.exe
  2⤵
  PID:2828
- C:\Windows\System\rjuqWzI.exe
  C:\Windows\System\rjuqWzI.exe
  2⤵
  PID:3960
- C:\Windows\System\JUCStqJ.exe
  C:\Windows\System\JUCStqJ.exe
  2⤵
  PID:3760
- C:\Windows\System\azXLyAa.exe
  C:\Windows\System\azXLyAa.exe
  2⤵
  PID:3216
- C:\Windows\System\hwIQwFO.exe
  C:\Windows\System\hwIQwFO.exe
  2⤵
  PID:3148
- C:\Windows\System\wyVcaNw.exe
  C:\Windows\System\wyVcaNw.exe
  2⤵
  PID:3716
- C:\Windows\System\uBLnyDH.exe
  C:\Windows\System\uBLnyDH.exe
  2⤵
  PID:3972
- C:\Windows\System\jHfnvbL.exe
  C:\Windows\System\jHfnvbL.exe
  2⤵
  PID:2168
- C:\Windows\System\rHGoack.exe
  C:\Windows\System\rHGoack.exe
  2⤵
  PID:2532
- C:\Windows\System\YcjJJTn.exe
  C:\Windows\System\YcjJJTn.exe
  2⤵
  PID:3408
- C:\Windows\System\jpmDDZZ.exe
  C:\Windows\System\jpmDDZZ.exe
  2⤵
  PID:3472
- C:\Windows\System\bTyvysO.exe
  C:\Windows\System\bTyvysO.exe
  2⤵
  PID:2412
- C:\Windows\System\esrDBpG.exe
  C:\Windows\System\esrDBpG.exe
  2⤵
  PID:3660
- C:\Windows\System\QBqyNSS.exe
  C:\Windows\System\QBqyNSS.exe
  2⤵
  PID:2380
- C:\Windows\System\jWpxbIm.exe
  C:\Windows\System\jWpxbIm.exe
  2⤵
  PID:3884
- C:\Windows\System\rNpxBBI.exe
  C:\Windows\System\rNpxBBI.exe
  2⤵
  PID:4068
- C:\Windows\System\GZobULv.exe
  C:\Windows\System\GZobULv.exe
  2⤵
  PID:3900
- C:\Windows\System\tyRzDJz.exe
  C:\Windows\System\tyRzDJz.exe
  2⤵
  PID:2892
- C:\Windows\System\DokFafo.exe
  C:\Windows\System\DokFafo.exe
  2⤵
  PID:1928
- C:\Windows\System\NnaHZAV.exe
  C:\Windows\System\NnaHZAV.exe
  2⤵
  PID:3152
- C:\Windows\System\sapodyH.exe
  C:\Windows\System\sapodyH.exe
  2⤵
  PID:2000
- C:\Windows\System\OlLJmfg.exe
  C:\Windows\System\OlLJmfg.exe
  2⤵
  PID:3416
- C:\Windows\System\xjSXEkx.exe
  C:\Windows\System\xjSXEkx.exe
  2⤵
  PID:4112
- C:\Windows\System\wvTSORq.exe
  C:\Windows\System\wvTSORq.exe
  2⤵
  PID:4128
- C:\Windows\System\vAiGdXj.exe
  C:\Windows\System\vAiGdXj.exe
  2⤵
  PID:4144
- C:\Windows\System\kfxuxyl.exe
  C:\Windows\System\kfxuxyl.exe
  2⤵
  PID:4164
- C:\Windows\System\UCGmMib.exe
  C:\Windows\System\UCGmMib.exe
  2⤵
  PID:4180
- C:\Windows\System\BCLiEUt.exe
  C:\Windows\System\BCLiEUt.exe
  2⤵
  PID:4196
- C:\Windows\System\ZOEKgBp.exe
  C:\Windows\System\ZOEKgBp.exe
  2⤵
  PID:4212
- C:\Windows\System\rwVRmkh.exe
  C:\Windows\System\rwVRmkh.exe
  2⤵
  PID:4228
- C:\Windows\System\dqnxKFP.exe
  C:\Windows\System\dqnxKFP.exe
  2⤵
  PID:4244
- C:\Windows\System\IzXmqzc.exe
  C:\Windows\System\IzXmqzc.exe
  2⤵
  PID:4260
- C:\Windows\System\QxAEMTR.exe
  C:\Windows\System\QxAEMTR.exe
  2⤵
  PID:4276
- C:\Windows\System\IEOsnvb.exe
  C:\Windows\System\IEOsnvb.exe
  2⤵
  PID:4324
- C:\Windows\System\lfBIwPB.exe
  C:\Windows\System\lfBIwPB.exe
  2⤵
  PID:4344
- C:\Windows\System\dyLoYLM.exe
  C:\Windows\System\dyLoYLM.exe
  2⤵
  PID:4360
- C:\Windows\System\aPbEHDG.exe
  C:\Windows\System\aPbEHDG.exe
  2⤵
  PID:4376
- C:\Windows\System\VKkAqhz.exe
  C:\Windows\System\VKkAqhz.exe
  2⤵
  PID:4392
- C:\Windows\System\vCLCVwX.exe
  C:\Windows\System\vCLCVwX.exe
  2⤵
  PID:4520
- C:\Windows\System\dwUWtuj.exe
  C:\Windows\System\dwUWtuj.exe
  2⤵
  PID:4536
- C:\Windows\System\RlkrbqK.exe
  C:\Windows\System\RlkrbqK.exe
  2⤵
  PID:4552
- C:\Windows\System\lfYggsy.exe
  C:\Windows\System\lfYggsy.exe
  2⤵
  PID:4568
- C:\Windows\System\hKYJMVS.exe
  C:\Windows\System\hKYJMVS.exe
  2⤵
  PID:4584
- C:\Windows\System\FiYvKdP.exe
  C:\Windows\System\FiYvKdP.exe
  2⤵
  PID:4600
- C:\Windows\System\TXpBhbI.exe
  C:\Windows\System\TXpBhbI.exe
  2⤵
  PID:4616
- C:\Windows\System\EqLEzTz.exe
  C:\Windows\System\EqLEzTz.exe
  2⤵
  PID:4632
- C:\Windows\System\dgvnxiL.exe
  C:\Windows\System\dgvnxiL.exe
  2⤵
  PID:4668
- C:\Windows\System\nUGtAae.exe
  C:\Windows\System\nUGtAae.exe
  2⤵
  PID:4688
- C:\Windows\System\VJZRlVi.exe
  C:\Windows\System\VJZRlVi.exe
  2⤵
  PID:4704
- C:\Windows\System\mxTGbha.exe
  C:\Windows\System\mxTGbha.exe
  2⤵
  PID:4728
- C:\Windows\System\KneDXTp.exe
  C:\Windows\System\KneDXTp.exe
  2⤵
  PID:4760
- C:\Windows\System\DVSZBCY.exe
  C:\Windows\System\DVSZBCY.exe
  2⤵
  PID:4776
- C:\Windows\System\FOfpGAT.exe
  C:\Windows\System\FOfpGAT.exe
  2⤵
  PID:4796
- C:\Windows\System\TBsFWEy.exe
  C:\Windows\System\TBsFWEy.exe
  2⤵
  PID:4820
- C:\Windows\System\XIvlzPX.exe
  C:\Windows\System\XIvlzPX.exe
  2⤵
  PID:4860
- C:\Windows\System\rlVhtsb.exe
  C:\Windows\System\rlVhtsb.exe
  2⤵
  PID:4892
- C:\Windows\System\CaIWhUn.exe
  C:\Windows\System\CaIWhUn.exe
  2⤵
  PID:4920
- C:\Windows\System\nESmJLO.exe
  C:\Windows\System\nESmJLO.exe
  2⤵
  PID:4944
- C:\Windows\System\PvGClcP.exe
  C:\Windows\System\PvGClcP.exe
  2⤵
  PID:4960
- C:\Windows\System\nVLGcfs.exe
  C:\Windows\System\nVLGcfs.exe
  2⤵
  PID:4980
- C:\Windows\System\EXTEpYo.exe
  C:\Windows\System\EXTEpYo.exe
  2⤵
  PID:5020
- C:\Windows\System\rjrlASi.exe
  C:\Windows\System\rjrlASi.exe
  2⤵
  PID:5048
- C:\Windows\System\BWClNjG.exe
  C:\Windows\System\BWClNjG.exe
  2⤵
  PID:5064
- C:\Windows\System\tpDPpVX.exe
  C:\Windows\System\tpDPpVX.exe
  2⤵
  PID:5084
- C:\Windows\System\CPihEto.exe
  C:\Windows\System\CPihEto.exe
  2⤵
  PID:5116
- C:\Windows\System\AtAYiDm.exe
  C:\Windows\System\AtAYiDm.exe
  2⤵
  PID:3332
- C:\Windows\System\vjXVcmF.exe
  C:\Windows\System\vjXVcmF.exe
  2⤵
  PID:3816
- C:\Windows\System\lrjeBKg.exe
  C:\Windows\System\lrjeBKg.exe
  2⤵
  PID:3180
- C:\Windows\System\xvfRVUA.exe
  C:\Windows\System\xvfRVUA.exe
  2⤵
  PID:2756
- C:\Windows\System\riPBZtk.exe
  C:\Windows\System\riPBZtk.exe
  2⤵
  PID:2864
- C:\Windows\System\TUWjOCw.exe
  C:\Windows\System\TUWjOCw.exe
  2⤵
  PID:4152
- C:\Windows\System\TuhLuLk.exe
  C:\Windows\System\TuhLuLk.exe
  2⤵
  PID:4224
- C:\Windows\System\iPWTlta.exe
  C:\Windows\System\iPWTlta.exe
  2⤵
  PID:4300
- C:\Windows\System\HEoCbPC.exe
  C:\Windows\System\HEoCbPC.exe
  2⤵
  PID:3780
- C:\Windows\System\atIgGTK.exe
  C:\Windows\System\atIgGTK.exe
  2⤵
  PID:3364
- C:\Windows\System\KnVGoQY.exe
  C:\Windows\System\KnVGoQY.exe
  2⤵
  PID:3116
- C:\Windows\System\aljqZUP.exe
  C:\Windows\System\aljqZUP.exe
  2⤵
  PID:2560
- C:\Windows\System\yzVBeTE.exe
  C:\Windows\System\yzVBeTE.exe
  2⤵
  PID:2744
- C:\Windows\System\nEcJuRl.exe
  C:\Windows\System\nEcJuRl.exe
  2⤵
  PID:4012
- C:\Windows\System\QZRiZkp.exe
  C:\Windows\System\QZRiZkp.exe
  2⤵
  PID:4172
- C:\Windows\System\RJiQuem.exe
  C:\Windows\System\RJiQuem.exe
  2⤵
  PID:4404
- C:\Windows\System\EONdPYH.exe
  C:\Windows\System\EONdPYH.exe
  2⤵
  PID:4440
- C:\Windows\System\RaKPDyY.exe
  C:\Windows\System\RaKPDyY.exe
  2⤵
  PID:4456
- C:\Windows\System\fJXpeRf.exe
  C:\Windows\System\fJXpeRf.exe
  2⤵
  PID:4488
- C:\Windows\System\JHXIpsf.exe
  C:\Windows\System\JHXIpsf.exe
  2⤵
  PID:4480
- C:\Windows\System\ICNFDcM.exe
  C:\Windows\System\ICNFDcM.exe
  2⤵
  PID:4512
- C:\Windows\System\vrIfgew.exe
  C:\Windows\System\vrIfgew.exe
  2⤵
  PID:4548
- C:\Windows\System\gvTkUCc.exe
  C:\Windows\System\gvTkUCc.exe
  2⤵
  PID:4560
- C:\Windows\System\kgluEYL.exe
  C:\Windows\System\kgluEYL.exe
  2⤵
  PID:4628
- C:\Windows\System\eZdjrlb.exe
  C:\Windows\System\eZdjrlb.exe
  2⤵
  PID:4648
- C:\Windows\System\LgCUzMt.exe
  C:\Windows\System\LgCUzMt.exe
  2⤵
  PID:4664
- C:\Windows\System\SgSHnLm.exe
  C:\Windows\System\SgSHnLm.exe
  2⤵
  PID:4696
- C:\Windows\System\NfzsDOS.exe
  C:\Windows\System\NfzsDOS.exe
  2⤵
  PID:4724
- C:\Windows\System\wUpfYHE.exe
  C:\Windows\System\wUpfYHE.exe
  2⤵
  PID:4740
- C:\Windows\System\bGqVxII.exe
  C:\Windows\System\bGqVxII.exe
  2⤵
  PID:4756
- C:\Windows\System\sGkdnyV.exe
  C:\Windows\System\sGkdnyV.exe
  2⤵
  PID:4788
- C:\Windows\System\rAhiFFY.exe
  C:\Windows\System\rAhiFFY.exe
  2⤵
  PID:4808
- C:\Windows\System\ALLWMpu.exe
  C:\Windows\System\ALLWMpu.exe
  2⤵
  PID:4840
- C:\Windows\System\YNXAgWn.exe
  C:\Windows\System\YNXAgWn.exe
  2⤵
  PID:4884
- C:\Windows\System\lAUocVs.exe
  C:\Windows\System\lAUocVs.exe
  2⤵
  PID:4976
- C:\Windows\System\FrCRsop.exe
  C:\Windows\System\FrCRsop.exe
  2⤵
  PID:5036
- C:\Windows\System\nidkliE.exe
  C:\Windows\System\nidkliE.exe
  2⤵
  PID:5000
- C:\Windows\System\bTqjiyR.exe
  C:\Windows\System\bTqjiyR.exe
  2⤵
  PID:4992
- C:\Windows\System\GLtIPqf.exe
  C:\Windows\System\GLtIPqf.exe
  2⤵
  PID:5072
- C:\Windows\System\pTsSYBC.exe
  C:\Windows\System\pTsSYBC.exe
  2⤵
  PID:3280
- C:\Windows\System\OXHvJoA.exe
  C:\Windows\System\OXHvJoA.exe
  2⤵
  PID:1892
- C:\Windows\System\zpRZXMD.exe
  C:\Windows\System\zpRZXMD.exe
  2⤵
  PID:4160
- C:\Windows\System\vzKgsnR.exe
  C:\Windows\System\vzKgsnR.exe
  2⤵
  PID:3476
- C:\Windows\System\RMwWBvE.exe
  C:\Windows\System\RMwWBvE.exe
  2⤵
  PID:4316
- C:\Windows\System\eCjUxDQ.exe
  C:\Windows\System\eCjUxDQ.exe
  2⤵
  PID:4352
- C:\Windows\System\mxghLOx.exe
  C:\Windows\System\mxghLOx.exe
  2⤵
  PID:3800
- C:\Windows\System\cmmapHs.exe
  C:\Windows\System\cmmapHs.exe
  2⤵
  PID:4416
- C:\Windows\System\WRXFTZk.exe
  C:\Windows\System\WRXFTZk.exe
  2⤵
  PID:4384
- C:\Windows\System\LqjHXGr.exe
  C:\Windows\System\LqjHXGr.exe
  2⤵
  PID:4120
- C:\Windows\System\EDVOdlH.exe
  C:\Windows\System\EDVOdlH.exe
  2⤵
  PID:2216
- C:\Windows\System\SWxgnmI.exe
  C:\Windows\System\SWxgnmI.exe
  2⤵
  PID:4508
- C:\Windows\System\BYpJmEf.exe
  C:\Windows\System\BYpJmEf.exe
  2⤵
  PID:4192
- C:\Windows\System\sSNgiHC.exe
  C:\Windows\System\sSNgiHC.exe
  2⤵
  PID:4336
- C:\Windows\System\AuBwQnr.exe
  C:\Windows\System\AuBwQnr.exe
  2⤵
  PID:4428
- C:\Windows\System\AFbJxNA.exe
  C:\Windows\System\AFbJxNA.exe
  2⤵
  PID:4968
- C:\Windows\System\rVAbqEF.exe
  C:\Windows\System\rVAbqEF.exe
  2⤵
  PID:4448
- C:\Windows\System\OeFFufr.exe
  C:\Windows\System\OeFFufr.exe
  2⤵
  PID:4720
- C:\Windows\System\VmpnMcp.exe
  C:\Windows\System\VmpnMcp.exe
  2⤵
  PID:4784
- C:\Windows\System\fXlFSPF.exe
  C:\Windows\System\fXlFSPF.exe
  2⤵
  PID:4484
- C:\Windows\System\FHDsadI.exe
  C:\Windows\System\FHDsadI.exe
  2⤵
  PID:4872
- C:\Windows\System\UhtssgH.exe
  C:\Windows\System\UhtssgH.exe
  2⤵
  PID:4952
- C:\Windows\System\UlnGPmC.exe
  C:\Windows\System\UlnGPmC.exe
  2⤵
  PID:4848
- C:\Windows\System\pyBaCGB.exe
  C:\Windows\System\pyBaCGB.exe
  2⤵
  PID:4908
- C:\Windows\System\crmSslM.exe
  C:\Windows\System\crmSslM.exe
  2⤵
  PID:4988
- C:\Windows\System\RmlucRX.exe
  C:\Windows\System\RmlucRX.exe
  2⤵
  PID:5076
- C:\Windows\System\SfytqsQ.exe
  C:\Windows\System\SfytqsQ.exe
  2⤵
  PID:4408
- C:\Windows\System\mMsrnXV.exe
  C:\Windows\System\mMsrnXV.exe
  2⤵
  PID:3100
- C:\Windows\System\nlmxbko.exe
  C:\Windows\System\nlmxbko.exe
  2⤵
  PID:4136
- C:\Windows\System\keXUQUV.exe
  C:\Windows\System\keXUQUV.exe
  2⤵
  PID:3076
- C:\Windows\System\TqhgkLT.exe
  C:\Windows\System\TqhgkLT.exe
  2⤵
  PID:4252
- C:\Windows\System\mFXTnzA.exe
  C:\Windows\System\mFXTnzA.exe
  2⤵
  PID:4356
- C:\Windows\System\OIzIvMR.exe
  C:\Windows\System\OIzIvMR.exe
  2⤵
  PID:4460
- C:\Windows\System\mbFmCQH.exe
  C:\Windows\System\mbFmCQH.exe
  2⤵
  PID:4320
- C:\Windows\System\rEzDJgM.exe
  C:\Windows\System\rEzDJgM.exe
  2⤵
  PID:4596
- C:\Windows\System\DlaltAG.exe
  C:\Windows\System\DlaltAG.exe
  2⤵
  PID:4676
- C:\Windows\System\dUgNDwX.exe
  C:\Windows\System\dUgNDwX.exe
  2⤵
  PID:4660
- C:\Windows\System\xmpNSSb.exe
  C:\Windows\System\xmpNSSb.exe
  2⤵
  PID:4592
- C:\Windows\System\ioAZTeW.exe
  C:\Windows\System\ioAZTeW.exe
  2⤵
  PID:4528
- C:\Windows\System\kPZfafU.exe
  C:\Windows\System\kPZfafU.exe
  2⤵
  PID:4792
- C:\Windows\System\deHAjcR.exe
  C:\Windows\System\deHAjcR.exe
  2⤵
  PID:4880
- C:\Windows\System\JRJSkby.exe
  C:\Windows\System\JRJSkby.exe
  2⤵
  PID:4900
- C:\Windows\System\vUDvfbP.exe
  C:\Windows\System\vUDvfbP.exe
  2⤵
  PID:5028
- C:\Windows\System\bAnhehA.exe
  C:\Windows\System\bAnhehA.exe
  2⤵
  PID:4836
- C:\Windows\System\oKRMKdA.exe
  C:\Windows\System\oKRMKdA.exe
  2⤵
  PID:5096
- C:\Windows\System\fvyWyVE.exe
  C:\Windows\System\fvyWyVE.exe
  2⤵
  PID:2296
- C:\Windows\System\jHGqhsl.exe
  C:\Windows\System\jHGqhsl.exe
  2⤵
  PID:1920
- C:\Windows\System\qyzuPIo.exe
  C:\Windows\System\qyzuPIo.exe
  2⤵
  PID:4240
- C:\Windows\System\CtecKUU.exe
  C:\Windows\System\CtecKUU.exe
  2⤵
  PID:4432
- C:\Windows\System\uTCrKVO.exe
  C:\Windows\System\uTCrKVO.exe
  2⤵
  PID:4504
- C:\Windows\System\cYkrIsb.exe
  C:\Windows\System\cYkrIsb.exe
  2⤵
  PID:4424
- C:\Windows\System\peXdlUX.exe
  C:\Windows\System\peXdlUX.exe
  2⤵
  PID:4496
- C:\Windows\System\svVZPrW.exe
  C:\Windows\System\svVZPrW.exe
  2⤵
  PID:4916
- C:\Windows\System\RBjmaVT.exe
  C:\Windows\System\RBjmaVT.exe
  2⤵
  PID:4940
- C:\Windows\System\MwVNdtP.exe
  C:\Windows\System\MwVNdtP.exe
  2⤵
  PID:4772
- C:\Windows\System\HhWDiNo.exe
  C:\Windows\System\HhWDiNo.exe
  2⤵
  PID:5056
- C:\Windows\System\UMwiVuE.exe
  C:\Windows\System\UMwiVuE.exe
  2⤵
  PID:4204
- C:\Windows\System\FGdoiBY.exe
  C:\Windows\System\FGdoiBY.exe
  2⤵
  PID:4084
- C:\Windows\System\PHzlYUl.exe
  C:\Windows\System\PHzlYUl.exe
  2⤵
  PID:4388
- C:\Windows\System\GfPGAZc.exe
  C:\Windows\System\GfPGAZc.exe
  2⤵
  PID:4368
- C:\Windows\System\zqNCTWa.exe
  C:\Windows\System\zqNCTWa.exe
  2⤵
  PID:5140
- C:\Windows\System\WOIqPyY.exe
  C:\Windows\System\WOIqPyY.exe
  2⤵
  PID:5156
- C:\Windows\System\zttzgwy.exe
  C:\Windows\System\zttzgwy.exe
  2⤵
  PID:5172
- C:\Windows\System\mcRyrqe.exe
  C:\Windows\System\mcRyrqe.exe
  2⤵
  PID:5188
- C:\Windows\System\Gajzvcz.exe
  C:\Windows\System\Gajzvcz.exe
  2⤵
  PID:5204
- C:\Windows\System\jlStTuc.exe
  C:\Windows\System\jlStTuc.exe
  2⤵
  PID:5220
- C:\Windows\System\eGfLVCZ.exe
  C:\Windows\System\eGfLVCZ.exe
  2⤵
  PID:5240
- C:\Windows\System\WYqOcoP.exe
  C:\Windows\System\WYqOcoP.exe
  2⤵
  PID:5256
- C:\Windows\System\mfbzJwa.exe
  C:\Windows\System\mfbzJwa.exe
  2⤵
  PID:5272
- C:\Windows\System\JDtlPCp.exe
  C:\Windows\System\JDtlPCp.exe
  2⤵
  PID:5292
- C:\Windows\System\TcWTWDU.exe
  C:\Windows\System\TcWTWDU.exe
  2⤵
  PID:5308
- C:\Windows\System\rGLniER.exe
  C:\Windows\System\rGLniER.exe
  2⤵
  PID:5324
- C:\Windows\System\JzvMIkn.exe
  C:\Windows\System\JzvMIkn.exe
  2⤵
  PID:5340
- C:\Windows\System\ACEUpYj.exe
  C:\Windows\System\ACEUpYj.exe
  2⤵
  PID:5356
- C:\Windows\System\TwrXPlB.exe
  C:\Windows\System\TwrXPlB.exe
  2⤵
  PID:5372
- C:\Windows\System\KvtRhxM.exe
  C:\Windows\System\KvtRhxM.exe
  2⤵
  PID:5388
- C:\Windows\System\QxvggAu.exe
  C:\Windows\System\QxvggAu.exe
  2⤵
  PID:5404
- C:\Windows\System\FLUsoFi.exe
  C:\Windows\System\FLUsoFi.exe
  2⤵
  PID:5420
- C:\Windows\System\oCHYGIh.exe
  C:\Windows\System\oCHYGIh.exe
  2⤵
  PID:5436
- C:\Windows\System\UzFNfbU.exe
  C:\Windows\System\UzFNfbU.exe
  2⤵
  PID:5452
- C:\Windows\System\lwvKFzw.exe
  C:\Windows\System\lwvKFzw.exe
  2⤵
  PID:5468
- C:\Windows\System\MToTcgl.exe
  C:\Windows\System\MToTcgl.exe
  2⤵
  PID:5484
- C:\Windows\System\tlSBtRA.exe
  C:\Windows\System\tlSBtRA.exe
  2⤵
  PID:5504
- C:\Windows\System\MVNDbpK.exe
  C:\Windows\System\MVNDbpK.exe
  2⤵
  PID:5520
- C:\Windows\System\SrMnBCH.exe
  C:\Windows\System\SrMnBCH.exe
  2⤵
  PID:5536
- C:\Windows\System\rkARzho.exe
  C:\Windows\System\rkARzho.exe
  2⤵
  PID:5552
- C:\Windows\System\vDYEKXA.exe
  C:\Windows\System\vDYEKXA.exe
  2⤵
  PID:5568
- C:\Windows\System\zauLFkF.exe
  C:\Windows\System\zauLFkF.exe
  2⤵
  PID:5584
- C:\Windows\System\XAQtsbg.exe
  C:\Windows\System\XAQtsbg.exe
  2⤵
  PID:5600
- C:\Windows\System\EuOQvPa.exe
  C:\Windows\System\EuOQvPa.exe
  2⤵
  PID:5616
- C:\Windows\System\GUUzHVk.exe
  C:\Windows\System\GUUzHVk.exe
  2⤵
  PID:5632
- C:\Windows\System\vucxsLf.exe
  C:\Windows\System\vucxsLf.exe
  2⤵
  PID:5660
- C:\Windows\System\dZJemYD.exe
  C:\Windows\System\dZJemYD.exe
  2⤵
  PID:5676
- C:\Windows\System\KfVRGpq.exe
  C:\Windows\System\KfVRGpq.exe
  2⤵
  PID:5692
- C:\Windows\System\eaQkTDR.exe
  C:\Windows\System\eaQkTDR.exe
  2⤵
  PID:5712
- C:\Windows\System\UBivBYm.exe
  C:\Windows\System\UBivBYm.exe
  2⤵
  PID:5728
- C:\Windows\System\sRXGQBs.exe
  C:\Windows\System\sRXGQBs.exe
  2⤵
  PID:5744
- C:\Windows\System\EYinmqT.exe
  C:\Windows\System\EYinmqT.exe
  2⤵
  PID:5760
- C:\Windows\System\EFJvfnx.exe
  C:\Windows\System\EFJvfnx.exe
  2⤵
  PID:5776
- C:\Windows\System\YSpHheE.exe
  C:\Windows\System\YSpHheE.exe
  2⤵
  PID:5792
- C:\Windows\System\gapgKBo.exe
  C:\Windows\System\gapgKBo.exe
  2⤵
  PID:5808
- C:\Windows\System\MhAjMky.exe
  C:\Windows\System\MhAjMky.exe
  2⤵
  PID:5824
- C:\Windows\System\JKTwAjl.exe
  C:\Windows\System\JKTwAjl.exe
  2⤵
  PID:5840
- C:\Windows\System\XVekZLi.exe
  C:\Windows\System\XVekZLi.exe
  2⤵
  PID:5856
- C:\Windows\System\avipoUs.exe
  C:\Windows\System\avipoUs.exe
  2⤵
  PID:5872
- C:\Windows\System\teuLSzy.exe
  C:\Windows\System\teuLSzy.exe
  2⤵
  PID:5888
- C:\Windows\System\DfFwGHP.exe
  C:\Windows\System\DfFwGHP.exe
  2⤵
  PID:5904
- C:\Windows\System\AksnArG.exe
  C:\Windows\System\AksnArG.exe
  2⤵
  PID:5920
- C:\Windows\System\bEjjQko.exe
  C:\Windows\System\bEjjQko.exe
  2⤵
  PID:5936
- C:\Windows\System\XNkKBgA.exe
  C:\Windows\System\XNkKBgA.exe
  2⤵
  PID:5952
- C:\Windows\System\LAsxTbr.exe
  C:\Windows\System\LAsxTbr.exe
  2⤵
  PID:5968
- C:\Windows\System\MPIozOj.exe
  C:\Windows\System\MPIozOj.exe
  2⤵
  PID:5984
- C:\Windows\System\UKSsnys.exe
  C:\Windows\System\UKSsnys.exe
  2⤵
  PID:6000
- C:\Windows\System\NnrrzmY.exe
  C:\Windows\System\NnrrzmY.exe
  2⤵
  PID:6016
- C:\Windows\System\mTcAhPG.exe
  C:\Windows\System\mTcAhPG.exe
  2⤵
  PID:6032
- C:\Windows\System\dtjZuEc.exe
  C:\Windows\System\dtjZuEc.exe
  2⤵
  PID:6048
- C:\Windows\System\yikOAZA.exe
  C:\Windows\System\yikOAZA.exe
  2⤵
  PID:6064
- C:\Windows\System\FzooeJW.exe
  C:\Windows\System\FzooeJW.exe
  2⤵
  PID:6080
- C:\Windows\System\gicoblR.exe
  C:\Windows\System\gicoblR.exe
  2⤵
  PID:6096
- C:\Windows\System\VaXIlBU.exe
  C:\Windows\System\VaXIlBU.exe
  2⤵
  PID:6112
- C:\Windows\System\lRGTheI.exe
  C:\Windows\System\lRGTheI.exe
  2⤵
  PID:6128
- C:\Windows\System\szKGqBg.exe
  C:\Windows\System\szKGqBg.exe
  2⤵
  PID:4468
- C:\Windows\System\AqxATkv.exe
  C:\Windows\System\AqxATkv.exe
  2⤵
  PID:4400
- C:\Windows\System\kTsNWEA.exe
  C:\Windows\System\kTsNWEA.exe
  2⤵
  PID:4624
- C:\Windows\System\pDsymtK.exe
  C:\Windows\System\pDsymtK.exe
  2⤵
  PID:5136
- C:\Windows\System\bgxeQtp.exe
  C:\Windows\System\bgxeQtp.exe
  2⤵
  PID:5200
- C:\Windows\System\GTUrsbM.exe
  C:\Windows\System\GTUrsbM.exe
  2⤵
  PID:4904
- C:\Windows\System\OkJTroL.exe
  C:\Windows\System\OkJTroL.exe
  2⤵
  PID:4296
- C:\Windows\System\QugCGdX.exe
  C:\Windows\System\QugCGdX.exe
  2⤵
  PID:5180
- C:\Windows\System\qVUDRkH.exe
  C:\Windows\System\qVUDRkH.exe
  2⤵
  PID:5252
- C:\Windows\System\ynUyTHS.exe
  C:\Windows\System\ynUyTHS.exe
  2⤵
  PID:5212
- C:\Windows\System\aHsjUjV.exe
  C:\Windows\System\aHsjUjV.exe
  2⤵
  PID:5268
- C:\Windows\System\KMKcepX.exe
  C:\Windows\System\KMKcepX.exe
  2⤵
  PID:5416
- C:\Windows\System\qtobDDa.exe
  C:\Windows\System\qtobDDa.exe
  2⤵
  PID:5480
- C:\Windows\System\PeHQxBO.exe
  C:\Windows\System\PeHQxBO.exe
  2⤵
  PID:5400
- C:\Windows\System\WwTPxmf.exe
  C:\Windows\System\WwTPxmf.exe
  2⤵
  PID:5336
- C:\Windows\System\NsFIcpS.exe
  C:\Windows\System\NsFIcpS.exe
  2⤵
  PID:5464
- C:\Windows\System\oVsFbiI.exe
  C:\Windows\System\oVsFbiI.exe
  2⤵
  PID:5516
- C:\Windows\System\HNvBkwD.exe
  C:\Windows\System\HNvBkwD.exe
  2⤵
  PID:5580
- C:\Windows\System\YFkAhnY.exe
  C:\Windows\System\YFkAhnY.exe
  2⤵
  PID:5644
- C:\Windows\System\qwlTDdn.exe
  C:\Windows\System\qwlTDdn.exe
  2⤵
  PID:5648
- C:\Windows\System\wOODjRG.exe
  C:\Windows\System\wOODjRG.exe
  2⤵
  PID:5564
- C:\Windows\System\IhtfkpB.exe
  C:\Windows\System\IhtfkpB.exe
  2⤵
  PID:5628
- C:\Windows\System\fDbAphp.exe
  C:\Windows\System\fDbAphp.exe
  2⤵
  PID:5700
- C:\Windows\System\gHXioBK.exe
  C:\Windows\System\gHXioBK.exe
  2⤵
  PID:5736
- C:\Windows\System\ZiXonli.exe
  C:\Windows\System\ZiXonli.exe
  2⤵
  PID:5784
- C:\Windows\System\FtWltRm.exe
  C:\Windows\System\FtWltRm.exe
  2⤵
  PID:5816
- C:\Windows\System\jxABMCM.exe
  C:\Windows\System\jxABMCM.exe
  2⤵
  PID:5944
- C:\Windows\System\mJZttIc.exe
  C:\Windows\System\mJZttIc.exe
  2⤵
  PID:6008
- C:\Windows\System\OYSHlpN.exe
  C:\Windows\System\OYSHlpN.exe
  2⤵
  PID:6072
- C:\Windows\System\MYaBKAJ.exe
  C:\Windows\System\MYaBKAJ.exe
  2⤵
  PID:6136
- C:\Windows\System\sMEJWmb.exe
  C:\Windows\System\sMEJWmb.exe
  2⤵
  PID:5800
- C:\Windows\System\TBdBzwM.exe
  C:\Windows\System\TBdBzwM.exe
  2⤵
  PID:6028
- C:\Windows\System\XcISvFf.exe
  C:\Windows\System\XcISvFf.exe
  2⤵
  PID:5836
- C:\Windows\System\AqLvEpc.exe
  C:\Windows\System\AqLvEpc.exe
  2⤵
  PID:5932
- C:\Windows\System\SIPJcVR.exe
  C:\Windows\System\SIPJcVR.exe
  2⤵
  PID:6024
- C:\Windows\System\GMshihn.exe
  C:\Windows\System\GMshihn.exe
  2⤵
  PID:6060
- C:\Windows\System\hYNYqBb.exe
  C:\Windows\System\hYNYqBb.exe
  2⤵
  PID:5100
- C:\Windows\System\tRPsvpA.exe
  C:\Windows\System\tRPsvpA.exe
  2⤵
  PID:5476
- C:\Windows\System\FFUKwlu.exe
  C:\Windows\System\FFUKwlu.exe
  2⤵
  PID:5148
- C:\Windows\System\qTNldCG.exe
  C:\Windows\System\qTNldCG.exe
  2⤵
  PID:5380
- C:\Windows\System\VAuCwQQ.exe
  C:\Windows\System\VAuCwQQ.exe
  2⤵
  PID:5428
- C:\Windows\System\zmxZRJT.exe
  C:\Windows\System\zmxZRJT.exe
  2⤵
  PID:5500
- C:\Windows\System\DlyGsLa.exe
  C:\Windows\System\DlyGsLa.exe
  2⤵
  PID:5668
- C:\Windows\System\RHOTKKH.exe
  C:\Windows\System\RHOTKKH.exe
  2⤵
  PID:5624
- C:\Windows\System\NhtuesW.exe
  C:\Windows\System\NhtuesW.exe
  2⤵
  PID:5752
- C:\Windows\System\SkyHKBW.exe
  C:\Windows\System\SkyHKBW.exe
  2⤵
  PID:5912
- C:\Windows\System\hlHswTF.exe
  C:\Windows\System\hlHswTF.exe
  2⤵
  PID:4852
- C:\Windows\System\ZqDsvTr.exe
  C:\Windows\System\ZqDsvTr.exe
  2⤵
  PID:5964
- C:\Windows\System\tyDvBEN.exe
  C:\Windows\System\tyDvBEN.exe
  2⤵
  PID:5704
- C:\Windows\System\TzqXARb.exe
  C:\Windows\System\TzqXARb.exe
  2⤵
  PID:5788
- C:\Windows\System\OckjqIk.exe
  C:\Windows\System\OckjqIk.exe
  2⤵
  PID:6108
- C:\Windows\System\cgpFcLe.exe
  C:\Windows\System\cgpFcLe.exe
  2⤵
  PID:5900
- C:\Windows\System\AElryRA.exe
  C:\Windows\System\AElryRA.exe
  2⤵
  PID:6056
- C:\Windows\System\CliEqqU.exe
  C:\Windows\System\CliEqqU.exe
  2⤵
  PID:6124
- C:\Windows\System\lDsJJEf.exe
  C:\Windows\System\lDsJJEf.exe
  2⤵
  PID:5284
- C:\Windows\System\IIvtTTB.exe
  C:\Windows\System\IIvtTTB.exe
  2⤵
  PID:5320
- C:\Windows\System\QxgbgQA.exe
  C:\Windows\System\QxgbgQA.exe
  2⤵
  PID:5236
- C:\Windows\System\VUSPhtV.exe
  C:\Windows\System\VUSPhtV.exe
  2⤵
  PID:5640
- C:\Windows\System\qpZzyOR.exe
  C:\Windows\System\qpZzyOR.exe
  2⤵
  PID:6044
- C:\Windows\System\AwXeKAg.exe
  C:\Windows\System\AwXeKAg.exe
  2⤵
  PID:5104
- C:\Windows\System\pgWiWcK.exe
  C:\Windows\System\pgWiWcK.exe
  2⤵
  PID:5880
- C:\Windows\System\veQXCbw.exe
  C:\Windows\System\veQXCbw.exe
  2⤵
  PID:5832
- C:\Windows\System\Kptiaaf.exe
  C:\Windows\System\Kptiaaf.exe
  2⤵
  PID:5128
- C:\Windows\System\cKNuXlA.exe
  C:\Windows\System\cKNuXlA.exe
  2⤵
  PID:4108
- C:\Windows\System\OKAfuSi.exe
  C:\Windows\System\OKAfuSi.exe
  2⤵
  PID:6088
- C:\Windows\System\mWpYhQo.exe
  C:\Windows\System\mWpYhQo.exe
  2⤵
  PID:5684
- C:\Windows\System\MgjeMZs.exe
  C:\Windows\System\MgjeMZs.exe
  2⤵
  PID:5432
- C:\Windows\System\xLQVjwL.exe
  C:\Windows\System\xLQVjwL.exe
  2⤵
  PID:5352
- C:\Windows\System\sxETtaa.exe
  C:\Windows\System\sxETtaa.exe
  2⤵
  PID:5980
- C:\Windows\System\vDwfITd.exe
  C:\Windows\System\vDwfITd.exe
  2⤵
  PID:6168
- C:\Windows\System\lTCoBNC.exe
  C:\Windows\System\lTCoBNC.exe
  2⤵
  PID:6184
- C:\Windows\System\nOHPoUo.exe
  C:\Windows\System\nOHPoUo.exe
  2⤵
  PID:6204
- C:\Windows\System\IcbEVLL.exe
  C:\Windows\System\IcbEVLL.exe
  2⤵
  PID:6220
- C:\Windows\System\nAvvgyo.exe
  C:\Windows\System\nAvvgyo.exe
  2⤵
  PID:6236
- C:\Windows\System\rxhprVE.exe
  C:\Windows\System\rxhprVE.exe
  2⤵
  PID:6252
- C:\Windows\System\RIhQNud.exe
  C:\Windows\System\RIhQNud.exe
  2⤵
  PID:6268
- C:\Windows\System\jHHgznM.exe
  C:\Windows\System\jHHgznM.exe
  2⤵
  PID:6284
- C:\Windows\System\yrtpiMG.exe
  C:\Windows\System\yrtpiMG.exe
  2⤵
  PID:6300
- C:\Windows\System\sSwAFps.exe
  C:\Windows\System\sSwAFps.exe
  2⤵
  PID:6320
- C:\Windows\System\iXFpnhR.exe
  C:\Windows\System\iXFpnhR.exe
  2⤵
  PID:6340
- C:\Windows\System\TqxJjtE.exe
  C:\Windows\System\TqxJjtE.exe
  2⤵
  PID:6356
- C:\Windows\System\AjIxgKZ.exe
  C:\Windows\System\AjIxgKZ.exe
  2⤵
  PID:6376
- C:\Windows\System\ncdggDY.exe
  C:\Windows\System\ncdggDY.exe
  2⤵
  PID:6392
- C:\Windows\System\jtTubza.exe
  C:\Windows\System\jtTubza.exe
  2⤵
  PID:6408
- C:\Windows\System\YJJesgO.exe
  C:\Windows\System\YJJesgO.exe
  2⤵
  PID:6424
- C:\Windows\System\yPvpATz.exe
  C:\Windows\System\yPvpATz.exe
  2⤵
  PID:6444
- C:\Windows\System\trWXBkJ.exe
  C:\Windows\System\trWXBkJ.exe
  2⤵
  PID:6460
- C:\Windows\System\ccuApld.exe
  C:\Windows\System\ccuApld.exe
  2⤵
  PID:6476
- C:\Windows\System\OkyiHDO.exe
  C:\Windows\System\OkyiHDO.exe
  2⤵
  PID:6492
- C:\Windows\System\LmvuRgR.exe
  C:\Windows\System\LmvuRgR.exe
  2⤵
  PID:6508
- C:\Windows\System\GJlZXqN.exe
  C:\Windows\System\GJlZXqN.exe
  2⤵
  PID:6524
- C:\Windows\System\liuMlrz.exe
  C:\Windows\System\liuMlrz.exe
  2⤵
  PID:6544
- C:\Windows\System\zcFWGjX.exe
  C:\Windows\System\zcFWGjX.exe
  2⤵
  PID:6560
- C:\Windows\System\BbrGbVT.exe
  C:\Windows\System\BbrGbVT.exe
  2⤵
  PID:6576
- C:\Windows\System\NRSKXFL.exe
  C:\Windows\System\NRSKXFL.exe
  2⤵
  PID:6592
- C:\Windows\System\EafTdgM.exe
  C:\Windows\System\EafTdgM.exe
  2⤵
  PID:6612
- C:\Windows\System\lVuzUwi.exe
  C:\Windows\System\lVuzUwi.exe
  2⤵
  PID:6632
- C:\Windows\System\aoAcUEY.exe
  C:\Windows\System\aoAcUEY.exe
  2⤵
  PID:6648
- C:\Windows\System\KPLDPKM.exe
  C:\Windows\System\KPLDPKM.exe
  2⤵
  PID:6664
- C:\Windows\System\mlnJInC.exe
  C:\Windows\System\mlnJInC.exe
  2⤵
  PID:6680
- C:\Windows\System\NjLMOsk.exe
  C:\Windows\System\NjLMOsk.exe
  2⤵
  PID:6696
- C:\Windows\System\iSqDMfm.exe
  C:\Windows\System\iSqDMfm.exe
  2⤵
  PID:6716
- C:\Windows\System\FPThgEA.exe
  C:\Windows\System\FPThgEA.exe
  2⤵
  PID:6732
- C:\Windows\System\uqlvcll.exe
  C:\Windows\System\uqlvcll.exe
  2⤵
  PID:6748
- C:\Windows\System\lqUuWzA.exe
  C:\Windows\System\lqUuWzA.exe
  2⤵
  PID:6764
- C:\Windows\System\LgzJhOp.exe
  C:\Windows\System\LgzJhOp.exe
  2⤵
  PID:6780
- C:\Windows\System\roZvbmt.exe
  C:\Windows\System\roZvbmt.exe
  2⤵
  PID:6796
- C:\Windows\System\OjDpvAR.exe
  C:\Windows\System\OjDpvAR.exe
  2⤵
  PID:6812
- C:\Windows\System\bewroPV.exe
  C:\Windows\System\bewroPV.exe
  2⤵
  PID:6828
- C:\Windows\System\voiuyMJ.exe
  C:\Windows\System\voiuyMJ.exe
  2⤵
  PID:6844
- C:\Windows\System\qnUsdUj.exe
  C:\Windows\System\qnUsdUj.exe
  2⤵
  PID:6860
- C:\Windows\System\sMakGUq.exe
  C:\Windows\System\sMakGUq.exe
  2⤵
  PID:6876
- C:\Windows\System\zdPvhRt.exe
  C:\Windows\System\zdPvhRt.exe
  2⤵
  PID:6892
- C:\Windows\System\JDpsKrD.exe
  C:\Windows\System\JDpsKrD.exe
  2⤵
  PID:6908
- C:\Windows\System\xBKAXby.exe
  C:\Windows\System\xBKAXby.exe
  2⤵
  PID:6924
- C:\Windows\System\lHMIwfS.exe
  C:\Windows\System\lHMIwfS.exe
  2⤵
  PID:6940
- C:\Windows\System\zTvFTpU.exe
  C:\Windows\System\zTvFTpU.exe
  2⤵
  PID:6964
- C:\Windows\System\YUMmjXk.exe
  C:\Windows\System\YUMmjXk.exe
  2⤵
  PID:6980
- C:\Windows\System\BuRNngS.exe
  C:\Windows\System\BuRNngS.exe
  2⤵
  PID:6996
- C:\Windows\System\hzDPOXq.exe
  C:\Windows\System\hzDPOXq.exe
  2⤵
  PID:7012
- C:\Windows\System\ieVqfWC.exe
  C:\Windows\System\ieVqfWC.exe
  2⤵
  PID:7028
- C:\Windows\System\BtLHodM.exe
  C:\Windows\System\BtLHodM.exe
  2⤵
  PID:7044
- C:\Windows\System\kxgOhjf.exe
  C:\Windows\System\kxgOhjf.exe
  2⤵
  PID:7068
- C:\Windows\System\oUSCGny.exe
  C:\Windows\System\oUSCGny.exe
  2⤵
  PID:7084
- C:\Windows\System\ODfnhqN.exe
  C:\Windows\System\ODfnhqN.exe
  2⤵
  PID:7116
- C:\Windows\System\hoQNqFa.exe
  C:\Windows\System\hoQNqFa.exe
  2⤵
  PID:7144
- C:\Windows\System\aUrOAzx.exe
  C:\Windows\System\aUrOAzx.exe
  2⤵
  PID:7160
- C:\Windows\System\YAHPYeo.exe
  C:\Windows\System\YAHPYeo.exe
  2⤵
  PID:6092
- C:\Windows\System\jQuEUTq.exe
  C:\Windows\System\jQuEUTq.exe
  2⤵
  PID:6216
- C:\Windows\System\diQarNP.exe
  C:\Windows\System\diQarNP.exe
  2⤵
  PID:6248
- C:\Windows\System\UhBdFRs.exe
  C:\Windows\System\UhBdFRs.exe
  2⤵
  PID:6348
- C:\Windows\System\xCHENcT.exe
  C:\Windows\System\xCHENcT.exe
  2⤵
  PID:6416
- C:\Windows\System\DYVSciD.exe
  C:\Windows\System\DYVSciD.exe
  2⤵
  PID:5656
- C:\Windows\System\IeTSmPX.exe
  C:\Windows\System\IeTSmPX.exe
  2⤵
  PID:6156
- C:\Windows\System\aISUbAP.exe
  C:\Windows\System\aISUbAP.exe
  2⤵
  PID:5596
- C:\Windows\System\PaUhhSF.exe
  C:\Windows\System\PaUhhSF.exe
  2⤵
  PID:6196
- C:\Windows\System\SCXqHeu.exe
  C:\Windows\System\SCXqHeu.exe
  2⤵
  PID:6292
- C:\Windows\System\ieAiYkG.exe
  C:\Windows\System\ieAiYkG.exe
  2⤵
  PID:6332
- C:\Windows\System\lpXMNWi.exe
  C:\Windows\System\lpXMNWi.exe
  2⤵
  PID:6432
- C:\Windows\System\frYMRVC.exe
  C:\Windows\System\frYMRVC.exe
  2⤵
  PID:6952
- C:\Windows\System\eZnCFpd.exe
  C:\Windows\System\eZnCFpd.exe
  2⤵
  PID:7024
- C:\Windows\System\AGulVTF.exe
  C:\Windows\System\AGulVTF.exe
  2⤵
  PID:7092
- C:\Windows\System\ZWRbaIW.exe
  C:\Windows\System\ZWRbaIW.exe
  2⤵
  PID:6708
- C:\Windows\System\QOjcFwE.exe
  C:\Windows\System\QOjcFwE.exe
  2⤵
  PID:7040
- C:\Windows\System\BaSZwBl.exe
  C:\Windows\System\BaSZwBl.exe
  2⤵
  PID:7108
- C:\Windows\System\aGgrnDb.exe
  C:\Windows\System\aGgrnDb.exe
  2⤵
  PID:6788
- C:\Windows\System\SPXGjyw.exe
  C:\Windows\System\SPXGjyw.exe
  2⤵
  PID:6556
- C:\Windows\System\fySQspT.exe
  C:\Windows\System\fySQspT.exe
  2⤵
  PID:6628
- C:\Windows\System\hgHospq.exe
  C:\Windows\System\hgHospq.exe
  2⤵
  PID:6692
- C:\Windows\System\MbqTNBf.exe
  C:\Windows\System\MbqTNBf.exe
  2⤵
  PID:6516
- C:\Windows\System\vZxNCcy.exe
  C:\Windows\System\vZxNCcy.exe
  2⤵
  PID:6500
- C:\Windows\System\GhqDOYA.exe
  C:\Windows\System\GhqDOYA.exe
  2⤵
  PID:6776
- C:\Windows\System\NYFzJlf.exe
  C:\Windows\System\NYFzJlf.exe
  2⤵
  PID:6572
- C:\Windows\System\NAKlUeU.exe
  C:\Windows\System\NAKlUeU.exe
  2⤵
  PID:6644
- C:\Windows\System\DtYvyAW.exe
  C:\Windows\System\DtYvyAW.exe
  2⤵
  PID:7156
- C:\Windows\System\vdwRPXs.exe
  C:\Windows\System\vdwRPXs.exe
  2⤵
  PID:6152
- C:\Windows\System\FRjALgQ.exe
  C:\Windows\System\FRjALgQ.exe
  2⤵
  PID:6364
- C:\Windows\System\BptalwE.exe
  C:\Windows\System\BptalwE.exe
  2⤵
  PID:7020
- C:\Windows\System\YRArlMJ.exe
  C:\Windows\System\YRArlMJ.exe
  2⤵
  PID:7056
- C:\Windows\System\nZAqCzg.exe
  C:\Windows\System\nZAqCzg.exe
  2⤵
  PID:6688
- C:\Windows\System\uQYoCkL.exe
  C:\Windows\System\uQYoCkL.exe
  2⤵
  PID:6676
- C:\Windows\System\uuovaRU.exe
  C:\Windows\System\uuovaRU.exe
  2⤵
  PID:7152
- C:\Windows\System\rahbxtS.exe
  C:\Windows\System\rahbxtS.exe
  2⤵
  PID:6852
- C:\Windows\System\tBzUiJq.exe
  C:\Windows\System\tBzUiJq.exe
  2⤵
  PID:6888
- C:\Windows\System\KdLCOFx.exe
  C:\Windows\System\KdLCOFx.exe
  2⤵
  PID:6972
- C:\Windows\System\eOarvZp.exe
  C:\Windows\System\eOarvZp.exe
  2⤵
  PID:6176
- C:\Windows\System\MrRfVes.exe
  C:\Windows\System\MrRfVes.exe
  2⤵
  PID:6384
- C:\Windows\System\bFHKnWk.exe
  C:\Windows\System\bFHKnWk.exe
  2⤵
  PID:6200
- C:\Windows\System\wflJGPu.exe
  C:\Windows\System\wflJGPu.exe
  2⤵
  PID:6452
- C:\Windows\System\wPzyEpr.exe
  C:\Windows\System\wPzyEpr.exe
  2⤵
  PID:7004
- C:\Windows\System\PMqZAsD.exe
  C:\Windows\System\PMqZAsD.exe
  2⤵
  PID:6760
- C:\Windows\System\qpMrZvB.exe
  C:\Windows\System\qpMrZvB.exe
  2⤵
  PID:6456
- C:\Windows\System\OHCmoFg.exe
  C:\Windows\System\OHCmoFg.exe
  2⤵
  PID:6772
- C:\Windows\System\auSwfMG.exe
  C:\Windows\System\auSwfMG.exe
  2⤵
  PID:6316
- C:\Windows\System\jAxIiaK.exe
  C:\Windows\System\jAxIiaK.exe
  2⤵
  PID:6104
- C:\Windows\System\xgjOkZh.exe
  C:\Windows\System\xgjOkZh.exe
  2⤵
  PID:6856
- C:\Windows\System\ZmsDHnY.exe
  C:\Windows\System\ZmsDHnY.exe
  2⤵
  PID:6836
- C:\Windows\System\skWCiGn.exe
  C:\Windows\System\skWCiGn.exe
  2⤵
  PID:6372
- C:\Windows\System\mHKzflZ.exe
  C:\Windows\System\mHKzflZ.exe
  2⤵
  PID:7080
- C:\Windows\System\BNqKefY.exe
  C:\Windows\System\BNqKefY.exe
  2⤵
  PID:6660
- C:\Windows\System\ivMVbwU.exe
  C:\Windows\System\ivMVbwU.exe
  2⤵
  PID:6568
- C:\Windows\System\aGLAcPl.exe
  C:\Windows\System\aGLAcPl.exe
  2⤵
  PID:7136
- C:\Windows\System\YfSWbcC.exe
  C:\Windows\System\YfSWbcC.exe
  2⤵
  PID:6808
- C:\Windows\System\LycsNpf.exe
  C:\Windows\System\LycsNpf.exe
  2⤵
  PID:6328
- C:\Windows\System\XeWhTZT.exe
  C:\Windows\System\XeWhTZT.exe
  2⤵
  PID:5772
- C:\Windows\System\jSiMDky.exe
  C:\Windows\System\jSiMDky.exe
  2⤵
  PID:6620
- C:\Windows\System\XSKqbzE.exe
  C:\Windows\System\XSKqbzE.exe
  2⤵
  PID:6488
- C:\Windows\System\cfSGOfG.exe
  C:\Windows\System\cfSGOfG.exe
  2⤵
  PID:6936
- C:\Windows\System\AeaNfyM.exe
  C:\Windows\System\AeaNfyM.exe
  2⤵
  PID:6540
- C:\Windows\System\zWjULfS.exe
  C:\Windows\System\zWjULfS.exe
  2⤵
  PID:7060
- C:\Windows\System\xAZbbcQ.exe
  C:\Windows\System\xAZbbcQ.exe
  2⤵
  PID:6900
- C:\Windows\System\lnqxpSY.exe
  C:\Windows\System\lnqxpSY.exe
  2⤵
  PID:6992
- C:\Windows\System\opMhLyM.exe
  C:\Windows\System\opMhLyM.exe
  2⤵
  PID:6820
- C:\Windows\System\lDkeHiR.exe
  C:\Windows\System\lDkeHiR.exe
  2⤵
  PID:7100
- C:\Windows\System\emcFJwM.exe
  C:\Windows\System\emcFJwM.exe
  2⤵
  PID:5804
- C:\Windows\System\vvrnUJl.exe
  C:\Windows\System\vvrnUJl.exe
  2⤵
  PID:6212
- C:\Windows\System\rbwbPMp.exe
  C:\Windows\System\rbwbPMp.exe
  2⤵
  PID:6988
- C:\Windows\System\YzDRBoc.exe
  C:\Windows\System\YzDRBoc.exe
  2⤵
  PID:7180
- C:\Windows\System\ngrZzff.exe
  C:\Windows\System\ngrZzff.exe
  2⤵
  PID:7200
- C:\Windows\System\JsbpOTe.exe
  C:\Windows\System\JsbpOTe.exe
  2⤵
  PID:7216
- C:\Windows\System\TyCmZOP.exe
  C:\Windows\System\TyCmZOP.exe
  2⤵
  PID:7248
- C:\Windows\System\JprezRU.exe
  C:\Windows\System\JprezRU.exe
  2⤵
  PID:7264
- C:\Windows\System\ZZvBKhh.exe
  C:\Windows\System\ZZvBKhh.exe
  2⤵
  PID:7280
- C:\Windows\System\ZQfAiXx.exe
  C:\Windows\System\ZQfAiXx.exe
  2⤵
  PID:7296
- C:\Windows\System\VFtJjWX.exe
  C:\Windows\System\VFtJjWX.exe
  2⤵
  PID:7312
- C:\Windows\System\ZUMdgDR.exe
  C:\Windows\System\ZUMdgDR.exe
  2⤵
  PID:7328
- C:\Windows\System\hICXMkH.exe
  C:\Windows\System\hICXMkH.exe
  2⤵
  PID:7344
- C:\Windows\System\fenpiWQ.exe
  C:\Windows\System\fenpiWQ.exe
  2⤵
  PID:7364
- C:\Windows\System\XZzdqtt.exe
  C:\Windows\System\XZzdqtt.exe
  2⤵
  PID:7380
- C:\Windows\System\mBXWluB.exe
  C:\Windows\System\mBXWluB.exe
  2⤵
  PID:7396
- C:\Windows\System\zfYaxDc.exe
  C:\Windows\System\zfYaxDc.exe
  2⤵
  PID:7412
- C:\Windows\System\PFICSHS.exe
  C:\Windows\System\PFICSHS.exe
  2⤵
  PID:7428
- C:\Windows\System\PNrvwdm.exe
  C:\Windows\System\PNrvwdm.exe
  2⤵
  PID:7444
- C:\Windows\System\VqsZHAB.exe
  C:\Windows\System\VqsZHAB.exe
  2⤵
  PID:7460
- C:\Windows\System\cJXzgoK.exe
  C:\Windows\System\cJXzgoK.exe
  2⤵
  PID:7476
- C:\Windows\System\JilAetj.exe
  C:\Windows\System\JilAetj.exe
  2⤵
  PID:7492
- C:\Windows\System\jrUAroW.exe
  C:\Windows\System\jrUAroW.exe
  2⤵
  PID:7508
- C:\Windows\System\NtIhBGj.exe
  C:\Windows\System\NtIhBGj.exe
  2⤵
  PID:7524
- C:\Windows\System\ZuRfUFw.exe
  C:\Windows\System\ZuRfUFw.exe
  2⤵
  PID:7540
- C:\Windows\System\YPRzjHY.exe
  C:\Windows\System\YPRzjHY.exe
  2⤵
  PID:7556
- C:\Windows\System\knrnusG.exe
  C:\Windows\System\knrnusG.exe
  2⤵
  PID:7572
- C:\Windows\System\YmDCxLv.exe
  C:\Windows\System\YmDCxLv.exe
  2⤵
  PID:7588
- C:\Windows\System\HLOfZkN.exe
  C:\Windows\System\HLOfZkN.exe
  2⤵
  PID:7604
- C:\Windows\System\GYnkeoN.exe
  C:\Windows\System\GYnkeoN.exe
  2⤵
  PID:7620
- C:\Windows\System\qXyYWgC.exe
  C:\Windows\System\qXyYWgC.exe
  2⤵
  PID:7636
- C:\Windows\System\XiFgQRs.exe
  C:\Windows\System\XiFgQRs.exe
  2⤵
  PID:7652
- C:\Windows\System\ZCawvDw.exe
  C:\Windows\System\ZCawvDw.exe
  2⤵
  PID:7668
- C:\Windows\System\jcDCuMF.exe
  C:\Windows\System\jcDCuMF.exe
  2⤵
  PID:7684
- C:\Windows\System\VdBNIsW.exe
  C:\Windows\System\VdBNIsW.exe
  2⤵
  PID:7704
- C:\Windows\System\CtKNOUH.exe
  C:\Windows\System\CtKNOUH.exe
  2⤵
  PID:7720
- C:\Windows\System\bWgBoOe.exe
  C:\Windows\System\bWgBoOe.exe
  2⤵
  PID:7736
- C:\Windows\System\FEcyFOz.exe
  C:\Windows\System\FEcyFOz.exe
  2⤵
  PID:7756
- C:\Windows\System\mjynrHh.exe
  C:\Windows\System\mjynrHh.exe
  2⤵
  PID:7772
- C:\Windows\System\eCVxfHl.exe
  C:\Windows\System\eCVxfHl.exe
  2⤵
  PID:7788
- C:\Windows\System\yoCFNFa.exe
  C:\Windows\System\yoCFNFa.exe
  2⤵
  PID:7804
- C:\Windows\System\RSSchKi.exe
  C:\Windows\System\RSSchKi.exe
  2⤵
  PID:7820
- C:\Windows\System\DwdHzJo.exe
  C:\Windows\System\DwdHzJo.exe
  2⤵
  PID:7836
- C:\Windows\System\hzqWcQF.exe
  C:\Windows\System\hzqWcQF.exe
  2⤵
  PID:7852
- C:\Windows\System\iISLlsU.exe
  C:\Windows\System\iISLlsU.exe
  2⤵
  PID:7868
- C:\Windows\System\bkXJRHV.exe
  C:\Windows\System\bkXJRHV.exe
  2⤵
  PID:7884
- C:\Windows\System\uiJWiKF.exe
  C:\Windows\System\uiJWiKF.exe
  2⤵
  PID:7900
- C:\Windows\System\QNxOGZQ.exe
  C:\Windows\System\QNxOGZQ.exe
  2⤵
  PID:7916
- C:\Windows\System\PBMLTav.exe
  C:\Windows\System\PBMLTav.exe
  2⤵
  PID:7932
- C:\Windows\System\ABpHVYt.exe
  C:\Windows\System\ABpHVYt.exe
  2⤵
  PID:7948
- C:\Windows\System\HQfPylI.exe
  C:\Windows\System\HQfPylI.exe
  2⤵
  PID:7964
- C:\Windows\System\CmBGLpc.exe
  C:\Windows\System\CmBGLpc.exe
  2⤵
  PID:7980
- C:\Windows\System\erSSrkN.exe
  C:\Windows\System\erSSrkN.exe
  2⤵
  PID:7996
- C:\Windows\System\eyAqCBQ.exe
  C:\Windows\System\eyAqCBQ.exe
  2⤵
  PID:8012
- C:\Windows\System\rQrjosh.exe
  C:\Windows\System\rQrjosh.exe
  2⤵
  PID:8028
- C:\Windows\System\lFqQsFy.exe
  C:\Windows\System\lFqQsFy.exe
  2⤵
  PID:8044
- C:\Windows\System\bXCtolK.exe
  C:\Windows\System\bXCtolK.exe
  2⤵
  PID:8060
- C:\Windows\System\ikZJwbo.exe
  C:\Windows\System\ikZJwbo.exe
  2⤵
  PID:8076
- C:\Windows\System\kCuFYxw.exe
  C:\Windows\System\kCuFYxw.exe
  2⤵
  PID:8092
- C:\Windows\System\LObhtmf.exe
  C:\Windows\System\LObhtmf.exe
  2⤵
  PID:8108
- C:\Windows\System\PMvzjnB.exe
  C:\Windows\System\PMvzjnB.exe
  2⤵
  PID:8124
- C:\Windows\System\vawBtcp.exe
  C:\Windows\System\vawBtcp.exe
  2⤵
  PID:8140
- C:\Windows\System\cpqlzsB.exe
  C:\Windows\System\cpqlzsB.exe
  2⤵
  PID:8156
- C:\Windows\System\CJjnmNn.exe
  C:\Windows\System\CJjnmNn.exe
  2⤵
  PID:8176
- C:\Windows\System\dhOLoWN.exe
  C:\Windows\System\dhOLoWN.exe
  2⤵
  PID:6640
- C:\Windows\System\JLWCASc.exe
  C:\Windows\System\JLWCASc.exe
  2⤵
  PID:7236
- C:\Windows\System\QnapNFi.exe
  C:\Windows\System\QnapNFi.exe
  2⤵
  PID:7208
- C:\Windows\System\cXafpur.exe
  C:\Windows\System\cXafpur.exe
  2⤵
  PID:7272
- C:\Windows\System\TDMNAPg.exe
  C:\Windows\System\TDMNAPg.exe
  2⤵
  PID:7336
- C:\Windows\System\nKtexTL.exe
  C:\Windows\System\nKtexTL.exe
  2⤵
  PID:7404
- C:\Windows\System\qdRrIiK.exe
  C:\Windows\System\qdRrIiK.exe
  2⤵
  PID:7468
- C:\Windows\System\yJsIFkm.exe
  C:\Windows\System\yJsIFkm.exe
  2⤵
  PID:7504
- C:\Windows\System\hdOQybz.exe
  C:\Windows\System\hdOQybz.exe
  2⤵
  PID:7564
- C:\Windows\System\FAbPwrG.exe
  C:\Windows\System\FAbPwrG.exe
  2⤵
  PID:7628
- C:\Windows\System\aRJmYyA.exe
  C:\Windows\System\aRJmYyA.exe
  2⤵
  PID:7692
- C:\Windows\System\GByhMHD.exe
  C:\Windows\System\GByhMHD.exe
  2⤵
  PID:7392
- C:\Windows\System\QRXGQtG.exe
  C:\Windows\System\QRXGQtG.exe
  2⤵
  PID:7796
- C:\Windows\System\QqqrPWL.exe
  C:\Windows\System\QqqrPWL.exe
  2⤵
  PID:7864
- C:\Windows\System\reUItyD.exe
  C:\Windows\System\reUItyD.exe
  2⤵
  PID:7928
- C:\Windows\System\WsbnyvH.exe
  C:\Windows\System\WsbnyvH.exe
  2⤵
  PID:7992
- C:\Windows\System\lTbbVzZ.exe
  C:\Windows\System\lTbbVzZ.exe
  2⤵
  PID:8056
- C:\Windows\System\eaPTmLU.exe
  C:\Windows\System\eaPTmLU.exe
  2⤵
  PID:8116
- C:\Windows\System\uBNfeUO.exe
  C:\Windows\System\uBNfeUO.exe
  2⤵
  PID:7424
- C:\Windows\System\lkLHjYW.exe
  C:\Windows\System\lkLHjYW.exe
  2⤵
  PID:6400
- C:\Windows\System\DAuJfxE.exe
  C:\Windows\System\DAuJfxE.exe
  2⤵
  PID:6824
- C:\Windows\System\AEazpFW.exe
  C:\Windows\System\AEazpFW.exe
  2⤵
  PID:7456
- C:\Windows\System\hdIIXwk.exe
  C:\Windows\System\hdIIXwk.exe
  2⤵
  PID:7644
- C:\Windows\System\ugocuBm.exe
  C:\Windows\System\ugocuBm.exe
  2⤵
  PID:7516
- C:\Windows\System\fcQAdlC.exe
  C:\Windows\System\fcQAdlC.exe
  2⤵
  PID:7360
- C:\Windows\System\coGYTDB.exe
  C:\Windows\System\coGYTDB.exe
  2⤵
  PID:7484
- C:\Windows\System\gVhTlWT.exe
  C:\Windows\System\gVhTlWT.exe
  2⤵
  PID:7612
- C:\Windows\System\ulluaKM.exe
  C:\Windows\System\ulluaKM.exe
  2⤵
  PID:7812
- C:\Windows\System\JEEvlpU.exe
  C:\Windows\System\JEEvlpU.exe
  2⤵
  PID:7880
- C:\Windows\System\DLcKhHx.exe
  C:\Windows\System\DLcKhHx.exe
  2⤵
  PID:7944
- C:\Windows\System\JjcMKNU.exe
  C:\Windows\System\JjcMKNU.exe
  2⤵
  PID:8040
- C:\Windows\System\JiZadrd.exe
  C:\Windows\System\JiZadrd.exe
  2⤵
  PID:7192
- C:\Windows\System\YbAufYr.exe
  C:\Windows\System\YbAufYr.exe
  2⤵
  PID:7648
- C:\Windows\System\JxuJqMK.exe
  C:\Windows\System\JxuJqMK.exe
  2⤵
  PID:7748
- C:\Windows\System\sxWeVvA.exe
  C:\Windows\System\sxWeVvA.exe
  2⤵
  PID:8008
- C:\Windows\System\FqVEbIj.exe
  C:\Windows\System\FqVEbIj.exe
  2⤵
  PID:8136
- C:\Windows\System\MADrDmv.exe
  C:\Windows\System\MADrDmv.exe
  2⤵
  PID:7660
- C:\Windows\System\oJuUOdb.exe
  C:\Windows\System\oJuUOdb.exe
  2⤵
  PID:7764
- C:\Windows\System\vhfRFgf.exe
  C:\Windows\System\vhfRFgf.exe
  2⤵
  PID:7324
- C:\Windows\System\VWBqpnb.exe
  C:\Windows\System\VWBqpnb.exe
  2⤵
  PID:8152
- C:\Windows\System\VxTfNsd.exe
  C:\Windows\System\VxTfNsd.exe
  2⤵
  PID:7700
- C:\Windows\System\vxHpJay.exe
  C:\Windows\System\vxHpJay.exe
  2⤵
  PID:7036
- C:\Windows\System\gPmRysM.exe
  C:\Windows\System\gPmRysM.exe
  2⤵
  PID:7352
- C:\Windows\System\nDmzvcD.exe
  C:\Windows\System\nDmzvcD.exe
  2⤵
  PID:7372
- C:\Windows\System\FDHSxbA.exe
  C:\Windows\System\FDHSxbA.exe
  2⤵
  PID:7848
- C:\Windows\System\uhQiRhY.exe
  C:\Windows\System\uhQiRhY.exe
  2⤵
  PID:7752
- C:\Windows\System\WYThxlM.exe
  C:\Windows\System\WYThxlM.exe
  2⤵
  PID:7304
- C:\Windows\System\dHbAROQ.exe
  C:\Windows\System\dHbAROQ.exe
  2⤵
  PID:7292
- C:\Windows\System\yboZJZC.exe
  C:\Windows\System\yboZJZC.exe
  2⤵
  PID:7832
- C:\Windows\System\LkkoZmX.exe
  C:\Windows\System\LkkoZmX.exe
  2⤵
  PID:7876
- C:\Windows\System\dFgXsdx.exe
  C:\Windows\System\dFgXsdx.exe
  2⤵
  PID:7240
- C:\Windows\System\CtcrnTa.exe
  C:\Windows\System\CtcrnTa.exe
  2⤵
  PID:8100
- C:\Windows\System\XGXdFRC.exe
  C:\Windows\System\XGXdFRC.exe
  2⤵
  PID:7596
- C:\Windows\System\zKmxHtt.exe
  C:\Windows\System\zKmxHtt.exe
  2⤵
  PID:6840
- C:\Windows\System\ORNROEa.exe
  C:\Windows\System\ORNROEa.exe
  2⤵
  PID:8052
- C:\Windows\System\BgltoZh.exe
  C:\Windows\System\BgltoZh.exe
  2⤵
  PID:7584
- C:\Windows\System\FxBlxWo.exe
  C:\Windows\System\FxBlxWo.exe
  2⤵
  PID:7940
- C:\Windows\System\MYVQXsd.exe
  C:\Windows\System\MYVQXsd.exe
  2⤵
  PID:7896
- C:\Windows\System\RLlyhTY.exe
  C:\Windows\System\RLlyhTY.exe
  2⤵
  PID:7172
- C:\Windows\System\zInDMSb.exe
  C:\Windows\System\zInDMSb.exe
  2⤵
  PID:7780
- C:\Windows\System\hadjsix.exe
  C:\Windows\System\hadjsix.exe
  2⤵
  PID:7244
- C:\Windows\System\Gewjghl.exe
  C:\Windows\System\Gewjghl.exe
  2⤵
  PID:7420
- C:\Windows\System\qLkRsUr.exe
  C:\Windows\System\qLkRsUr.exe
  2⤵
  PID:7260
- C:\Windows\System\NDMKhbe.exe
  C:\Windows\System\NDMKhbe.exe
  2⤵
  PID:8104
- C:\Windows\System\QQhGyiB.exe
  C:\Windows\System\QQhGyiB.exe
  2⤵
  PID:8224
- C:\Windows\System\eGygtgG.exe
  C:\Windows\System\eGygtgG.exe
  2⤵
  PID:8240
- C:\Windows\System\uPhFChk.exe
  C:\Windows\System\uPhFChk.exe
  2⤵
  PID:8256
- C:\Windows\System\eBqOWwc.exe
  C:\Windows\System\eBqOWwc.exe
  2⤵
  PID:8272
- C:\Windows\System\CcJQGLn.exe
  C:\Windows\System\CcJQGLn.exe
  2⤵
  PID:8288
- C:\Windows\System\zFMBLRl.exe
  C:\Windows\System\zFMBLRl.exe
  2⤵
  PID:8304
- C:\Windows\System\Vrpvdrn.exe
  C:\Windows\System\Vrpvdrn.exe
  2⤵
  PID:8320
- C:\Windows\System\IlAvaho.exe
  C:\Windows\System\IlAvaho.exe
  2⤵
  PID:8336
- C:\Windows\System\rfTYVUy.exe
  C:\Windows\System\rfTYVUy.exe
  2⤵
  PID:8352
- C:\Windows\System\hHOmrXh.exe
  C:\Windows\System\hHOmrXh.exe
  2⤵
  PID:8368
- C:\Windows\System\wWoJsMu.exe
  C:\Windows\System\wWoJsMu.exe
  2⤵
  PID:8384
- C:\Windows\System\VgkVSow.exe
  C:\Windows\System\VgkVSow.exe
  2⤵
  PID:8400
- C:\Windows\System\ehQpkSD.exe
  C:\Windows\System\ehQpkSD.exe
  2⤵
  PID:8416
- C:\Windows\System\pjezfYv.exe
  C:\Windows\System\pjezfYv.exe
  2⤵
  PID:8436
- C:\Windows\System\XVZeqHv.exe
  C:\Windows\System\XVZeqHv.exe
  2⤵
  PID:8452
- C:\Windows\System\YxpdKUS.exe
  C:\Windows\System\YxpdKUS.exe
  2⤵
  PID:8472
- C:\Windows\System\sVBeRKB.exe
  C:\Windows\System\sVBeRKB.exe
  2⤵
  PID:8492
- C:\Windows\System\rnyoinX.exe
  C:\Windows\System\rnyoinX.exe
  2⤵
  PID:8512
- C:\Windows\System\GTpGYtP.exe
  C:\Windows\System\GTpGYtP.exe
  2⤵
  PID:8528
- C:\Windows\System\EAOAzAs.exe
  C:\Windows\System\EAOAzAs.exe
  2⤵
  PID:8548
- C:\Windows\System\GyVSkqE.exe
  C:\Windows\System\GyVSkqE.exe
  2⤵
  PID:8564
- C:\Windows\System\JvJEIUG.exe
  C:\Windows\System\JvJEIUG.exe
  2⤵
  PID:8580
- C:\Windows\System\CNDgrIT.exe
  C:\Windows\System\CNDgrIT.exe
  2⤵
  PID:8600
- C:\Windows\System\EnaseKF.exe
  C:\Windows\System\EnaseKF.exe
  2⤵
  PID:8616
- C:\Windows\System\DjVrlzs.exe
  C:\Windows\System\DjVrlzs.exe
  2⤵
  PID:8632
- C:\Windows\System\XHMZItk.exe
  C:\Windows\System\XHMZItk.exe
  2⤵
  PID:8648
- C:\Windows\System\ZAVWPbZ.exe
  C:\Windows\System\ZAVWPbZ.exe
  2⤵
  PID:8668
- C:\Windows\System\HnvVHeH.exe
  C:\Windows\System\HnvVHeH.exe
  2⤵
  PID:8684
- C:\Windows\System\ynuzneI.exe
  C:\Windows\System\ynuzneI.exe
  2⤵
  PID:8704
- C:\Windows\System\JvfvoSe.exe
  C:\Windows\System\JvfvoSe.exe
  2⤵
  PID:8720
- C:\Windows\System\sHqggPc.exe
  C:\Windows\System\sHqggPc.exe
  2⤵
  PID:8736
- C:\Windows\System\QmPCCYZ.exe
  C:\Windows\System\QmPCCYZ.exe
  2⤵
  PID:8776
- C:\Windows\System\ZIdiLLt.exe
  C:\Windows\System\ZIdiLLt.exe
  2⤵
  PID:8792
- C:\Windows\System\RdmHIwx.exe
  C:\Windows\System\RdmHIwx.exe
  2⤵
  PID:8816
- C:\Windows\System\BVAReMp.exe
  C:\Windows\System\BVAReMp.exe
  2⤵
  PID:8832
- C:\Windows\System\DOpNMNd.exe
  C:\Windows\System\DOpNMNd.exe
  2⤵
  PID:8848
- C:\Windows\System\JNeEcqm.exe
  C:\Windows\System\JNeEcqm.exe
  2⤵
  PID:8864
- C:\Windows\System\oOLwSOC.exe
  C:\Windows\System\oOLwSOC.exe
  2⤵
  PID:8880
- C:\Windows\System\kOVjQNI.exe
  C:\Windows\System\kOVjQNI.exe
  2⤵
  PID:8896
- C:\Windows\System\KGwgRmV.exe
  C:\Windows\System\KGwgRmV.exe
  2⤵
  PID:8912
- C:\Windows\System\lOjukiU.exe
  C:\Windows\System\lOjukiU.exe
  2⤵
  PID:8932
- C:\Windows\System\gbBGbao.exe
  C:\Windows\System\gbBGbao.exe
  2⤵
  PID:9060
- C:\Windows\System\DuiYvaT.exe
  C:\Windows\System\DuiYvaT.exe
  2⤵
  PID:9080
- C:\Windows\System\MKahvqG.exe
  C:\Windows\System\MKahvqG.exe
  2⤵
  PID:9104
- C:\Windows\System\LMgBeSK.exe
  C:\Windows\System\LMgBeSK.exe
  2⤵
  PID:9124
- C:\Windows\System\iysVwpo.exe
  C:\Windows\System\iysVwpo.exe
  2⤵
  PID:9144
- C:\Windows\System\BpUcSxZ.exe
  C:\Windows\System\BpUcSxZ.exe
  2⤵
  PID:9160
- C:\Windows\System\PmGfnVV.exe
  C:\Windows\System\PmGfnVV.exe
  2⤵
  PID:8200
- C:\Windows\System\JbeNDzI.exe
  C:\Windows\System\JbeNDzI.exe
  2⤵
  PID:8216
- C:\Windows\System\AGehGEs.exe
  C:\Windows\System\AGehGEs.exe
  2⤵
  PID:7728
- C:\Windows\System\rbvYxcN.exe
  C:\Windows\System\rbvYxcN.exe
  2⤵
  PID:8020
- C:\Windows\System\sabEkll.exe
  C:\Windows\System\sabEkll.exe
  2⤵
  PID:8252
- C:\Windows\System\MfsJgPd.exe
  C:\Windows\System\MfsJgPd.exe
  2⤵
  PID:8264
- C:\Windows\System\MzKKHLv.exe
  C:\Windows\System\MzKKHLv.exe
  2⤵
  PID:8348
- C:\Windows\System\YxjTehg.exe
  C:\Windows\System\YxjTehg.exe
  2⤵
  PID:8448
- C:\Windows\System\NjOgAsE.exe
  C:\Windows\System\NjOgAsE.exe
  2⤵
  PID:8484
- C:\Windows\System\TsNWxRq.exe
  C:\Windows\System\TsNWxRq.exe
  2⤵
  PID:8524
- C:\Windows\System\RbQinaA.exe
  C:\Windows\System\RbQinaA.exe
  2⤵
  PID:8268
- C:\Windows\System\GknBoLQ.exe
  C:\Windows\System\GknBoLQ.exe
  2⤵
  PID:8364
- C:\Windows\System\idcAMru.exe
  C:\Windows\System\idcAMru.exe
  2⤵
  PID:8468
- C:\Windows\System\ZLfCGpG.exe
  C:\Windows\System\ZLfCGpG.exe
  2⤵
  PID:8536
- C:\Windows\System\KzOiBxa.exe
  C:\Windows\System\KzOiBxa.exe
  2⤵
  PID:8592
- C:\Windows\System\AgTUOoQ.exe
  C:\Windows\System\AgTUOoQ.exe
  2⤵
  PID:8640
- C:\Windows\System\MObrvTo.exe
  C:\Windows\System\MObrvTo.exe
  2⤵
  PID:8624
- C:\Windows\System\FfHLbgm.exe
  C:\Windows\System\FfHLbgm.exe
  2⤵
  PID:8692
- C:\Windows\System\OviVnzW.exe
  C:\Windows\System\OviVnzW.exe
  2⤵
  PID:8784
- C:\Windows\System\tkDqqXt.exe
  C:\Windows\System\tkDqqXt.exe
  2⤵
  PID:8700
- C:\Windows\System\vfWngHX.exe
  C:\Windows\System\vfWngHX.exe
  2⤵
  PID:8748
- C:\Windows\System\oLCfloh.exe
  C:\Windows\System\oLCfloh.exe
  2⤵
  PID:8756
- C:\Windows\System\TUKuFhu.exe
  C:\Windows\System\TUKuFhu.exe
  2⤵
  PID:8804
- C:\Windows\System\HfoiCpW.exe
  C:\Windows\System\HfoiCpW.exe
  2⤵
  PID:8872
- C:\Windows\System\PphsCue.exe
  C:\Windows\System\PphsCue.exe
  2⤵
  PID:8928
- C:\Windows\System\Solyojh.exe
  C:\Windows\System\Solyojh.exe
  2⤵
  PID:8856
- C:\Windows\System\MAmYvsC.exe
  C:\Windows\System\MAmYvsC.exe
  2⤵
  PID:8892
- C:\Windows\System\TbtGrpM.exe
  C:\Windows\System\TbtGrpM.exe
  2⤵
  PID:8960
- C:\Windows\System\sdWrgSD.exe
  C:\Windows\System\sdWrgSD.exe
  2⤵
  PID:8976
- C:\Windows\System\bjGbSIu.exe
  C:\Windows\System\bjGbSIu.exe
  2⤵
  PID:8992
- C:\Windows\System\EVVBdhf.exe
  C:\Windows\System\EVVBdhf.exe
  2⤵
  PID:9008
- C:\Windows\System\JobVblp.exe
  C:\Windows\System\JobVblp.exe
  2⤵
  PID:9024
- C:\Windows\System\vWqdCLk.exe
  C:\Windows\System\vWqdCLk.exe
  2⤵
  PID:9044
- C:\Windows\System\FWwWIPO.exe
  C:\Windows\System\FWwWIPO.exe
  2⤵
  PID:9052
- C:\Windows\System\QhhhArR.exe
  C:\Windows\System\QhhhArR.exe
  2⤵
  PID:9116
- C:\Windows\System\IRHxFFA.exe
  C:\Windows\System\IRHxFFA.exe
  2⤵
  PID:9132
- C:\Windows\System\KHhEBpx.exe
  C:\Windows\System\KHhEBpx.exe
  2⤵
  PID:9092
- C:\Windows\System\wjdfBQK.exe
  C:\Windows\System\wjdfBQK.exe
  2⤵
  PID:9136
- C:\Windows\System\rLKaNhV.exe
  C:\Windows\System\rLKaNhV.exe
  2⤵
  PID:9192
- C:\Windows\System\GQzvJpd.exe
  C:\Windows\System\GQzvJpd.exe
  2⤵
  PID:9208
- C:\Windows\System\zvOFpOx.exe
  C:\Windows\System\zvOFpOx.exe
  2⤵
  PID:7536
- C:\Windows\System\JGMbYUW.exe
  C:\Windows\System\JGMbYUW.exe
  2⤵
  PID:8212
- C:\Windows\System\CNKxXfO.exe
  C:\Windows\System\CNKxXfO.exe
  2⤵
  PID:8428
- C:\Windows\System\IfLJIjj.exe
  C:\Windows\System\IfLJIjj.exe
  2⤵
  PID:8328
- C:\Windows\System\jLlgGrE.exe
  C:\Windows\System\jLlgGrE.exe
  2⤵
  PID:8392
- C:\Windows\System\KJFuCMH.exe
  C:\Windows\System\KJFuCMH.exe
  2⤵
  PID:8572
- C:\Windows\System\swgpVOS.exe
  C:\Windows\System\swgpVOS.exe
  2⤵
  PID:8236
- C:\Windows\System\JBZbvRd.exe
  C:\Windows\System\JBZbvRd.exe
  2⤵
  PID:8744
- C:\Windows\System\YbDXNsW.exe
  C:\Windows\System\YbDXNsW.exe
  2⤵
  PID:8408
- C:\Windows\System\eOIcyRk.exe
  C:\Windows\System\eOIcyRk.exe
  2⤵
  PID:8588
- C:\Windows\System\trKkXkq.exe
  C:\Windows\System\trKkXkq.exe
  2⤵
  PID:8576
- C:\Windows\System\nLNNhLT.exe
  C:\Windows\System\nLNNhLT.exe
  2⤵
  PID:8664
- C:\Windows\System\ogRbDKB.exe
  C:\Windows\System\ogRbDKB.exe
  2⤵
  PID:8612
- C:\Windows\System\dYZVKAa.exe
  C:\Windows\System\dYZVKAa.exe
  2⤵
  PID:8812
- C:\Windows\System\pDJKdKR.exe
  C:\Windows\System\pDJKdKR.exe
  2⤵
  PID:8984
- C:\Windows\System\sObxsLG.exe
  C:\Windows\System\sObxsLG.exe
  2⤵
  PID:8944
- C:\Windows\System\LjYoJcM.exe
  C:\Windows\System\LjYoJcM.exe
  2⤵
  PID:9056
- C:\Windows\System\GBxbSeP.exe
  C:\Windows\System\GBxbSeP.exe
  2⤵
  PID:9096
- C:\Windows\System\cHfeSYh.exe
  C:\Windows\System\cHfeSYh.exe
  2⤵
  PID:8196
- C:\Windows\System\GhkZMKH.exe
  C:\Windows\System\GhkZMKH.exe
  2⤵
  PID:8560
- C:\Windows\System\ALmZdkQ.exe
  C:\Windows\System\ALmZdkQ.exe
  2⤵
  PID:9176
- C:\Windows\System\ETyDYWy.exe
  C:\Windows\System\ETyDYWy.exe
  2⤵
  PID:9076
- C:\Windows\System\jgNGGfj.exe
  C:\Windows\System\jgNGGfj.exe
  2⤵
  PID:7520
- C:\Windows\System\wlJKAds.exe
  C:\Windows\System\wlJKAds.exe
  2⤵
  PID:9004
- C:\Windows\System\XxkwEsZ.exe
  C:\Windows\System\XxkwEsZ.exe
  2⤵
  PID:8544
- C:\Windows\System\CjXOvQT.exe
  C:\Windows\System\CjXOvQT.exe
  2⤵
  PID:1504
- C:\Windows\System\oWtqMzG.exe
  C:\Windows\System\oWtqMzG.exe
  2⤵
  PID:8520
- C:\Windows\System\sJoqOhK.exe
  C:\Windows\System\sJoqOhK.exe
  2⤵
  PID:8504
- C:\Windows\System\iyegKtX.exe
  C:\Windows\System\iyegKtX.exe
  2⤵
  PID:8828
- C:\Windows\System\LqmbkST.exe
  C:\Windows\System\LqmbkST.exe
  2⤵
  PID:9016
- C:\Windows\System\rhlpKcA.exe
  C:\Windows\System\rhlpKcA.exe
  2⤵
  PID:8344
- C:\Windows\System\OPkhaqJ.exe
  C:\Windows\System\OPkhaqJ.exe
  2⤵
  PID:8732
- C:\Windows\System\jbVYvVL.exe
  C:\Windows\System\jbVYvVL.exe
  2⤵
  PID:8460
- C:\Windows\System\PzjmDbw.exe
  C:\Windows\System\PzjmDbw.exe
  2⤵
  PID:8800
- C:\Windows\System\lcMEwsc.exe
  C:\Windows\System\lcMEwsc.exe
  2⤵
  PID:8296
- C:\Windows\System\NKGWHmY.exe
  C:\Windows\System\NKGWHmY.exe
  2⤵
  PID:9236
- C:\Windows\System\YJMROAi.exe
  C:\Windows\System\YJMROAi.exe
  2⤵
  PID:9252
- C:\Windows\System\taGxaiC.exe
  C:\Windows\System\taGxaiC.exe
  2⤵
  PID:9276
- C:\Windows\System\MoPDnzz.exe
  C:\Windows\System\MoPDnzz.exe
  2⤵
  PID:9292
- C:\Windows\System\ZLBrdcP.exe
  C:\Windows\System\ZLBrdcP.exe
  2⤵
  PID:9308
- C:\Windows\System\RmQZsGH.exe
  C:\Windows\System\RmQZsGH.exe
  2⤵
  PID:9324
- C:\Windows\System\sDHOgRH.exe
  C:\Windows\System\sDHOgRH.exe
  2⤵
  PID:9340
- C:\Windows\System\iLCDHuN.exe
  C:\Windows\System\iLCDHuN.exe
  2⤵
  PID:9356
- C:\Windows\System\Jtzqtkn.exe
  C:\Windows\System\Jtzqtkn.exe
  2⤵
  PID:9372
- C:\Windows\System\AmKtMSs.exe
  C:\Windows\System\AmKtMSs.exe
  2⤵
  PID:9388
- C:\Windows\System\CCLmxiN.exe
  C:\Windows\System\CCLmxiN.exe
  2⤵
  PID:9404
- C:\Windows\System\FklMiNI.exe
  C:\Windows\System\FklMiNI.exe
  2⤵
  PID:9420
- C:\Windows\System\BqoCJbv.exe
  C:\Windows\System\BqoCJbv.exe
  2⤵
  PID:9452
- C:\Windows\System\PrRDSxd.exe
  C:\Windows\System\PrRDSxd.exe
  2⤵
  PID:9468
- C:\Windows\System\ubqmhNU.exe
  C:\Windows\System\ubqmhNU.exe
  2⤵
  PID:9524
- C:\Windows\System\VEqKclF.exe
  C:\Windows\System\VEqKclF.exe
  2⤵
  PID:9540
- C:\Windows\System\vRMIqEC.exe
  C:\Windows\System\vRMIqEC.exe
  2⤵
  PID:9556
- C:\Windows\System\tuVywQr.exe
  C:\Windows\System\tuVywQr.exe
  2⤵
  PID:9572
- C:\Windows\System\csbdkqv.exe
  C:\Windows\System\csbdkqv.exe
  2⤵
  PID:9588
- C:\Windows\System\cfVAjFC.exe
  C:\Windows\System\cfVAjFC.exe
  2⤵
  PID:9604
- C:\Windows\System\HtwbOAK.exe
  C:\Windows\System\HtwbOAK.exe
  2⤵
  PID:9620
- C:\Windows\System\bXMLNQP.exe
  C:\Windows\System\bXMLNQP.exe
  2⤵
  PID:9636
- C:\Windows\System\iFWJnPP.exe
  C:\Windows\System\iFWJnPP.exe
  2⤵
  PID:9652
- C:\Windows\System\UjEdPtV.exe
  C:\Windows\System\UjEdPtV.exe
  2⤵
  PID:9668
- C:\Windows\System\awbzpQY.exe
  C:\Windows\System\awbzpQY.exe
  2⤵
  PID:9684
- C:\Windows\System\MxgojPk.exe
  C:\Windows\System\MxgojPk.exe
  2⤵
  PID:9700
- C:\Windows\System\tGMIMvr.exe
  C:\Windows\System\tGMIMvr.exe
  2⤵
  PID:9716
- C:\Windows\System\CfthKtl.exe
  C:\Windows\System\CfthKtl.exe
  2⤵
  PID:9732
- C:\Windows\System\ZeHTAfx.exe
  C:\Windows\System\ZeHTAfx.exe
  2⤵
  PID:9748
- C:\Windows\System\gQQQwls.exe
  C:\Windows\System\gQQQwls.exe
  2⤵
  PID:9764
- C:\Windows\System\zdmZiwo.exe
  C:\Windows\System\zdmZiwo.exe
  2⤵
  PID:9780
- C:\Windows\System\QeYRqZm.exe
  C:\Windows\System\QeYRqZm.exe
  2⤵
  PID:9796
- C:\Windows\System\nrLPgxB.exe
  C:\Windows\System\nrLPgxB.exe
  2⤵
  PID:9812
- C:\Windows\System\HqPeqYv.exe
  C:\Windows\System\HqPeqYv.exe
  2⤵
  PID:9828
- C:\Windows\System\CCvlqrc.exe
  C:\Windows\System\CCvlqrc.exe
  2⤵
  PID:9844
- C:\Windows\System\UZbsiOr.exe
  C:\Windows\System\UZbsiOr.exe
  2⤵
  PID:9860
- C:\Windows\System\eSHGOkp.exe
  C:\Windows\System\eSHGOkp.exe
  2⤵
  PID:9876
- C:\Windows\System\hlZKnGz.exe
  C:\Windows\System\hlZKnGz.exe
  2⤵
  PID:9892
- C:\Windows\System\VgFYoJD.exe
  C:\Windows\System\VgFYoJD.exe
  2⤵
  PID:9908
- C:\Windows\System\okaBTym.exe
  C:\Windows\System\okaBTym.exe
  2⤵
  PID:9924
- C:\Windows\System\RwYHsqt.exe
  C:\Windows\System\RwYHsqt.exe
  2⤵
  PID:9940
- C:\Windows\System\AJlcTYs.exe
  C:\Windows\System\AJlcTYs.exe
  2⤵
  PID:9956
- C:\Windows\System\wKpWBih.exe
  C:\Windows\System\wKpWBih.exe
  2⤵
  PID:9972
- C:\Windows\System\wWSdjFt.exe
  C:\Windows\System\wWSdjFt.exe
  2⤵
  PID:9988
- C:\Windows\System\GIcqxau.exe
  C:\Windows\System\GIcqxau.exe
  2⤵
  PID:10012
- C:\Windows\System\mYblEYu.exe
  C:\Windows\System\mYblEYu.exe
  2⤵
  PID:10072
- C:\Windows\System\hLpNrmK.exe
  C:\Windows\System\hLpNrmK.exe
  2⤵
  PID:10088
- C:\Windows\System\PboCChb.exe
  C:\Windows\System\PboCChb.exe
  2⤵
  PID:10104
- C:\Windows\System\ntgQcNn.exe
  C:\Windows\System\ntgQcNn.exe
  2⤵
  PID:10120
- C:\Windows\System\LfWeruc.exe
  C:\Windows\System\LfWeruc.exe
  2⤵
  PID:10136
- C:\Windows\System\cWTZfzx.exe
  C:\Windows\System\cWTZfzx.exe
  2⤵
  PID:10152
- C:\Windows\System\VepUIAr.exe
  C:\Windows\System\VepUIAr.exe
  2⤵
  PID:10184
- C:\Windows\System\lffcwGO.exe
  C:\Windows\System\lffcwGO.exe
  2⤵
  PID:10208
- C:\Windows\System\PtrCMhO.exe
  C:\Windows\System\PtrCMhO.exe
  2⤵
  PID:10228
- C:\Windows\System\gUtFjnS.exe
  C:\Windows\System\gUtFjnS.exe
  2⤵
  PID:8644
- C:\Windows\System\oFJuHDX.exe
  C:\Windows\System\oFJuHDX.exe
  2⤵
  PID:9260
- C:\Windows\System\JokntlH.exe
  C:\Windows\System\JokntlH.exe
  2⤵
  PID:9304
- C:\Windows\System\PZdoVsP.exe
  C:\Windows\System\PZdoVsP.exe
  2⤵
  PID:7680
- C:\Windows\System\mpfuFJq.exe
  C:\Windows\System\mpfuFJq.exe
  2⤵
  PID:8752
- C:\Windows\System\WMFmwrq.exe
  C:\Windows\System\WMFmwrq.exe
  2⤵
  PID:9332
- C:\Windows\System\aYmqokU.exe
  C:\Windows\System\aYmqokU.exe
  2⤵
  PID:9036
- C:\Windows\System\WwaOUBD.exe
  C:\Windows\System\WwaOUBD.exe
  2⤵
  PID:8488
- C:\Windows\System\kvMbtEm.exe
  C:\Windows\System\kvMbtEm.exe
  2⤵
  PID:9156
- C:\Windows\System\JoEaWPP.exe
  C:\Windows\System\JoEaWPP.exe
  2⤵
  PID:9364
- C:\Windows\System\hEfEUcw.exe
  C:\Windows\System\hEfEUcw.exe
  2⤵
  PID:9396
- C:\Windows\System\VPoNApU.exe
  C:\Windows\System\VPoNApU.exe
  2⤵
  PID:9412
- C:\Windows\System\EgtcOfc.exe
  C:\Windows\System\EgtcOfc.exe
  2⤵
  PID:9416
- C:\Windows\System\ulNNvUE.exe
  C:\Windows\System\ulNNvUE.exe
  2⤵
  PID:9460
- C:\Windows\System\qRUaWdM.exe
  C:\Windows\System\qRUaWdM.exe
  2⤵
  PID:9484
- C:\Windows\System\Darpgvu.exe
  C:\Windows\System\Darpgvu.exe
  2⤵
  PID:9500
- C:\Windows\System\rEBqXBI.exe
  C:\Windows\System\rEBqXBI.exe
  2⤵
  PID:9512
- C:\Windows\System\cFCUfpV.exe
  C:\Windows\System\cFCUfpV.exe
  2⤵
  PID:9584
- C:\Windows\System\rshKnoJ.exe
  C:\Windows\System\rshKnoJ.exe
  2⤵
  PID:9568
- C:\Windows\System\YJCSsSI.exe
  C:\Windows\System\YJCSsSI.exe
  2⤵
  PID:9616
- C:\Windows\System\OzJQPwz.exe
  C:\Windows\System\OzJQPwz.exe
  2⤵
  PID:9680
- C:\Windows\System\sALIuHB.exe
  C:\Windows\System\sALIuHB.exe
  2⤵
  PID:9628
- C:\Windows\System\lMARBbb.exe
  C:\Windows\System\lMARBbb.exe
  2⤵
  PID:9884
- C:\Windows\System\IRDTdSL.exe
  C:\Windows\System\IRDTdSL.exe
  2⤵
  PID:9776
- C:\Windows\System\LuNvKVT.exe
  C:\Windows\System\LuNvKVT.exe
  2⤵
  PID:9840
- C:\Windows\System\CrKkHTC.exe
  C:\Windows\System\CrKkHTC.exe
  2⤵
  PID:9900
- C:\Windows\System\FnEznyQ.exe
  C:\Windows\System\FnEznyQ.exe
  2⤵
  PID:9964
- C:\Windows\System\exTodPu.exe
  C:\Windows\System\exTodPu.exe
  2⤵
  PID:10004
- C:\Windows\System\fghiQRr.exe
  C:\Windows\System\fghiQRr.exe
  2⤵
  PID:10112
- C:\Windows\System\IOwZQsK.exe
  C:\Windows\System\IOwZQsK.exe
  2⤵
  PID:10192
- C:\Windows\System\wMqMGEQ.exe
  C:\Windows\System\wMqMGEQ.exe
  2⤵
  PID:9660
- C:\Windows\System\YuVCKhy.exe
  C:\Windows\System\YuVCKhy.exe
  2⤵
  PID:10236
- C:\Windows\System\BAFMQRo.exe
  C:\Windows\System\BAFMQRo.exe
  2⤵
  PID:10032
- C:\Windows\System\HXPBeyG.exe
  C:\Windows\System\HXPBeyG.exe
  2⤵
  PID:9268
- C:\Windows\System\CjKSopx.exe
  C:\Windows\System\CjKSopx.exe
  2⤵
  PID:9820
- C:\Windows\System\YRfojBZ.exe
  C:\Windows\System\YRfojBZ.exe
  2⤵
  PID:9952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AfQuAfi.exe

Filesize
2.2MB

MD5
8adaac3a878e0748a9ef20e9f15aec26

SHA1
7431569cbe4bdf6f714e97f0804c8ef93f74bae7

SHA256
cc8bdcf354d3539856f9f67ecfe06d74c62bc9c03392e49ed30d99dc6edac6e5

SHA512
80878ecec26b01c795f4a912d5e5edde912e4432a7ad3286bebd9057455ad676e5609115ff207b509dab0063551c5c40f7f8678777468d231675d2486822fcf5

Download Submit
C:\Windows\system\FWLtihN.exe

Filesize
2.2MB

MD5
561d36255f663f42a8df781798c64e1b

SHA1
8c05af9237ad635a8dc60913f99ae61aa95b6c48

SHA256
cfd3ded59025815abff2a02ac2f4f68a7578bc8653b98ac91e6a888f83c2d333

SHA512
8445995d6030701cac99d7386ba12e5f24de3f11e319bf71d916c787024f1a29d8b2391eea49c729e667f3c61c492bfdd3ab2b47f28a3a660f4cedd778d48c78

Download Submit
C:\Windows\system\NbgjmiU.exe

Filesize
2.2MB

MD5
375ad0dc37128c11860ad90a29335389

SHA1
ec7e194b3c528f544346edcf5653f512808337f1

SHA256
654a345f862450c09c819b9911c5df752cf041c0d0522d222ae7acba68caa8c9

SHA512
5ba08042a835f1cc138a1c8c5c78c3d405bf00237ac8833dc5aa29427c4d6b115377d0be824f9b45a0b90eeb72831508f33741b5602fa14e1c5d1b19716256d3

Download Submit
C:\Windows\system\OkrQFTf.exe

Filesize
2.2MB

MD5
fa3e6630f5a2f7bfffcc34c29a29502c

SHA1
b113717944e02878c8b187fcdc704ca7b097f813

SHA256
198d3a5a8a3edb8e5afd77de1a960a0d8148c1cc26b26a598eadf6bdba07a56f

SHA512
978c672d25a00b1253fd0e82760727de69f3fb9ef4cca2df989a1952b3c25a3cedad6c508b366872ef6edb9fae121bdac170a5cd134901da7e05be5f0d9b0272

Download Submit
C:\Windows\system\OvWFBWD.exe

Filesize
2.2MB

MD5
4dd0e20158854eb7d10c4c21ffc8c784

SHA1
52c05ebd709ffd6cad3e3f94c7de69732fbfef3e

SHA256
a6de62449c6ec0db9db00ffc0e94b91bdbd2cee5bbe990f86869385d5071db9d

SHA512
87615dc699f8025a19b8fa396291077d7d3a43211ba60748543c03287cf87f2ec8b1ddde423846e3317ceb99c4b7ce4d55d0e86b48c01edfa03099ad53aa53c1

Download Submit
C:\Windows\system\QgWrQKz.exe

Filesize
2.2MB

MD5
1b9762066877efb646d7fcf5bf79a246

SHA1
e080349dee44756e39e938f2c9800a460b4d4f07

SHA256
e609bc2f1d489e3bc11348f4496f04279efab8967d1a1b94be68e405d660f1e2

SHA512
608b2ba02ef8a185dee19f9ef151934f1275f95f471035a93b494e363779d69a9f7b040b955cbee321cf7e173db8bfe9780a61fee65a1503390fe5befb5515e8

Download Submit
C:\Windows\system\TEqCcdw.exe

Filesize
2.2MB

MD5
beace9e060df4bf9978a650d624946b0

SHA1
c35a2aaeebdec4c1dc5005fbd7982fb1ed175d5b

SHA256
ce21534cfb411ad077c01f432a6b124dd0b8a22c72c2959867d4a5f636bdb6a5

SHA512
7f98531f32e06ff014e3af6025abc62458686b1288565509ba5b70cabc3aac199e12e2f74f04231ac10bee9d22106d90488964bff170bffd9f70829f6ca22966

Download Submit
C:\Windows\system\VHqoXLH.exe

Filesize
2.2MB

MD5
263480cb64909a49aa51fd58c8a17238

SHA1
0008316acb11d747f2f0b1cf41fe8d02dc01b4fc

SHA256
882607610f350738688d82fbb06e7c615563c5dbef7146f86f3b908223527455

SHA512
c8264208b8a8d04d3eb95d5baeb8278cd2770798af74c5d38285db2c948267286430aa064d42ddca94857deb3374469d432279e939d2bd58f8d250fbf6e22a4e

Download Submit
C:\Windows\system\VSHYSWm.exe

Filesize
2.2MB

MD5
ac6628a46f87a4f506b24a9231cdaf5c

SHA1
75b830394929ac0ebd04d5b219e130459a586e61

SHA256
a4d665b3c8972705250aa1f8263df57ac9dcde8e2b97fe623dab44c53a6c8dab

SHA512
e41522ea167a310de99aebc30294691341b9631934d0a85f2d49545586a429bf7046270bfc1793ec8a64a2f74d48763510f172bc2357608518c0907fe7506acc

Download Submit
C:\Windows\system\WkRXefk.exe

Filesize
2.2MB

MD5
5fbae3afd5dd6307f155ce9c3aefb523

SHA1
2d92dcabab8edf5fb5aeb4a8f4c445fd20d4f27b

SHA256
0606e5b5c073ac69e23bd9e91f7d69d3331e26693e2389913ed229742c5ff8c1

SHA512
c2056208f8a1ccf9bd9acba5840bd4b06e220c090f004be2f858957b3c6672acdd8ea5bdb2922321dfeabfaa89e2bb447fcb4524cee03d64100cd125c11838ae

Download Submit
C:\Windows\system\XApuONZ.exe

Filesize
2.2MB

MD5
7a69c5a379cbba1a674f8059d68ab26e

SHA1
16a777f0b4dda75e13a0e2a254cecc10e3f1b840

SHA256
7b25877a799f507a0e679f2646fe82dba7ad7ed6fa69f7ab7b2f90e28c201428

SHA512
a4571d13db33a6684b777dcc4196fb53e7285fe09187d2c410e65a586f7403d0fecaee1c1e04d8973c599af2139dac875ad9feaf1eee7b618105d99838196405

Download Submit
C:\Windows\system\YUcDrIA.exe

Filesize
2.2MB

MD5
b42f8ffac4e17536fe4f8724634ae8c7

SHA1
dc91beb4dce1552404378941071948db36100463

SHA256
68343573c48401494b8df164732502bf09b37293448aa763393fbbfe686430e0

SHA512
daf1a78e3a1ce3c3522e9dae40181fd95871583e358db1fb3306043ae3bf07064d54b63a12594a090b1a7e6002606e9b4ade9ec5f78679c231a8e6def5ce2bf2

Download Submit
C:\Windows\system\ZSuuUzk.exe

Filesize
2.2MB

MD5
60053993298d8ae24da261efad7367ea

SHA1
780a7e3e13a16ef0c899351cd55b14a54ea5f54c

SHA256
0d88b023175deeac4cc705636f5ad499230a87cc035787668a6c0cbe655d92a5

SHA512
77987477040f9b8d6d8015d6ad86957acac2e64b333f9ae13a51b0d708c6d47bbb8a39d134320099399a273e4eb377f547805c2cc24412cc8f48e885feb1108b

Download Submit
C:\Windows\system\ZeJNQMo.exe

Filesize
2.2MB

MD5
f213b04d6a0893bdb1ff757d933e84a3

SHA1
4ea72a896fe1594691cb97ef51a0b1d7b4ee86b4

SHA256
18a5ef40e123fff938bad73b3479a108454f2b29df0e2032fe0bf96b282509eb

SHA512
cd78ec6b978e0691a97da5a03e99ba9ae83a6bf8af5ce0903a793ff710e1a7386254ead9d6eaabdd993d15a61ba2498c8aaf27b2fed6504fb998dbad1d5f9533

Download Submit
C:\Windows\system\bUnpDPh.exe

Filesize
2.2MB

MD5
82e8a4deed70fb4439e6b50491e09cd1

SHA1
be5c136d0af310436fb7652c3b45035f8eec4a7a

SHA256
c07680f8aca4becd0c00d095f19fd71a852b2886864de184eacb5cc527af3b02

SHA512
701fb8be5dd1a01c974746077faf71ec6789a199c14a523beabfaed38e32432db99191232bde66946e45bb39fc363391db4349237efd31087a423b9e6dfcaebc

Download Submit
C:\Windows\system\fTxnQmt.exe

Filesize
2.2MB

MD5
df4be72e898412be4ff77c5bef623351

SHA1
2e94f4c254914f24dcc534f809f164083e29ae3a

SHA256
18b87e4b805f2af6bc4ac96ac24eb098fa6b3ee0bbc1f7b825723d263f51e7a3

SHA512
f644f04526f8fa73a4fbed0d23251f969de2e3f1a23231c5871e20fd948a54f81841adc47e8e3eabb1a7ddddacc68d9e703ebeaa9da144f4c0124bbb2c79b927

Download Submit
C:\Windows\system\ggcVaII.exe

Filesize
2.2MB

MD5
3ddc2e7c17cb0f8ce612f17ceb164e7c

SHA1
99c69d7d6c10784333aa8cd5271be02c6571bdce

SHA256
4f4370ff5b072ce071b5127e315b776376b2e1fcdccbf3d96a09a5fda9949220

SHA512
72f0fa38408d2b95d68f666b629181af2df6df5bf211771cbff05dd671b7deb8f94740a7c11929ddf8c3db9272d114e3dd81d359615cad65985792ff74a00337

Download Submit
C:\Windows\system\gyJkxJX.exe

Filesize
2.2MB

MD5
e84e06959bc214420f9b0ac5e8a893f2

SHA1
0c46c46bac016fb49461df9f5e3cfaa4bc2cbdda

SHA256
17ec3df420eefdf67e8d6623eec7cbff68fe9a9fabb90f5a16d6879389b36d93

SHA512
421ac724a037741981f6f4982b8f4c4dd4c3a6dbd5fd7467839d476c77174b6e7659399ea74889f4f09d939dce401962ad0850aff3dd181e0f1cad755c018d1b

Download Submit
C:\Windows\system\hiVpFVs.exe

Filesize
2.2MB

MD5
f2f9568c26d13515f7d4aae9b0ad9bd6

SHA1
175831ee39948bdd70d1b0bb3623bb4b82d7fb5a

SHA256
0a9ff492016c2056875016c6da99af4cdb37add62145ded532d18da4567ab9a5

SHA512
770ae12327d170653e665b55049b95688acd2e442733f1512284369dc49c12e604cb5532648ac00f2b1e7b80df35f2f44dc7b87ed4b4094e1e553646f96ae378

Download Submit
C:\Windows\system\hslgaow.exe

Filesize
2.2MB

MD5
4e1533c052b114eca08c7fdf3a1b5019

SHA1
d1caccdd1a153a9deec89f10979326efea29d83b

SHA256
ad927e100e1ed6e9902cd5169a4df2b58541eee2e7e5da47e300c26917114e21

SHA512
aef76264c9d12691bb6b0efa9e9baf07b3e7a71740c562c043572b346e011cc60d961f6e92ae10c09fabdc4a60751ecf020b8eb8cf86b14db968baafc9bfde16

Download Submit
C:\Windows\system\iKAnvVv.exe

Filesize
2.2MB

MD5
30385557cd62e0c9f6645484398ef7e7

SHA1
4dbce7f8cf564ad0ec1e4e76db5254f0372a8acf

SHA256
c7254f7c9db0e2d69828027da5ca942ceaeb5210d55611cdee34c07d133c9cc6

SHA512
9622bc6c59e052d90de684ea05690f929ae01e30891a0e98f7ec52c86d70e04c54480fe77ef8589b59caba2f4d014c9fa90f437875181248515ce5a7b1be3ec4

Download Submit
C:\Windows\system\liCibvB.exe

Filesize
2.2MB

MD5
fe8ee7ac83387eb8afb8d7900dda873b

SHA1
9c09000d1aaa2063cc2436c3ae0c7319bf144cf4

SHA256
ece99a7236a2c4be5631f35f023ccb474565eaa81898694451590b62b8dec04d

SHA512
ce7a5012c49212487f5a61d85358a64c67342def110d6d5bedd92090ca20d598a6f61fe2a4c4d6e78de678417b6b58123e3dd245df40564d673dccaae23dd330

Download Submit
C:\Windows\system\nxpgUon.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\qxMCytX.exe

Filesize
2.2MB

MD5
49cfe51801ac01139aa6ab680fcf6175

SHA1
2a2f575cb5ce232e471b17fee401ef03b8ede8d7

SHA256
2bdbcc2749c6343f21b2038dbf4ba29f06a4de4c1eb5d5ed0b1b57d12cbb0cec

SHA512
ba02c6241f3ada1bb149fa26e8b50439ef224b87ffbfdf156c8468d89cb0a2e1b5ef3e3da693490a3bd876c690bacbb34d61349259f2d6e55c4e3b9c76f9ff63

Download Submit
C:\Windows\system\urWAuiF.exe

Filesize
2.2MB

MD5
b48be49d403cd0718516251646a45dd7

SHA1
ea14f121aba6c3634874ba2d5695ae96c659d888

SHA256
3bfa5723900fd3f954b2fe21ce1717c69d925ecfa68c4e24c5e8d1411f53a2a4

SHA512
306a03bc77a2eed2db13d4d7e1665cef2701941dc1b247d57cfb72c5e482b5aa39ea26b37d8e36c705cf5e84e6b4067fceb54b36c5a635aeae291d1a781c515f

Download Submit
C:\Windows\system\yAxYymb.exe

Filesize
2.2MB

MD5
7e352e08bfd5515134c5abc83ea9a69d

SHA1
c13ba2df469b3baa3bce57ff44a93222822c24bd

SHA256
4bd0ff97bcfdfff14c6a4a01e233128913b0285c7da1b8ec8dfa44c814d74d11

SHA512
704ae0e85b6dc221ca860c4d96562408531d41236dbd90f9b55249c235610ba25df1363cbec339f79fd5016a0300801b43684520d1e16a066c181f24966b6600

Download Submit
\Windows\system\FQQRNzj.exe

Filesize
2.2MB

MD5
281e604b1b5b9be95eb350395d96252d

SHA1
f4c7739b2bbef76b1572123e2adae29edfbd3cb4

SHA256
040a3f7977846fc6be7ac97730b66f6937792da8071f4fa23cb9b1caa64f9c17

SHA512
fdc65f40a52fe2eea52d3b4d815cd9cea4fc3a6a82af0ad5edef8945aa1606f9f111ee50bf2bca88fd1079452a856573df8ebb2ebf0b155d96d2af0c26962c98

Download Submit
\Windows\system\PZlCGoE.exe

Filesize
2.2MB

MD5
3b6331852f02e0693b5d4c0071a9f3fe

SHA1
fd577add5475753c68787f770f4de53f60b60337

SHA256
f3869586c1ff26378e350c0445542cdc4f49baf4591ace247b0413e5bdee8234

SHA512
ceb8ffeeca02205a439a017ccf08fa0310179d573b1e8d44961c467a0d6a1a0f52391f6756cc47e6913e7d8255101dd0d50bb7bb5b10d5f9f4e7ac6fa52897c7

Download Submit
\Windows\system\YqXUxNP.exe

Filesize
2.2MB

MD5
2017f47d6670ddc3861101f579e95811

SHA1
25699110735c7a395f7197a490c39258698321ca

SHA256
4645acc9ee909f4c2cc26725990f7c1de52c974c005889d17eedf6e395d8d8ad

SHA512
6f33529644428ad274d86cd5b3301a2ec48271ac5e5596760e875ebc4f49fa76f61ef4cf150668ee72fed41b0e71639c0140fb938c58c1fb751cdbf0dde101bb

Download Submit
\Windows\system\curQGpe.exe

Filesize
2.2MB

MD5
f0c759ea6fce9d119a7d4bbf8dfd86c8

SHA1
570e74357ba973c6d85531ec035be1af99f5677e

SHA256
a26697b992fdde6d4f1785b5fecda797f332493fc704c9069703cbc14fa2cc67

SHA512
586a4e29eb7e90c40718c68b4e9856859f2fa7d5e2ddd9473b56211e349bf50e9af4c7a1ad3ab4f64147925866144774c431adbfc6650d5f8e6bb5775f8de7c7

Download Submit
\Windows\system\hLGjKDu.exe

Filesize
2.2MB

MD5
5d1de6a11b38d999523e30afaf07d53a

SHA1
6c5dda53340b8e6ee4a3342e3d1b4e679ed648e4

SHA256
51973ba7ec517ea17854b47032e027143042645e46c8caf8ce33074c1204fa6f

SHA512
6cd1c6f53dcd2ccfdf7663585dd8dfc8620bee8765040ab646b760dee6716324ffcff7b76ccc201a9115a938578c1f9a2c97774b8d3436f24c27c6b1aa3d9166

Download Submit
\Windows\system\iTXgDYQ.exe

Filesize
2.2MB

MD5
8aafdb1d41a9f95a96fe94695f07efe0

SHA1
2470326d02d6238b69a8cc9adee8a264c54adc00

SHA256
7acc05bd164776d4531ef294bdd427603568c94f580bfabae343288beb19cd2d

SHA512
e146d3cb7abce0c6e4f89be78d541080bfbe3fdb58828fbd296d58a7ae246672ecdc8a761d758dafeaf614a99da12e44385e4381176217f2ea959744328a2f70

Download Submit
\Windows\system\iTjdMje.exe

Filesize
2.2MB

MD5
a540e17706c9d0ca476cdd0e314e1382

SHA1
586906275851b2d60f0088712e0bb3866ca1415f

SHA256
d5757b503069bd2bc68583624670e79ebd4e0af319e0a062405da33c90425be1

SHA512
e9793fb3956b67b3bf3f621214208e0944e1700885329f47a156c65baa90732af542699c7f1bea7518a23b2ed6a3c68c59f7ef25b6d48f8515a66dcd68d8d31b

Download Submit
\Windows\system\wuMZTEb.exe

Filesize
2.2MB

MD5
ca75a8bf222b6a1a0d2b4d9cca3091cc

SHA1
184babb32be9ff190f3f04ea62c14d20dcb881b9

SHA256
c2fdd617087ddba17913747e45242c112d92bdb4079b4a30366e5327f2aa8b4e

SHA512
33c7a36b3b12e868b43fa0dbfe8a2a0149de78e4eba41888d5dcbc93af37c4906b1d61d24336143e6e930fafee79cc46a3cd8770ab4fb0d767733b019b5f35af

Download Submit
\Windows\system\xtDFdNu.exe

Filesize
2.2MB

MD5
d872c496cd8b807daf95c8ef73bcca36

SHA1
ecdc2d58623e5f6aa6cf4db79ecad05f908fe3cf

SHA256
626a193834398c16e4d39824217c303dc42cb56bf8de20e854baf4b5edc0e09d

SHA512
8b2325ad027d1b67580404fdf05b8d956fff97bb33ffc34ca1bc6daacf03ac93abc46b4d113d87b444e37107c8d77637f268f4f4e849a85b93aee2d696e9b05b

Download Submit
memory/320-72-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/320-6751-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-63-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/1728-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1728-55-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-45-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/1728-16-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/1728-57-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/1728-21-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-73-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-6-0x00000000029B0000-0x0000000002DA2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-1-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-39-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-70-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-44-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1728-30-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2144-242-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2144-243-0x00000000027F0000-0x00000000027F8000-memory.dmp

Filesize
32KB

Download
memory/2404-6766-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2404-56-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2432-6322-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2432-82-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2508-58-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2508-6749-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2516-6765-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2516-43-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2536-1148-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2536-6767-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2536-46-0x000000013FCA0000-0x0000000140092000-memory.dmp

Filesize
3.9MB

Download
memory/2592-6750-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-37-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-1149-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-6755-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-47-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-8-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2688-6748-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-260-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2720-42-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2720-6761-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2860-65-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2980-6752-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-539-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-40-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download