xmrig | 89b0bccfed7ae3bd81691509a6a08279e23325bf003a16523fdb6a0bafb492b6

Analysis

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
Size

3.0MB
MD5

8ef6ea27d02a5bfed61d37b126afd840
SHA1

2c21358d2cb2fa1bdf2e825f5eeb03b13905fc81
SHA256

89b0bccfed7ae3bd81691509a6a08279e23325bf003a16523fdb6a0bafb492b6
SHA512

43361dac12aa5613bf4b718e678b88fb63b4c7c22c90a91daa55c82f49b9d21cc284e991500918e957bbbe5cdefa3d33b36f411fddd5a84d9ad6b8d01f47ab17
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5HYTCtTa:NABC

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2144-129-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2748-160-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2644-157-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2184-153-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2352-148-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2532-145-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2428-139-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2180-134-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2436-128-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2736-126-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2736-5529-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2520-5528-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2180-5526-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/2428-5531-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2836-5536-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2748-5537-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2352-5543-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2436-5542-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2644-5539-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2184-5538-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2520	SaVNOkg.exe
2836	wklCoyl.exe
2736	rtmkACc.exe
2436	KjHExPk.exe
2180	ppBKMpO.exe
2428	eKjsjLn.exe
2532	GXULOAj.exe
2352	TBeIsYj.exe
2184	NIrNexm.exe
2644	LRbDBdj.exe
2748	csKCVuQ.exe
2900	MFPkUrx.exe
1484	xzGtKva.exe
2776	vVmuUXA.exe
1840	mubempN.exe
1576	PmsOTMS.exe
1852	FhiZJOU.exe
2140	juoXbeu.exe
1368	KcHObkJ.exe
1692	kYgELkk.exe
240	IeyIwnL.exe
1296	ZLAaoqX.exe
2120	stnfuvH.exe
2260	smxpJkJ.exe
1880	xpeVauA.exe
2380	QrBzRLt.exe
3036	CcLvdBx.exe
1196	wNsoHjs.exe
2228	vDXGOfd.exe
3012	OGflcib.exe
1716	cgZEOuz.exe
1756	otKSOdr.exe
2816	syLNezZ.exe
912	OgzRKaV.exe
1492	AnjiLlh.exe
1800	SHMlkRQ.exe
1212	ZXsLHiZ.exe
2168	PfmtOeS.exe
1056	SPTFzhB.exe
2320	pkKxocQ.exe
1052	oJSYNGn.exe
1140	qyhvFlz.exe
1992	kUdcvmQ.exe
2496	NjQnhFD.exe
900	nkMUhDX.exe
2876	NSkPOvL.exe
1564	aulDswE.exe
1912	VzufBQu.exe
2540	FdwQsvV.exe
1652	MKuzPQt.exe
2516	QyldDxC.exe
2620	CxvWRqb.exe
2416	Ryxabij.exe
2696	keZEjHZ.exe
2456	ylJpUSg.exe
2916	iyMqmvV.exe
2632	ifVkzcB.exe
1868	hHmVGRC.exe
1892	tmbecxz.exe
2760	RPEOxiN.exe
960	HWqhUgj.exe
1728	akenElF.exe
1888	kaZXZRi.exe
856	vJtzrcU.exe

Loads dropped DLL 64 IoCs

pid	Process
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2144-2-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/files/0x000b000000014e5a-3.dat	upx
behavioral1/files/0x000b000000014e5a-7.dat	upx
behavioral1/files/0x0031000000015b13-13.dat	upx
behavioral1/memory/2520-8-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/files/0x0006000000016597-90.dat	upx
behavioral1/files/0x0006000000016c26-80.dat	upx
behavioral1/files/0x0006000000016cc9-100.dat	upx
behavioral1/files/0x0006000000016ce1-114.dat	upx
behavioral1/files/0x0006000000016cc9-113.dat	upx
behavioral1/files/0x0006000000016d06-149.dat	upx
behavioral1/files/0x0006000000016d0e-165.dat	upx
behavioral1/files/0x0006000000016d27-177.dat	upx
behavioral1/files/0x0006000000016d40-182.dat	upx
behavioral1/files/0x0006000000016d17-169.dat	upx
behavioral1/files/0x0006000000016d3b-198.dat	upx
behavioral1/files/0x0031000000015b77-194.dat	upx
behavioral1/files/0x0006000000016d44-186.dat	upx
behavioral1/files/0x0006000000016d4b-191.dat	upx
behavioral1/files/0x0006000000016d1f-190.dat	upx
behavioral1/files/0x0006000000016d27-175.dat	upx
behavioral1/memory/2748-160-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2644-157-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2184-153-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2352-148-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2532-145-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x0006000000016cfe-141.dat	upx
behavioral1/memory/2428-139-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2180-134-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/files/0x0006000000016cf5-132.dat	upx
behavioral1/memory/2436-128-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2736-126-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0006000000016ced-122.dat	upx
behavioral1/files/0x0006000000016c7a-108.dat	upx
behavioral1/files/0x0006000000016cab-105.dat	upx
behavioral1/files/0x0006000000016c2e-104.dat	upx
behavioral1/files/0x0006000000016c17-86.dat	upx
behavioral1/files/0x00060000000167ef-83.dat	upx
behavioral1/files/0x0006000000016c2e-87.dat	upx
behavioral1/files/0x0006000000016a45-74.dat	upx
behavioral1/files/0x0006000000016525-69.dat	upx
behavioral1/files/0x0006000000016411-62.dat	upx
behavioral1/files/0x00070000000160f8-49.dat	upx
behavioral1/files/0x0008000000015cad-45.dat	upx
behavioral1/files/0x0008000000015ca5-39.dat	upx
behavioral1/files/0x001400000000549e-30.dat	upx
behavioral1/files/0x0007000000015c7c-25.dat	upx
behavioral1/memory/2836-19-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2736-5529-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2520-5528-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2180-5526-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/2428-5531-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2836-5536-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2748-5537-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/memory/2352-5543-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2436-5542-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2644-5539-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2184-5538-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XUbumjO.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\pHXxyGg.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\TNyghYY.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\HKZnnin.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\bwfLenE.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\wCHASaC.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\tyZqLWt.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\sixkppU.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\jESsdnv.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\NFkbzwv.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\bLAyxnD.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\bytAYWA.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\cuhsOwY.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\JQqXeGc.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\fPtiAVl.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\xHqxFMB.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\zrkoOoW.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\bLWuCyn.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\vGFiKYA.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\VWIMgvW.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\MGCKuvK.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\NWnBZbn.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\QtiDAGG.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\crQZWkl.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\Uohhssv.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\hdFBvNd.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\GyhBKDy.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\dBxqTMy.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\AOtIJze.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\siiJzIw.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\goXxOkV.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\rqbfret.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\uzWcYAh.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\AusXdMo.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\qgzvkPC.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\ICpqEqp.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\TuUUSUR.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\ZICmZmL.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\YxmHtED.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\OrFhXFP.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\fJDDxJF.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\TzmWVlj.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\gIXhCAg.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\UzjczgW.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\mrVFyUd.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\INFFlVA.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\bNsifrn.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\osOGzOL.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\UyAYhsy.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\XaHwAuu.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\zGsmwsI.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\czjqfue.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\msHcqwB.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\NGFyJvB.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\YmajvIf.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\cABePre.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\sIpywFa.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\rJhKyql.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\qglUTLU.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\blMEjQI.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\EwlVOOd.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\zEkfHHv.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\sgWXvsY.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
File created	C:\Windows\System\zVizhTw.exe	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2744	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
Token: SeDebugPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2744	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	29
PID 2144 wrote to memory of 2744	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	29
PID 2144 wrote to memory of 2744	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	29
PID 2144 wrote to memory of 2520	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	30
PID 2144 wrote to memory of 2520	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	30
PID 2144 wrote to memory of 2520	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	30
PID 2144 wrote to memory of 2836	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	31
PID 2144 wrote to memory of 2836	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	31
PID 2144 wrote to memory of 2836	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	31
PID 2144 wrote to memory of 2736	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	32
PID 2144 wrote to memory of 2736	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	32
PID 2144 wrote to memory of 2736	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	32
PID 2144 wrote to memory of 2436	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	33
PID 2144 wrote to memory of 2436	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	33
PID 2144 wrote to memory of 2436	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	33
PID 2144 wrote to memory of 2180	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	34
PID 2144 wrote to memory of 2180	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	34
PID 2144 wrote to memory of 2180	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	34
PID 2144 wrote to memory of 2428	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	35
PID 2144 wrote to memory of 2428	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	35
PID 2144 wrote to memory of 2428	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	35
PID 2144 wrote to memory of 2532	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	36
PID 2144 wrote to memory of 2532	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	36
PID 2144 wrote to memory of 2532	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	36
PID 2144 wrote to memory of 2352	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	37
PID 2144 wrote to memory of 2352	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	37
PID 2144 wrote to memory of 2352	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	37
PID 2144 wrote to memory of 2184	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	38
PID 2144 wrote to memory of 2184	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	38
PID 2144 wrote to memory of 2184	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	38
PID 2144 wrote to memory of 2644	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	39
PID 2144 wrote to memory of 2644	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	39
PID 2144 wrote to memory of 2644	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	39
PID 2144 wrote to memory of 2748	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	40
PID 2144 wrote to memory of 2748	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	40
PID 2144 wrote to memory of 2748	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	40
PID 2144 wrote to memory of 2776	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	41
PID 2144 wrote to memory of 2776	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	41
PID 2144 wrote to memory of 2776	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	41
PID 2144 wrote to memory of 2900	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	42
PID 2144 wrote to memory of 2900	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	42
PID 2144 wrote to memory of 2900	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	42
PID 2144 wrote to memory of 1840	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	43
PID 2144 wrote to memory of 1840	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	43
PID 2144 wrote to memory of 1840	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	43
PID 2144 wrote to memory of 1484	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	44
PID 2144 wrote to memory of 1484	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	44
PID 2144 wrote to memory of 1484	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	44
PID 2144 wrote to memory of 2140	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	45
PID 2144 wrote to memory of 2140	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	45
PID 2144 wrote to memory of 2140	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	45
PID 2144 wrote to memory of 1576	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	46
PID 2144 wrote to memory of 1576	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	46
PID 2144 wrote to memory of 1576	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	46
PID 2144 wrote to memory of 1368	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	47
PID 2144 wrote to memory of 1368	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	47
PID 2144 wrote to memory of 1368	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	47
PID 2144 wrote to memory of 1852	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	48
PID 2144 wrote to memory of 1852	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	48
PID 2144 wrote to memory of 1852	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	48
PID 2144 wrote to memory of 1692	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	49
PID 2144 wrote to memory of 1692	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	49
PID 2144 wrote to memory of 1692	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	49
PID 2144 wrote to memory of 240	2144	8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8ef6ea27d02a5bfed61d37b126afd840_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System\SaVNOkg.exe
  C:\Windows\System\SaVNOkg.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\wklCoyl.exe
  C:\Windows\System\wklCoyl.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\rtmkACc.exe
  C:\Windows\System\rtmkACc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\KjHExPk.exe
  C:\Windows\System\KjHExPk.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ppBKMpO.exe
  C:\Windows\System\ppBKMpO.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\eKjsjLn.exe
  C:\Windows\System\eKjsjLn.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\GXULOAj.exe
  C:\Windows\System\GXULOAj.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\TBeIsYj.exe
  C:\Windows\System\TBeIsYj.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\NIrNexm.exe
  C:\Windows\System\NIrNexm.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\LRbDBdj.exe
  C:\Windows\System\LRbDBdj.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\csKCVuQ.exe
  C:\Windows\System\csKCVuQ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vVmuUXA.exe
  C:\Windows\System\vVmuUXA.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\MFPkUrx.exe
  C:\Windows\System\MFPkUrx.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\mubempN.exe
  C:\Windows\System\mubempN.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\xzGtKva.exe
  C:\Windows\System\xzGtKva.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\juoXbeu.exe
  C:\Windows\System\juoXbeu.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\PmsOTMS.exe
  C:\Windows\System\PmsOTMS.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\KcHObkJ.exe
  C:\Windows\System\KcHObkJ.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\FhiZJOU.exe
  C:\Windows\System\FhiZJOU.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\kYgELkk.exe
  C:\Windows\System\kYgELkk.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\IeyIwnL.exe
  C:\Windows\System\IeyIwnL.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\ZLAaoqX.exe
  C:\Windows\System\ZLAaoqX.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\stnfuvH.exe
  C:\Windows\System\stnfuvH.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\smxpJkJ.exe
  C:\Windows\System\smxpJkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\xpeVauA.exe
  C:\Windows\System\xpeVauA.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\QrBzRLt.exe
  C:\Windows\System\QrBzRLt.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\CcLvdBx.exe
  C:\Windows\System\CcLvdBx.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\vDXGOfd.exe
  C:\Windows\System\vDXGOfd.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\wNsoHjs.exe
  C:\Windows\System\wNsoHjs.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\OGflcib.exe
  C:\Windows\System\OGflcib.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\cgZEOuz.exe
  C:\Windows\System\cgZEOuz.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\AnjiLlh.exe
  C:\Windows\System\AnjiLlh.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\otKSOdr.exe
  C:\Windows\System\otKSOdr.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\SHMlkRQ.exe
  C:\Windows\System\SHMlkRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\syLNezZ.exe
  C:\Windows\System\syLNezZ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ZXsLHiZ.exe
  C:\Windows\System\ZXsLHiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\OgzRKaV.exe
  C:\Windows\System\OgzRKaV.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\PfmtOeS.exe
  C:\Windows\System\PfmtOeS.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\SPTFzhB.exe
  C:\Windows\System\SPTFzhB.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\oJSYNGn.exe
  C:\Windows\System\oJSYNGn.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\pkKxocQ.exe
  C:\Windows\System\pkKxocQ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\qyhvFlz.exe
  C:\Windows\System\qyhvFlz.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\kUdcvmQ.exe
  C:\Windows\System\kUdcvmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\NjQnhFD.exe
  C:\Windows\System\NjQnhFD.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\nkMUhDX.exe
  C:\Windows\System\nkMUhDX.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\NSkPOvL.exe
  C:\Windows\System\NSkPOvL.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\aulDswE.exe
  C:\Windows\System\aulDswE.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\VzufBQu.exe
  C:\Windows\System\VzufBQu.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\FdwQsvV.exe
  C:\Windows\System\FdwQsvV.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\MKuzPQt.exe
  C:\Windows\System\MKuzPQt.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\QyldDxC.exe
  C:\Windows\System\QyldDxC.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\Ryxabij.exe
  C:\Windows\System\Ryxabij.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\CxvWRqb.exe
  C:\Windows\System\CxvWRqb.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\keZEjHZ.exe
  C:\Windows\System\keZEjHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ylJpUSg.exe
  C:\Windows\System\ylJpUSg.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\iyMqmvV.exe
  C:\Windows\System\iyMqmvV.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\tmbecxz.exe
  C:\Windows\System\tmbecxz.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\ifVkzcB.exe
  C:\Windows\System\ifVkzcB.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\RPEOxiN.exe
  C:\Windows\System\RPEOxiN.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\hHmVGRC.exe
  C:\Windows\System\hHmVGRC.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\HWqhUgj.exe
  C:\Windows\System\HWqhUgj.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\ThuZthk.exe
  C:\Windows\System\ThuZthk.exe
  2⤵
  PID:1520
- C:\Windows\System\akenElF.exe
  C:\Windows\System\akenElF.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\phoqkyV.exe
  C:\Windows\System\phoqkyV.exe
  2⤵
  PID:2636
- C:\Windows\System\kaZXZRi.exe
  C:\Windows\System\kaZXZRi.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\dhjFsfR.exe
  C:\Windows\System\dhjFsfR.exe
  2⤵
  PID:1284
- C:\Windows\System\vJtzrcU.exe
  C:\Windows\System\vJtzrcU.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\DpKSvPD.exe
  C:\Windows\System\DpKSvPD.exe
  2⤵
  PID:2952
- C:\Windows\System\JIYQgRC.exe
  C:\Windows\System\JIYQgRC.exe
  2⤵
  PID:2820
- C:\Windows\System\wLaWKna.exe
  C:\Windows\System\wLaWKna.exe
  2⤵
  PID:2528
- C:\Windows\System\opnRmUi.exe
  C:\Windows\System\opnRmUi.exe
  2⤵
  PID:2264
- C:\Windows\System\drQGMRa.exe
  C:\Windows\System\drQGMRa.exe
  2⤵
  PID:2932
- C:\Windows\System\ZTAwmfP.exe
  C:\Windows\System\ZTAwmfP.exe
  2⤵
  PID:2076
- C:\Windows\System\cOQPmVb.exe
  C:\Windows\System\cOQPmVb.exe
  2⤵
  PID:2208
- C:\Windows\System\pCEokwW.exe
  C:\Windows\System\pCEokwW.exe
  2⤵
  PID:1928
- C:\Windows\System\qrauKRV.exe
  C:\Windows\System\qrauKRV.exe
  2⤵
  PID:452
- C:\Windows\System\TxyXmOj.exe
  C:\Windows\System\TxyXmOj.exe
  2⤵
  PID:2860
- C:\Windows\System\thqYNpZ.exe
  C:\Windows\System\thqYNpZ.exe
  2⤵
  PID:628
- C:\Windows\System\cZIeNBB.exe
  C:\Windows\System\cZIeNBB.exe
  2⤵
  PID:112
- C:\Windows\System\psRhZOO.exe
  C:\Windows\System\psRhZOO.exe
  2⤵
  PID:2160
- C:\Windows\System\BxXUxUG.exe
  C:\Windows\System\BxXUxUG.exe
  2⤵
  PID:2164
- C:\Windows\System\xhbppRp.exe
  C:\Windows\System\xhbppRp.exe
  2⤵
  PID:2336
- C:\Windows\System\GPlbryJ.exe
  C:\Windows\System\GPlbryJ.exe
  2⤵
  PID:568
- C:\Windows\System\LXZdutj.exe
  C:\Windows\System\LXZdutj.exe
  2⤵
  PID:1452
- C:\Windows\System\OYJGYWG.exe
  C:\Windows\System\OYJGYWG.exe
  2⤵
  PID:2060
- C:\Windows\System\wkBrqOW.exe
  C:\Windows\System\wkBrqOW.exe
  2⤵
  PID:1604
- C:\Windows\System\IHZOxvz.exe
  C:\Windows\System\IHZOxvz.exe
  2⤵
  PID:1960
- C:\Windows\System\lMTzTtY.exe
  C:\Windows\System\lMTzTtY.exe
  2⤵
  PID:1544
- C:\Windows\System\jMbhHIO.exe
  C:\Windows\System\jMbhHIO.exe
  2⤵
  PID:896
- C:\Windows\System\ZNkZMvy.exe
  C:\Windows\System\ZNkZMvy.exe
  2⤵
  PID:2472
- C:\Windows\System\LjrrasI.exe
  C:\Windows\System\LjrrasI.exe
  2⤵
  PID:2768
- C:\Windows\System\HSvYlak.exe
  C:\Windows\System\HSvYlak.exe
  2⤵
  PID:2716
- C:\Windows\System\idNczmy.exe
  C:\Windows\System\idNczmy.exe
  2⤵
  PID:3092
- C:\Windows\System\eBKMPKl.exe
  C:\Windows\System\eBKMPKl.exe
  2⤵
  PID:3108
- C:\Windows\System\jplRYLS.exe
  C:\Windows\System\jplRYLS.exe
  2⤵
  PID:3124
- C:\Windows\System\LQUsdwb.exe
  C:\Windows\System\LQUsdwb.exe
  2⤵
  PID:3140
- C:\Windows\System\EFZnlfR.exe
  C:\Windows\System\EFZnlfR.exe
  2⤵
  PID:3156
- C:\Windows\System\NByoNYl.exe
  C:\Windows\System\NByoNYl.exe
  2⤵
  PID:3176
- C:\Windows\System\EEDkhrV.exe
  C:\Windows\System\EEDkhrV.exe
  2⤵
  PID:3192
- C:\Windows\System\AOzcITV.exe
  C:\Windows\System\AOzcITV.exe
  2⤵
  PID:3208
- C:\Windows\System\ouwlkCt.exe
  C:\Windows\System\ouwlkCt.exe
  2⤵
  PID:3224
- C:\Windows\System\ApYecjB.exe
  C:\Windows\System\ApYecjB.exe
  2⤵
  PID:3240
- C:\Windows\System\lTbHJwS.exe
  C:\Windows\System\lTbHJwS.exe
  2⤵
  PID:3256
- C:\Windows\System\SBPFSKX.exe
  C:\Windows\System\SBPFSKX.exe
  2⤵
  PID:3272
- C:\Windows\System\uIwEmRD.exe
  C:\Windows\System\uIwEmRD.exe
  2⤵
  PID:3292
- C:\Windows\System\FycMAJe.exe
  C:\Windows\System\FycMAJe.exe
  2⤵
  PID:3308
- C:\Windows\System\HeNjZou.exe
  C:\Windows\System\HeNjZou.exe
  2⤵
  PID:3324
- C:\Windows\System\gYhkxiX.exe
  C:\Windows\System\gYhkxiX.exe
  2⤵
  PID:3340
- C:\Windows\System\ahQjkRX.exe
  C:\Windows\System\ahQjkRX.exe
  2⤵
  PID:3356
- C:\Windows\System\VbnNfeN.exe
  C:\Windows\System\VbnNfeN.exe
  2⤵
  PID:3372
- C:\Windows\System\fIGSebT.exe
  C:\Windows\System\fIGSebT.exe
  2⤵
  PID:3388
- C:\Windows\System\XZiHGAV.exe
  C:\Windows\System\XZiHGAV.exe
  2⤵
  PID:3404
- C:\Windows\System\aZSNKhB.exe
  C:\Windows\System\aZSNKhB.exe
  2⤵
  PID:3424
- C:\Windows\System\KMOONjO.exe
  C:\Windows\System\KMOONjO.exe
  2⤵
  PID:3440
- C:\Windows\System\JNrzdDE.exe
  C:\Windows\System\JNrzdDE.exe
  2⤵
  PID:3456
- C:\Windows\System\aCQdFdR.exe
  C:\Windows\System\aCQdFdR.exe
  2⤵
  PID:3472
- C:\Windows\System\pjoKsxx.exe
  C:\Windows\System\pjoKsxx.exe
  2⤵
  PID:3488
- C:\Windows\System\BHNBcBZ.exe
  C:\Windows\System\BHNBcBZ.exe
  2⤵
  PID:3504
- C:\Windows\System\OVIgtBX.exe
  C:\Windows\System\OVIgtBX.exe
  2⤵
  PID:3520
- C:\Windows\System\ixmAoPh.exe
  C:\Windows\System\ixmAoPh.exe
  2⤵
  PID:3536
- C:\Windows\System\nDATOSA.exe
  C:\Windows\System\nDATOSA.exe
  2⤵
  PID:3556
- C:\Windows\System\VYBAARs.exe
  C:\Windows\System\VYBAARs.exe
  2⤵
  PID:3572
- C:\Windows\System\AKCwcWr.exe
  C:\Windows\System\AKCwcWr.exe
  2⤵
  PID:3588
- C:\Windows\System\FATUuPg.exe
  C:\Windows\System\FATUuPg.exe
  2⤵
  PID:3604
- C:\Windows\System\Noypkee.exe
  C:\Windows\System\Noypkee.exe
  2⤵
  PID:3620
- C:\Windows\System\MuORxFM.exe
  C:\Windows\System\MuORxFM.exe
  2⤵
  PID:3636
- C:\Windows\System\zliyiUk.exe
  C:\Windows\System\zliyiUk.exe
  2⤵
  PID:3652
- C:\Windows\System\Ohbdldz.exe
  C:\Windows\System\Ohbdldz.exe
  2⤵
  PID:3668
- C:\Windows\System\kfzOrkV.exe
  C:\Windows\System\kfzOrkV.exe
  2⤵
  PID:3684
- C:\Windows\System\octHGdQ.exe
  C:\Windows\System\octHGdQ.exe
  2⤵
  PID:3700
- C:\Windows\System\LQZeLqB.exe
  C:\Windows\System\LQZeLqB.exe
  2⤵
  PID:3716
- C:\Windows\System\xcIdwVv.exe
  C:\Windows\System\xcIdwVv.exe
  2⤵
  PID:3736
- C:\Windows\System\gaXRoFt.exe
  C:\Windows\System\gaXRoFt.exe
  2⤵
  PID:3752
- C:\Windows\System\oJThgyU.exe
  C:\Windows\System\oJThgyU.exe
  2⤵
  PID:3768
- C:\Windows\System\oXQggSE.exe
  C:\Windows\System\oXQggSE.exe
  2⤵
  PID:3784
- C:\Windows\System\TTtOqEX.exe
  C:\Windows\System\TTtOqEX.exe
  2⤵
  PID:3800
- C:\Windows\System\iWXoZmo.exe
  C:\Windows\System\iWXoZmo.exe
  2⤵
  PID:3816
- C:\Windows\System\dBpCQat.exe
  C:\Windows\System\dBpCQat.exe
  2⤵
  PID:3832
- C:\Windows\System\CfNmkqb.exe
  C:\Windows\System\CfNmkqb.exe
  2⤵
  PID:3852
- C:\Windows\System\dqhkIOz.exe
  C:\Windows\System\dqhkIOz.exe
  2⤵
  PID:3868
- C:\Windows\System\OwmyKas.exe
  C:\Windows\System\OwmyKas.exe
  2⤵
  PID:3884
- C:\Windows\System\Ohnjgfd.exe
  C:\Windows\System\Ohnjgfd.exe
  2⤵
  PID:3900
- C:\Windows\System\sMoUzGs.exe
  C:\Windows\System\sMoUzGs.exe
  2⤵
  PID:3916
- C:\Windows\System\hZfuUTU.exe
  C:\Windows\System\hZfuUTU.exe
  2⤵
  PID:3932
- C:\Windows\System\ZJYEqvd.exe
  C:\Windows\System\ZJYEqvd.exe
  2⤵
  PID:3948
- C:\Windows\System\TresjHY.exe
  C:\Windows\System\TresjHY.exe
  2⤵
  PID:3972
- C:\Windows\System\vzgtSyQ.exe
  C:\Windows\System\vzgtSyQ.exe
  2⤵
  PID:3988
- C:\Windows\System\zYPvghm.exe
  C:\Windows\System\zYPvghm.exe
  2⤵
  PID:4004
- C:\Windows\System\LdwTRVA.exe
  C:\Windows\System\LdwTRVA.exe
  2⤵
  PID:4020
- C:\Windows\System\EiInDMC.exe
  C:\Windows\System\EiInDMC.exe
  2⤵
  PID:4036
- C:\Windows\System\lSqDAWw.exe
  C:\Windows\System\lSqDAWw.exe
  2⤵
  PID:4052
- C:\Windows\System\tAaZpYE.exe
  C:\Windows\System\tAaZpYE.exe
  2⤵
  PID:4068
- C:\Windows\System\xHmnaBB.exe
  C:\Windows\System\xHmnaBB.exe
  2⤵
  PID:4088
- C:\Windows\System\NNOGYRo.exe
  C:\Windows\System\NNOGYRo.exe
  2⤵
  PID:1512
- C:\Windows\System\DMCKUYF.exe
  C:\Windows\System\DMCKUYF.exe
  2⤵
  PID:2032
- C:\Windows\System\cRtcGvA.exe
  C:\Windows\System\cRtcGvA.exe
  2⤵
  PID:3184
- C:\Windows\System\jXuwwrT.exe
  C:\Windows\System\jXuwwrT.exe
  2⤵
  PID:3288
- C:\Windows\System\IkiQdma.exe
  C:\Windows\System\IkiQdma.exe
  2⤵
  PID:3352
- C:\Windows\System\nPErxQi.exe
  C:\Windows\System\nPErxQi.exe
  2⤵
  PID:3420
- C:\Windows\System\xUqKUEE.exe
  C:\Windows\System\xUqKUEE.exe
  2⤵
  PID:3480
- C:\Windows\System\uqjJfcQ.exe
  C:\Windows\System\uqjJfcQ.exe
  2⤵
  PID:3584
- C:\Windows\System\oRlyzQN.exe
  C:\Windows\System\oRlyzQN.exe
  2⤵
  PID:3648
- C:\Windows\System\YsbLCgA.exe
  C:\Windows\System\YsbLCgA.exe
  2⤵
  PID:2708
- C:\Windows\System\htESNzF.exe
  C:\Windows\System\htESNzF.exe
  2⤵
  PID:3812
- C:\Windows\System\snxYMnH.exe
  C:\Windows\System\snxYMnH.exe
  2⤵
  PID:3880
- C:\Windows\System\XkAAWAI.exe
  C:\Windows\System\XkAAWAI.exe
  2⤵
  PID:3980
- C:\Windows\System\agxolpK.exe
  C:\Windows\System\agxolpK.exe
  2⤵
  PID:4044
- C:\Windows\System\DbFeEOl.exe
  C:\Windows\System\DbFeEOl.exe
  2⤵
  PID:276
- C:\Windows\System\PeZRPMZ.exe
  C:\Windows\System\PeZRPMZ.exe
  2⤵
  PID:2444
- C:\Windows\System\bpjRgqj.exe
  C:\Windows\System\bpjRgqj.exe
  2⤵
  PID:2556
- C:\Windows\System\BGdnnvS.exe
  C:\Windows\System\BGdnnvS.exe
  2⤵
  PID:2272
- C:\Windows\System\YJlXMaq.exe
  C:\Windows\System\YJlXMaq.exe
  2⤵
  PID:1020
- C:\Windows\System\UlEqgjt.exe
  C:\Windows\System\UlEqgjt.exe
  2⤵
  PID:1720
- C:\Windows\System\DdtJTsT.exe
  C:\Windows\System\DdtJTsT.exe
  2⤵
  PID:1440
- C:\Windows\System\ynWLIdS.exe
  C:\Windows\System\ynWLIdS.exe
  2⤵
  PID:2348
- C:\Windows\System\ZttCbli.exe
  C:\Windows\System\ZttCbli.exe
  2⤵
  PID:3116
- C:\Windows\System\cFmwHtM.exe
  C:\Windows\System\cFmwHtM.exe
  2⤵
  PID:3188
- C:\Windows\System\ofllozZ.exe
  C:\Windows\System\ofllozZ.exe
  2⤵
  PID:3512
- C:\Windows\System\dDCNFqV.exe
  C:\Windows\System\dDCNFqV.exe
  2⤵
  PID:3712
- C:\Windows\System\piSCGbg.exe
  C:\Windows\System\piSCGbg.exe
  2⤵
  PID:3876
- C:\Windows\System\baFVPtO.exe
  C:\Windows\System\baFVPtO.exe
  2⤵
  PID:2064
- C:\Windows\System\MZrvNNR.exe
  C:\Windows\System\MZrvNNR.exe
  2⤵
  PID:1588
- C:\Windows\System\wmyeFzd.exe
  C:\Windows\System\wmyeFzd.exe
  2⤵
  PID:1476
- C:\Windows\System\eyNhTwe.exe
  C:\Windows\System\eyNhTwe.exe
  2⤵
  PID:2512
- C:\Windows\System\OEsdLyB.exe
  C:\Windows\System\OEsdLyB.exe
  2⤵
  PID:3100
- C:\Windows\System\bbiHLfq.exe
  C:\Windows\System\bbiHLfq.exe
  2⤵
  PID:3164
- C:\Windows\System\GXwJFCn.exe
  C:\Windows\System\GXwJFCn.exe
  2⤵
  PID:3204
- C:\Windows\System\KFeEdch.exe
  C:\Windows\System\KFeEdch.exe
  2⤵
  PID:3268
- C:\Windows\System\ezzJKcA.exe
  C:\Windows\System\ezzJKcA.exe
  2⤵
  PID:3336
- C:\Windows\System\vMjyJoo.exe
  C:\Windows\System\vMjyJoo.exe
  2⤵
  PID:3400
- C:\Windows\System\ebDEyOs.exe
  C:\Windows\System\ebDEyOs.exe
  2⤵
  PID:3464
- C:\Windows\System\GAzJHVD.exe
  C:\Windows\System\GAzJHVD.exe
  2⤵
  PID:3532
- C:\Windows\System\AcUfRqn.exe
  C:\Windows\System\AcUfRqn.exe
  2⤵
  PID:3600
- C:\Windows\System\bBcAkjx.exe
  C:\Windows\System\bBcAkjx.exe
  2⤵
  PID:3664
- C:\Windows\System\aaNwAVl.exe
  C:\Windows\System\aaNwAVl.exe
  2⤵
  PID:3728
- C:\Windows\System\IMAnUvn.exe
  C:\Windows\System\IMAnUvn.exe
  2⤵
  PID:3764
- C:\Windows\System\qmSqaKO.exe
  C:\Windows\System\qmSqaKO.exe
  2⤵
  PID:3864
- C:\Windows\System\tYuCuYb.exe
  C:\Windows\System\tYuCuYb.exe
  2⤵
  PID:3928
- C:\Windows\System\qijpuSr.exe
  C:\Windows\System\qijpuSr.exe
  2⤵
  PID:3996
- C:\Windows\System\orTPwiC.exe
  C:\Windows\System\orTPwiC.exe
  2⤵
  PID:2924
- C:\Windows\System\pRRiwto.exe
  C:\Windows\System\pRRiwto.exe
  2⤵
  PID:3152
- C:\Windows\System\UYCRaLx.exe
  C:\Windows\System\UYCRaLx.exe
  2⤵
  PID:3136
- C:\Windows\System\JnXDVSS.exe
  C:\Windows\System\JnXDVSS.exe
  2⤵
  PID:3396
- C:\Windows\System\CeBUxtp.exe
  C:\Windows\System\CeBUxtp.exe
  2⤵
  PID:3660
- C:\Windows\System\IeqtHDH.exe
  C:\Windows\System\IeqtHDH.exe
  2⤵
  PID:3924
- C:\Windows\System\YVaYJJV.exe
  C:\Windows\System\YVaYJJV.exe
  2⤵
  PID:4064
- C:\Windows\System\tzXUINW.exe
  C:\Windows\System\tzXUINW.exe
  2⤵
  PID:4104
- C:\Windows\System\cQgjEMI.exe
  C:\Windows\System\cQgjEMI.exe
  2⤵
  PID:4120
- C:\Windows\System\dRnhLld.exe
  C:\Windows\System\dRnhLld.exe
  2⤵
  PID:4136
- C:\Windows\System\hwuHXRs.exe
  C:\Windows\System\hwuHXRs.exe
  2⤵
  PID:4152
- C:\Windows\System\zXXmPXR.exe
  C:\Windows\System\zXXmPXR.exe
  2⤵
  PID:4168
- C:\Windows\System\hpUSxsF.exe
  C:\Windows\System\hpUSxsF.exe
  2⤵
  PID:4184
- C:\Windows\System\yInYzOv.exe
  C:\Windows\System\yInYzOv.exe
  2⤵
  PID:4200
- C:\Windows\System\ZgqgDly.exe
  C:\Windows\System\ZgqgDly.exe
  2⤵
  PID:4216
- C:\Windows\System\AJBxmrs.exe
  C:\Windows\System\AJBxmrs.exe
  2⤵
  PID:4240
- C:\Windows\System\tHompvj.exe
  C:\Windows\System\tHompvj.exe
  2⤵
  PID:4256
- C:\Windows\System\dfzmssI.exe
  C:\Windows\System\dfzmssI.exe
  2⤵
  PID:4272
- C:\Windows\System\ZIBnBHl.exe
  C:\Windows\System\ZIBnBHl.exe
  2⤵
  PID:4328
- C:\Windows\System\bUSBHEB.exe
  C:\Windows\System\bUSBHEB.exe
  2⤵
  PID:4352
- C:\Windows\System\WZWEPXc.exe
  C:\Windows\System\WZWEPXc.exe
  2⤵
  PID:4368
- C:\Windows\System\MULDufF.exe
  C:\Windows\System\MULDufF.exe
  2⤵
  PID:4384
- C:\Windows\System\fBQqSXV.exe
  C:\Windows\System\fBQqSXV.exe
  2⤵
  PID:4400
- C:\Windows\System\EuNUheW.exe
  C:\Windows\System\EuNUheW.exe
  2⤵
  PID:4416
- C:\Windows\System\bSrzlAz.exe
  C:\Windows\System\bSrzlAz.exe
  2⤵
  PID:4432
- C:\Windows\System\BUfRsXP.exe
  C:\Windows\System\BUfRsXP.exe
  2⤵
  PID:4448
- C:\Windows\System\bwvDalv.exe
  C:\Windows\System\bwvDalv.exe
  2⤵
  PID:4464
- C:\Windows\System\eHbdTBp.exe
  C:\Windows\System\eHbdTBp.exe
  2⤵
  PID:4480
- C:\Windows\System\TVbisFd.exe
  C:\Windows\System\TVbisFd.exe
  2⤵
  PID:4496
- C:\Windows\System\grabQAn.exe
  C:\Windows\System\grabQAn.exe
  2⤵
  PID:4512
- C:\Windows\System\qDSfbWv.exe
  C:\Windows\System\qDSfbWv.exe
  2⤵
  PID:4528
- C:\Windows\System\YuRZlNj.exe
  C:\Windows\System\YuRZlNj.exe
  2⤵
  PID:4544
- C:\Windows\System\EnrOCEJ.exe
  C:\Windows\System\EnrOCEJ.exe
  2⤵
  PID:4560
- C:\Windows\System\GQIQcuN.exe
  C:\Windows\System\GQIQcuN.exe
  2⤵
  PID:4576
- C:\Windows\System\syyGmLP.exe
  C:\Windows\System\syyGmLP.exe
  2⤵
  PID:4592
- C:\Windows\System\mNZGHyH.exe
  C:\Windows\System\mNZGHyH.exe
  2⤵
  PID:4608
- C:\Windows\System\dHODSNS.exe
  C:\Windows\System\dHODSNS.exe
  2⤵
  PID:4628
- C:\Windows\System\lcYAZSh.exe
  C:\Windows\System\lcYAZSh.exe
  2⤵
  PID:4644
- C:\Windows\System\VQxWeBB.exe
  C:\Windows\System\VQxWeBB.exe
  2⤵
  PID:4660
- C:\Windows\System\WjXSdet.exe
  C:\Windows\System\WjXSdet.exe
  2⤵
  PID:4680
- C:\Windows\System\KblJuPF.exe
  C:\Windows\System\KblJuPF.exe
  2⤵
  PID:4696
- C:\Windows\System\IiYgygw.exe
  C:\Windows\System\IiYgygw.exe
  2⤵
  PID:4712
- C:\Windows\System\VCBnUYL.exe
  C:\Windows\System\VCBnUYL.exe
  2⤵
  PID:4728
- C:\Windows\System\kPSKOtb.exe
  C:\Windows\System\kPSKOtb.exe
  2⤵
  PID:4744
- C:\Windows\System\ZntYDXb.exe
  C:\Windows\System\ZntYDXb.exe
  2⤵
  PID:4760
- C:\Windows\System\oBajwCs.exe
  C:\Windows\System\oBajwCs.exe
  2⤵
  PID:4776
- C:\Windows\System\zrgbMXh.exe
  C:\Windows\System\zrgbMXh.exe
  2⤵
  PID:4792
- C:\Windows\System\XzOpFzI.exe
  C:\Windows\System\XzOpFzI.exe
  2⤵
  PID:4808
- C:\Windows\System\lKMabFO.exe
  C:\Windows\System\lKMabFO.exe
  2⤵
  PID:4824
- C:\Windows\System\OzXaLAa.exe
  C:\Windows\System\OzXaLAa.exe
  2⤵
  PID:4840
- C:\Windows\System\YGrJeiS.exe
  C:\Windows\System\YGrJeiS.exe
  2⤵
  PID:4856
- C:\Windows\System\DuKmTKi.exe
  C:\Windows\System\DuKmTKi.exe
  2⤵
  PID:4872
- C:\Windows\System\ZjvuPHn.exe
  C:\Windows\System\ZjvuPHn.exe
  2⤵
  PID:4888
- C:\Windows\System\yCQEInn.exe
  C:\Windows\System\yCQEInn.exe
  2⤵
  PID:4904
- C:\Windows\System\KHmVkVI.exe
  C:\Windows\System\KHmVkVI.exe
  2⤵
  PID:4920
- C:\Windows\System\meTDhms.exe
  C:\Windows\System\meTDhms.exe
  2⤵
  PID:4936
- C:\Windows\System\AJWnOGo.exe
  C:\Windows\System\AJWnOGo.exe
  2⤵
  PID:4952
- C:\Windows\System\RKbixbe.exe
  C:\Windows\System\RKbixbe.exe
  2⤵
  PID:5004
- C:\Windows\System\EBTiAic.exe
  C:\Windows\System\EBTiAic.exe
  2⤵
  PID:5048
- C:\Windows\System\cuRmvtj.exe
  C:\Windows\System\cuRmvtj.exe
  2⤵
  PID:5068
- C:\Windows\System\NBTdrmL.exe
  C:\Windows\System\NBTdrmL.exe
  2⤵
  PID:5084
- C:\Windows\System\bJlupoh.exe
  C:\Windows\System\bJlupoh.exe
  2⤵
  PID:5100
- C:\Windows\System\fEHIyAq.exe
  C:\Windows\System\fEHIyAq.exe
  2⤵
  PID:5116
- C:\Windows\System\sOQMwOS.exe
  C:\Windows\System\sOQMwOS.exe
  2⤵
  PID:3580
- C:\Windows\System\cIljnis.exe
  C:\Windows\System\cIljnis.exe
  2⤵
  PID:4112
- C:\Windows\System\AeVeGWK.exe
  C:\Windows\System\AeVeGWK.exe
  2⤵
  PID:4176
- C:\Windows\System\XEzYiEI.exe
  C:\Windows\System\XEzYiEI.exe
  2⤵
  PID:904
- C:\Windows\System\cdFcYdX.exe
  C:\Windows\System\cdFcYdX.exe
  2⤵
  PID:4280
- C:\Windows\System\Xqghdnj.exe
  C:\Windows\System\Xqghdnj.exe
  2⤵
  PID:4300
- C:\Windows\System\gGOTIcM.exe
  C:\Windows\System\gGOTIcM.exe
  2⤵
  PID:4288
- C:\Windows\System\OynKGQp.exe
  C:\Windows\System\OynKGQp.exe
  2⤵
  PID:920
- C:\Windows\System\fzjZJXF.exe
  C:\Windows\System\fzjZJXF.exe
  2⤵
  PID:3412
- C:\Windows\System\PGiEFae.exe
  C:\Windows\System\PGiEFae.exe
  2⤵
  PID:3748
- C:\Windows\System\LLMoCld.exe
  C:\Windows\System\LLMoCld.exe
  2⤵
  PID:3680
- C:\Windows\System\dsONwgy.exe
  C:\Windows\System\dsONwgy.exe
  2⤵
  PID:4196
- C:\Windows\System\GIGfYdV.exe
  C:\Windows\System\GIGfYdV.exe
  2⤵
  PID:3172
- C:\Windows\System\PijrxCM.exe
  C:\Windows\System\PijrxCM.exe
  2⤵
  PID:4380
- C:\Windows\System\RhucWvp.exe
  C:\Windows\System\RhucWvp.exe
  2⤵
  PID:4392
- C:\Windows\System\zCBPaZC.exe
  C:\Windows\System\zCBPaZC.exe
  2⤵
  PID:4852
- C:\Windows\System\LVOFPzF.exe
  C:\Windows\System\LVOFPzF.exe
  2⤵
  PID:4916
- C:\Windows\System\QVjbBSA.exe
  C:\Windows\System\QVjbBSA.exe
  2⤵
  PID:2788
- C:\Windows\System\NriHKmr.exe
  C:\Windows\System\NriHKmr.exe
  2⤵
  PID:1084
- C:\Windows\System\cFozPmY.exe
  C:\Windows\System\cFozPmY.exe
  2⤵
  PID:3552
- C:\Windows\System\VbqkMhG.exe
  C:\Windows\System\VbqkMhG.exe
  2⤵
  PID:4476
- C:\Windows\System\dVkjCqg.exe
  C:\Windows\System\dVkjCqg.exe
  2⤵
  PID:4836
- C:\Windows\System\PUcCNQa.exe
  C:\Windows\System\PUcCNQa.exe
  2⤵
  PID:4412
- C:\Windows\System\AKVWmcL.exe
  C:\Windows\System\AKVWmcL.exe
  2⤵
  PID:4440
- C:\Windows\System\nNPtEwu.exe
  C:\Windows\System\nNPtEwu.exe
  2⤵
  PID:4508
- C:\Windows\System\PSVXONb.exe
  C:\Windows\System\PSVXONb.exe
  2⤵
  PID:4572
- C:\Windows\System\lKYOUdW.exe
  C:\Windows\System\lKYOUdW.exe
  2⤵
  PID:4640
- C:\Windows\System\giiAyaX.exe
  C:\Windows\System\giiAyaX.exe
  2⤵
  PID:4704
- C:\Windows\System\wIHvOfI.exe
  C:\Windows\System\wIHvOfI.exe
  2⤵
  PID:4772
- C:\Windows\System\KSgUPqt.exe
  C:\Windows\System\KSgUPqt.exe
  2⤵
  PID:4132
- C:\Windows\System\LpoxVuF.exe
  C:\Windows\System\LpoxVuF.exe
  2⤵
  PID:3896
- C:\Windows\System\jXmkPUS.exe
  C:\Windows\System\jXmkPUS.exe
  2⤵
  PID:4100
- C:\Windows\System\qYQszkM.exe
  C:\Windows\System\qYQszkM.exe
  2⤵
  PID:4980
- C:\Windows\System\fCNWqpX.exe
  C:\Windows\System\fCNWqpX.exe
  2⤵
  PID:4984
- C:\Windows\System\quIYjKM.exe
  C:\Windows\System\quIYjKM.exe
  2⤵
  PID:5016
- C:\Windows\System\FChmAdQ.exe
  C:\Windows\System\FChmAdQ.exe
  2⤵
  PID:4032
- C:\Windows\System\TTpUUrv.exe
  C:\Windows\System\TTpUUrv.exe
  2⤵
  PID:5080
- C:\Windows\System\wOKhAiW.exe
  C:\Windows\System\wOKhAiW.exe
  2⤵
  PID:2220
- C:\Windows\System\pikiIhb.exe
  C:\Windows\System\pikiIhb.exe
  2⤵
  PID:3448
- C:\Windows\System\ELPOMQb.exe
  C:\Windows\System\ELPOMQb.exe
  2⤵
  PID:4308
- C:\Windows\System\WjmuUtM.exe
  C:\Windows\System\WjmuUtM.exe
  2⤵
  PID:5096
- C:\Windows\System\mxIsmpK.exe
  C:\Windows\System\mxIsmpK.exe
  2⤵
  PID:4080
- C:\Windows\System\UDsONKQ.exe
  C:\Windows\System\UDsONKQ.exe
  2⤵
  PID:3548
- C:\Windows\System\JLFJuZu.exe
  C:\Windows\System\JLFJuZu.exe
  2⤵
  PID:5092
- C:\Windows\System\LOJPMVv.exe
  C:\Windows\System\LOJPMVv.exe
  2⤵
  PID:4016
- C:\Windows\System\vdTASNa.exe
  C:\Windows\System\vdTASNa.exe
  2⤵
  PID:3860
- C:\Windows\System\deAWuHJ.exe
  C:\Windows\System\deAWuHJ.exe
  2⤵
  PID:3248
- C:\Windows\System\guCIXcl.exe
  C:\Windows\System\guCIXcl.exe
  2⤵
  PID:2156
- C:\Windows\System\PGcGzHT.exe
  C:\Windows\System\PGcGzHT.exe
  2⤵
  PID:2960
- C:\Windows\System\kdrbALw.exe
  C:\Windows\System\kdrbALw.exe
  2⤵
  PID:1760
- C:\Windows\System\nZffqtH.exe
  C:\Windows\System\nZffqtH.exe
  2⤵
  PID:1848
- C:\Windows\System\cCUYTxc.exe
  C:\Windows\System\cCUYTxc.exe
  2⤵
  PID:3596
- C:\Windows\System\nMMLaoy.exe
  C:\Windows\System\nMMLaoy.exe
  2⤵
  PID:4344
- C:\Windows\System\JubVcpR.exe
  C:\Windows\System\JubVcpR.exe
  2⤵
  PID:3200
- C:\Windows\System\lbencHd.exe
  C:\Windows\System\lbencHd.exe
  2⤵
  PID:4524
- C:\Windows\System\PyYRmVM.exe
  C:\Windows\System\PyYRmVM.exe
  2⤵
  PID:4624
- C:\Windows\System\riZfApU.exe
  C:\Windows\System\riZfApU.exe
  2⤵
  PID:4724
- C:\Windows\System\uZmKark.exe
  C:\Windows\System\uZmKark.exe
  2⤵
  PID:2024
- C:\Windows\System\wNTSVeZ.exe
  C:\Windows\System\wNTSVeZ.exe
  2⤵
  PID:4948
- C:\Windows\System\JIavoRB.exe
  C:\Windows\System\JIavoRB.exe
  2⤵
  PID:3844
- C:\Windows\System\uNSAqVv.exe
  C:\Windows\System\uNSAqVv.exe
  2⤵
  PID:4504
- C:\Windows\System\KqLqhFz.exe
  C:\Windows\System\KqLqhFz.exe
  2⤵
  PID:4636
- C:\Windows\System\zThudKT.exe
  C:\Windows\System\zThudKT.exe
  2⤵
  PID:4672
- C:\Windows\System\iMSMenx.exe
  C:\Windows\System\iMSMenx.exe
  2⤵
  PID:3960
- C:\Windows\System\LKgYcsE.exe
  C:\Windows\System\LKgYcsE.exe
  2⤵
  PID:4964
- C:\Windows\System\DJjzUyT.exe
  C:\Windows\System\DJjzUyT.exe
  2⤵
  PID:3104
- C:\Windows\System\luKPzyf.exe
  C:\Windows\System\luKPzyf.exe
  2⤵
  PID:4900
- C:\Windows\System\ZQAGHTY.exe
  C:\Windows\System\ZQAGHTY.exe
  2⤵
  PID:5000
- C:\Windows\System\qOzAfOi.exe
  C:\Windows\System\qOzAfOi.exe
  2⤵
  PID:3368
- C:\Windows\System\SLlAUzM.exe
  C:\Windows\System\SLlAUzM.exe
  2⤵
  PID:5036
- C:\Windows\System\gkeJbOI.exe
  C:\Windows\System\gkeJbOI.exe
  2⤵
  PID:2652
- C:\Windows\System\KTOOBzG.exe
  C:\Windows\System\KTOOBzG.exe
  2⤵
  PID:3632
- C:\Windows\System\rkdYsXF.exe
  C:\Windows\System\rkdYsXF.exe
  2⤵
  PID:2672
- C:\Windows\System\sbQRQsW.exe
  C:\Windows\System\sbQRQsW.exe
  2⤵
  PID:3016
- C:\Windows\System\SYfdFox.exe
  C:\Windows\System\SYfdFox.exe
  2⤵
  PID:5056
- C:\Windows\System\NDmnyEz.exe
  C:\Windows\System\NDmnyEz.exe
  2⤵
  PID:3252
- C:\Windows\System\gtZMLry.exe
  C:\Windows\System\gtZMLry.exe
  2⤵
  PID:292
- C:\Windows\System\PRPqIiL.exe
  C:\Windows\System\PRPqIiL.exe
  2⤵
  PID:3348
- C:\Windows\System\HGmEqwd.exe
  C:\Windows\System\HGmEqwd.exe
  2⤵
  PID:4012
- C:\Windows\System\vCrjUUm.exe
  C:\Windows\System\vCrjUUm.exe
  2⤵
  PID:3044
- C:\Windows\System\oVpSrau.exe
  C:\Windows\System\oVpSrau.exe
  2⤵
  PID:4164
- C:\Windows\System\VZSTbmK.exe
  C:\Windows\System\VZSTbmK.exe
  2⤵
  PID:4264
- C:\Windows\System\rIEmfai.exe
  C:\Windows\System\rIEmfai.exe
  2⤵
  PID:3724
- C:\Windows\System\JxbzSaC.exe
  C:\Windows\System\JxbzSaC.exe
  2⤵
  PID:808
- C:\Windows\System\fJiKSXe.exe
  C:\Windows\System\fJiKSXe.exe
  2⤵
  PID:4428
- C:\Windows\System\FKYjlTI.exe
  C:\Windows\System\FKYjlTI.exe
  2⤵
  PID:4456
- C:\Windows\System\qjRhpOh.exe
  C:\Windows\System\qjRhpOh.exe
  2⤵
  PID:2464
- C:\Windows\System\tfArSvt.exe
  C:\Windows\System\tfArSvt.exe
  2⤵
  PID:1008
- C:\Windows\System\itcFywC.exe
  C:\Windows\System\itcFywC.exe
  2⤵
  PID:4688
- C:\Windows\System\OxerxXO.exe
  C:\Windows\System\OxerxXO.exe
  2⤵
  PID:2700
- C:\Windows\System\KlIRIVh.exe
  C:\Windows\System\KlIRIVh.exe
  2⤵
  PID:4912
- C:\Windows\System\YCBNnUx.exe
  C:\Windows\System\YCBNnUx.exe
  2⤵
  PID:2392
- C:\Windows\System\tgUAyWV.exe
  C:\Windows\System\tgUAyWV.exe
  2⤵
  PID:5028
- C:\Windows\System\avYXtit.exe
  C:\Windows\System\avYXtit.exe
  2⤵
  PID:4832
- C:\Windows\System\cKtPgVO.exe
  C:\Windows\System\cKtPgVO.exe
  2⤵
  PID:552
- C:\Windows\System\kXYnGYF.exe
  C:\Windows\System\kXYnGYF.exe
  2⤵
  PID:4928
- C:\Windows\System\OWQFVxk.exe
  C:\Windows\System\OWQFVxk.exe
  2⤵
  PID:5024
- C:\Windows\System\qMPBzws.exe
  C:\Windows\System\qMPBzws.exe
  2⤵
  PID:4896
- C:\Windows\System\PSbiRVv.exe
  C:\Windows\System\PSbiRVv.exe
  2⤵
  PID:5040
- C:\Windows\System\xdUGsYA.exe
  C:\Windows\System\xdUGsYA.exe
  2⤵
  PID:5112
- C:\Windows\System\KLNjaHO.exe
  C:\Windows\System\KLNjaHO.exe
  2⤵
  PID:4060
- C:\Windows\System\PZEBkOK.exe
  C:\Windows\System\PZEBkOK.exe
  2⤵
  PID:848
- C:\Windows\System\hGNYTNz.exe
  C:\Windows\System\hGNYTNz.exe
  2⤵
  PID:3452
- C:\Windows\System\FrQuFBV.exe
  C:\Windows\System\FrQuFBV.exe
  2⤵
  PID:300
- C:\Windows\System\ogEMnqD.exe
  C:\Windows\System\ogEMnqD.exe
  2⤵
  PID:2284
- C:\Windows\System\hdwKjHq.exe
  C:\Windows\System\hdwKjHq.exe
  2⤵
  PID:2552
- C:\Windows\System\BRyxzSw.exe
  C:\Windows\System\BRyxzSw.exe
  2⤵
  PID:2824
- C:\Windows\System\IjRzsHA.exe
  C:\Windows\System\IjRzsHA.exe
  2⤵
  PID:1792
- C:\Windows\System\ogQLMOC.exe
  C:\Windows\System\ogQLMOC.exe
  2⤵
  PID:2912
- C:\Windows\System\RQDqtbO.exe
  C:\Windows\System\RQDqtbO.exe
  2⤵
  PID:1668
- C:\Windows\System\FptXENA.exe
  C:\Windows\System\FptXENA.exe
  2⤵
  PID:4424
- C:\Windows\System\ONHAxIx.exe
  C:\Windows\System\ONHAxIx.exe
  2⤵
  PID:812
- C:\Windows\System\NUwUVtW.exe
  C:\Windows\System\NUwUVtW.exe
  2⤵
  PID:4588
- C:\Windows\System\RzSMaJw.exe
  C:\Windows\System\RzSMaJw.exe
  2⤵
  PID:4692
- C:\Windows\System\ylFXMlF.exe
  C:\Windows\System\ylFXMlF.exe
  2⤵
  PID:4784
- C:\Windows\System\zShSBhQ.exe
  C:\Windows\System\zShSBhQ.exe
  2⤵
  PID:4604
- C:\Windows\System\KBePuWh.exe
  C:\Windows\System\KBePuWh.exe
  2⤵
  PID:4736
- C:\Windows\System\plMiBJr.exe
  C:\Windows\System\plMiBJr.exe
  2⤵
  PID:5060
- C:\Windows\System\LXfeQrp.exe
  C:\Windows\System\LXfeQrp.exe
  2⤵
  PID:3912
- C:\Windows\System\xuUYDTZ.exe
  C:\Windows\System\xuUYDTZ.exe
  2⤵
  PID:800
- C:\Windows\System\pCFWOiU.exe
  C:\Windows\System\pCFWOiU.exe
  2⤵
  PID:3380
- C:\Windows\System\zImUHpq.exe
  C:\Windows\System\zImUHpq.exe
  2⤵
  PID:780
- C:\Windows\System\IsiksYs.exe
  C:\Windows\System\IsiksYs.exe
  2⤵
  PID:2216
- C:\Windows\System\RmVLCNg.exe
  C:\Windows\System\RmVLCNg.exe
  2⤵
  PID:1736
- C:\Windows\System\umKVnmd.exe
  C:\Windows\System\umKVnmd.exe
  2⤵
  PID:1748
- C:\Windows\System\dbuonWM.exe
  C:\Windows\System\dbuonWM.exe
  2⤵
  PID:2196
- C:\Windows\System\qLIWaei.exe
  C:\Windows\System\qLIWaei.exe
  2⤵
  PID:4340
- C:\Windows\System\CpbaQgQ.exe
  C:\Windows\System\CpbaQgQ.exe
  2⤵
  PID:3020
- C:\Windows\System\AzZlDYf.exe
  C:\Windows\System\AzZlDYf.exe
  2⤵
  PID:2948
- C:\Windows\System\NYBChft.exe
  C:\Windows\System\NYBChft.exe
  2⤵
  PID:2356
- C:\Windows\System\uMKOPck.exe
  C:\Windows\System\uMKOPck.exe
  2⤵
  PID:1780
- C:\Windows\System\yiNYCWb.exe
  C:\Windows\System\yiNYCWb.exe
  2⤵
  PID:2936
- C:\Windows\System\nxBUTvr.exe
  C:\Windows\System\nxBUTvr.exe
  2⤵
  PID:4932
- C:\Windows\System\qMUUOyL.exe
  C:\Windows\System\qMUUOyL.exe
  2⤵
  PID:5076
- C:\Windows\System\XSjPLYF.exe
  C:\Windows\System\XSjPLYF.exe
  2⤵
  PID:2372
- C:\Windows\System\sZTXUkm.exe
  C:\Windows\System\sZTXUkm.exe
  2⤵
  PID:3284
- C:\Windows\System\PRepKyg.exe
  C:\Windows\System\PRepKyg.exe
  2⤵
  PID:2432
- C:\Windows\System\tKZxfjV.exe
  C:\Windows\System\tKZxfjV.exe
  2⤵
  PID:4488
- C:\Windows\System\urJPGdt.exe
  C:\Windows\System\urJPGdt.exe
  2⤵
  PID:2468
- C:\Windows\System\QAuxRgy.exe
  C:\Windows\System\QAuxRgy.exe
  2⤵
  PID:3544
- C:\Windows\System\tgVorGi.exe
  C:\Windows\System\tgVorGi.exe
  2⤵
  PID:2764
- C:\Windows\System\gfujaRK.exe
  C:\Windows\System\gfujaRK.exe
  2⤵
  PID:4520
- C:\Windows\System\lttIACj.exe
  C:\Windows\System\lttIACj.exe
  2⤵
  PID:1644
- C:\Windows\System\rtDJSBa.exe
  C:\Windows\System\rtDJSBa.exe
  2⤵
  PID:3792
- C:\Windows\System\ajaWWTX.exe
  C:\Windows\System\ajaWWTX.exe
  2⤵
  PID:380
- C:\Windows\System\ioxcabf.exe
  C:\Windows\System\ioxcabf.exe
  2⤵
  PID:1320
- C:\Windows\System\uWniWJi.exe
  C:\Windows\System\uWniWJi.exe
  2⤵
  PID:2888
- C:\Windows\System\OcnvTit.exe
  C:\Windows\System\OcnvTit.exe
  2⤵
  PID:1788
- C:\Windows\System\cBfgsdT.exe
  C:\Windows\System\cBfgsdT.exe
  2⤵
  PID:2252
- C:\Windows\System\KEnBHXk.exe
  C:\Windows\System\KEnBHXk.exe
  2⤵
  PID:4296
- C:\Windows\System\gsfcmRq.exe
  C:\Windows\System\gsfcmRq.exe
  2⤵
  PID:1732
- C:\Windows\System\nBpmkVA.exe
  C:\Windows\System\nBpmkVA.exe
  2⤵
  PID:2088
- C:\Windows\System\bNsifrn.exe
  C:\Windows\System\bNsifrn.exe
  2⤵
  PID:2304
- C:\Windows\System\VbAPZln.exe
  C:\Windows\System\VbAPZln.exe
  2⤵
  PID:1596
- C:\Windows\System\BxOamBE.exe
  C:\Windows\System\BxOamBE.exe
  2⤵
  PID:2240
- C:\Windows\System\IRstqei.exe
  C:\Windows\System\IRstqei.exe
  2⤵
  PID:2600
- C:\Windows\System\RfMWTBk.exe
  C:\Windows\System\RfMWTBk.exe
  2⤵
  PID:5136
- C:\Windows\System\rJBcWAS.exe
  C:\Windows\System\rJBcWAS.exe
  2⤵
  PID:5152
- C:\Windows\System\RartEUY.exe
  C:\Windows\System\RartEUY.exe
  2⤵
  PID:5168
- C:\Windows\System\LYsncng.exe
  C:\Windows\System\LYsncng.exe
  2⤵
  PID:5184
- C:\Windows\System\jyvQONZ.exe
  C:\Windows\System\jyvQONZ.exe
  2⤵
  PID:5200
- C:\Windows\System\XVNMqXa.exe
  C:\Windows\System\XVNMqXa.exe
  2⤵
  PID:5216
- C:\Windows\System\CxQiXLm.exe
  C:\Windows\System\CxQiXLm.exe
  2⤵
  PID:5232
- C:\Windows\System\HnTGlnm.exe
  C:\Windows\System\HnTGlnm.exe
  2⤵
  PID:5248
- C:\Windows\System\xBFMBZm.exe
  C:\Windows\System\xBFMBZm.exe
  2⤵
  PID:5264
- C:\Windows\System\cRYmIYe.exe
  C:\Windows\System\cRYmIYe.exe
  2⤵
  PID:5280
- C:\Windows\System\TVtVkea.exe
  C:\Windows\System\TVtVkea.exe
  2⤵
  PID:5296
- C:\Windows\System\zfSNGyI.exe
  C:\Windows\System\zfSNGyI.exe
  2⤵
  PID:5312
- C:\Windows\System\TGgEdXe.exe
  C:\Windows\System\TGgEdXe.exe
  2⤵
  PID:5328
- C:\Windows\System\EXAYFvb.exe
  C:\Windows\System\EXAYFvb.exe
  2⤵
  PID:5344
- C:\Windows\System\cIjilJk.exe
  C:\Windows\System\cIjilJk.exe
  2⤵
  PID:5360
- C:\Windows\System\TyVEkiY.exe
  C:\Windows\System\TyVEkiY.exe
  2⤵
  PID:5376
- C:\Windows\System\pQAPArz.exe
  C:\Windows\System\pQAPArz.exe
  2⤵
  PID:5392
- C:\Windows\System\YPFNDDV.exe
  C:\Windows\System\YPFNDDV.exe
  2⤵
  PID:5408
- C:\Windows\System\TkzhUAF.exe
  C:\Windows\System\TkzhUAF.exe
  2⤵
  PID:5424
- C:\Windows\System\tayAmuV.exe
  C:\Windows\System\tayAmuV.exe
  2⤵
  PID:5440
- C:\Windows\System\LQqYFNh.exe
  C:\Windows\System\LQqYFNh.exe
  2⤵
  PID:5456
- C:\Windows\System\VHxQiIa.exe
  C:\Windows\System\VHxQiIa.exe
  2⤵
  PID:5472
- C:\Windows\System\lJawljO.exe
  C:\Windows\System\lJawljO.exe
  2⤵
  PID:5488
- C:\Windows\System\WsTbcBb.exe
  C:\Windows\System\WsTbcBb.exe
  2⤵
  PID:5504
- C:\Windows\System\EYwOQkS.exe
  C:\Windows\System\EYwOQkS.exe
  2⤵
  PID:5520
- C:\Windows\System\HxolkgR.exe
  C:\Windows\System\HxolkgR.exe
  2⤵
  PID:5540
- C:\Windows\System\oBkEOUH.exe
  C:\Windows\System\oBkEOUH.exe
  2⤵
  PID:5556
- C:\Windows\System\EyWHjUJ.exe
  C:\Windows\System\EyWHjUJ.exe
  2⤵
  PID:5572
- C:\Windows\System\gTDCqCR.exe
  C:\Windows\System\gTDCqCR.exe
  2⤵
  PID:5588
- C:\Windows\System\vxyOFDa.exe
  C:\Windows\System\vxyOFDa.exe
  2⤵
  PID:5608
- C:\Windows\System\xoTDSkP.exe
  C:\Windows\System\xoTDSkP.exe
  2⤵
  PID:5624
- C:\Windows\System\sasHZGd.exe
  C:\Windows\System\sasHZGd.exe
  2⤵
  PID:5640
- C:\Windows\System\BqzqcXy.exe
  C:\Windows\System\BqzqcXy.exe
  2⤵
  PID:5656
- C:\Windows\System\kCuHLiI.exe
  C:\Windows\System\kCuHLiI.exe
  2⤵
  PID:5672
- C:\Windows\System\xKUCFBQ.exe
  C:\Windows\System\xKUCFBQ.exe
  2⤵
  PID:5688
- C:\Windows\System\ESbBqQs.exe
  C:\Windows\System\ESbBqQs.exe
  2⤵
  PID:5704
- C:\Windows\System\xVFFqXj.exe
  C:\Windows\System\xVFFqXj.exe
  2⤵
  PID:5724
- C:\Windows\System\KuLhYcc.exe
  C:\Windows\System\KuLhYcc.exe
  2⤵
  PID:5740
- C:\Windows\System\hWESyZi.exe
  C:\Windows\System\hWESyZi.exe
  2⤵
  PID:5756
- C:\Windows\System\HLmthJo.exe
  C:\Windows\System\HLmthJo.exe
  2⤵
  PID:5772
- C:\Windows\System\HLwMJFm.exe
  C:\Windows\System\HLwMJFm.exe
  2⤵
  PID:5788
- C:\Windows\System\DihGHkt.exe
  C:\Windows\System\DihGHkt.exe
  2⤵
  PID:5804
- C:\Windows\System\BGHkgLZ.exe
  C:\Windows\System\BGHkgLZ.exe
  2⤵
  PID:5820
- C:\Windows\System\OMvrmvH.exe
  C:\Windows\System\OMvrmvH.exe
  2⤵
  PID:5836
- C:\Windows\System\UndLsoj.exe
  C:\Windows\System\UndLsoj.exe
  2⤵
  PID:5864
- C:\Windows\System\JMrUsfp.exe
  C:\Windows\System\JMrUsfp.exe
  2⤵
  PID:5880
- C:\Windows\System\zeYzfVd.exe
  C:\Windows\System\zeYzfVd.exe
  2⤵
  PID:5900
- C:\Windows\System\WAiChRz.exe
  C:\Windows\System\WAiChRz.exe
  2⤵
  PID:5916
- C:\Windows\System\xhYAsOs.exe
  C:\Windows\System\xhYAsOs.exe
  2⤵
  PID:5932
- C:\Windows\System\WbIZDyO.exe
  C:\Windows\System\WbIZDyO.exe
  2⤵
  PID:5948
- C:\Windows\System\dWlrqZf.exe
  C:\Windows\System\dWlrqZf.exe
  2⤵
  PID:5964
- C:\Windows\System\lahlGpm.exe
  C:\Windows\System\lahlGpm.exe
  2⤵
  PID:5980
- C:\Windows\System\sUdyADo.exe
  C:\Windows\System\sUdyADo.exe
  2⤵
  PID:5996
- C:\Windows\System\yBYPyBT.exe
  C:\Windows\System\yBYPyBT.exe
  2⤵
  PID:6012
- C:\Windows\System\ucdoxLF.exe
  C:\Windows\System\ucdoxLF.exe
  2⤵
  PID:6028
- C:\Windows\System\SdSWAym.exe
  C:\Windows\System\SdSWAym.exe
  2⤵
  PID:6048
- C:\Windows\System\sQfiwIz.exe
  C:\Windows\System\sQfiwIz.exe
  2⤵
  PID:6064
- C:\Windows\System\AurdYJI.exe
  C:\Windows\System\AurdYJI.exe
  2⤵
  PID:6080
- C:\Windows\System\RnQudkZ.exe
  C:\Windows\System\RnQudkZ.exe
  2⤵
  PID:6096
- C:\Windows\System\HsoTipW.exe
  C:\Windows\System\HsoTipW.exe
  2⤵
  PID:6112
- C:\Windows\System\BmVtgED.exe
  C:\Windows\System\BmVtgED.exe
  2⤵
  PID:6132
- C:\Windows\System\aUObGgj.exe
  C:\Windows\System\aUObGgj.exe
  2⤵
  PID:2028
- C:\Windows\System\wxacgqb.exe
  C:\Windows\System\wxacgqb.exe
  2⤵
  PID:5132
- C:\Windows\System\jKzdFxM.exe
  C:\Windows\System\jKzdFxM.exe
  2⤵
  PID:5196
- C:\Windows\System\gYRmyIx.exe
  C:\Windows\System\gYRmyIx.exe
  2⤵
  PID:2784
- C:\Windows\System\tANKOJy.exe
  C:\Windows\System\tANKOJy.exe
  2⤵
  PID:5292
- C:\Windows\System\JsYatop.exe
  C:\Windows\System\JsYatop.exe
  2⤵
  PID:5356
- C:\Windows\System\jaztekr.exe
  C:\Windows\System\jaztekr.exe
  2⤵
  PID:5484
- C:\Windows\System\SNssazL.exe
  C:\Windows\System\SNssazL.exe
  2⤵
  PID:4348
- C:\Windows\System\UAvblWn.exe
  C:\Windows\System\UAvblWn.exe
  2⤵
  PID:5512
- C:\Windows\System\habLgvu.exe
  C:\Windows\System\habLgvu.exe
  2⤵
  PID:5148
- C:\Windows\System\tzvJffa.exe
  C:\Windows\System\tzvJffa.exe
  2⤵
  PID:5620
- C:\Windows\System\aPBKtTs.exe
  C:\Windows\System\aPBKtTs.exe
  2⤵
  PID:5684
- C:\Windows\System\hpatPVe.exe
  C:\Windows\System\hpatPVe.exe
  2⤵
  PID:5600
- C:\Windows\System\lStOmva.exe
  C:\Windows\System\lStOmva.exe
  2⤵
  PID:5276
- C:\Windows\System\JYWNpVS.exe
  C:\Windows\System\JYWNpVS.exe
  2⤵
  PID:5340
- C:\Windows\System\Dclxiqu.exe
  C:\Windows\System\Dclxiqu.exe
  2⤵
  PID:5400
- C:\Windows\System\FcgtAfD.exe
  C:\Windows\System\FcgtAfD.exe
  2⤵
  PID:5568
- C:\Windows\System\sHtxxKB.exe
  C:\Windows\System\sHtxxKB.exe
  2⤵
  PID:5436
- C:\Windows\System\YPZBZhi.exe
  C:\Windows\System\YPZBZhi.exe
  2⤵
  PID:5496
- C:\Windows\System\lrvvuxy.exe
  C:\Windows\System\lrvvuxy.exe
  2⤵
  PID:5564
- C:\Windows\System\ZbtqgCZ.exe
  C:\Windows\System\ZbtqgCZ.exe
  2⤵
  PID:5664
- C:\Windows\System\JhRWWDo.exe
  C:\Windows\System\JhRWWDo.exe
  2⤵
  PID:5736
- C:\Windows\System\iKXbaDF.exe
  C:\Windows\System\iKXbaDF.exe
  2⤵
  PID:5796
- C:\Windows\System\mkydhQQ.exe
  C:\Windows\System\mkydhQQ.exe
  2⤵
  PID:5812
- C:\Windows\System\heQDqAu.exe
  C:\Windows\System\heQDqAu.exe
  2⤵
  PID:5832
- C:\Windows\System\WVcLSMI.exe
  C:\Windows\System\WVcLSMI.exe
  2⤵
  PID:5856
- C:\Windows\System\zNYMQyH.exe
  C:\Windows\System\zNYMQyH.exe
  2⤵
  PID:5912
- C:\Windows\System\KyfWuzg.exe
  C:\Windows\System\KyfWuzg.exe
  2⤵
  PID:5924
- C:\Windows\System\eSipfmQ.exe
  C:\Windows\System\eSipfmQ.exe
  2⤵
  PID:5956
- C:\Windows\System\RumONdr.exe
  C:\Windows\System\RumONdr.exe
  2⤵
  PID:5992
- C:\Windows\System\EDepOou.exe
  C:\Windows\System\EDepOou.exe
  2⤵
  PID:6004
- C:\Windows\System\JQArKlB.exe
  C:\Windows\System\JQArKlB.exe
  2⤵
  PID:6044
- C:\Windows\System\mJGvVaQ.exe
  C:\Windows\System\mJGvVaQ.exe
  2⤵
  PID:6024
- C:\Windows\System\TweUnbv.exe
  C:\Windows\System\TweUnbv.exe
  2⤵
  PID:6056
- C:\Windows\System\fZDHtzJ.exe
  C:\Windows\System\fZDHtzJ.exe
  2⤵
  PID:6124
- C:\Windows\System\YhjPHxY.exe
  C:\Windows\System\YhjPHxY.exe
  2⤵
  PID:5192
- C:\Windows\System\JBdtzIw.exe
  C:\Windows\System\JBdtzIw.exe
  2⤵
  PID:5228
- C:\Windows\System\jAoxsdb.exe
  C:\Windows\System\jAoxsdb.exe
  2⤵
  PID:4492
- C:\Windows\System\iwMuHXT.exe
  C:\Windows\System\iwMuHXT.exe
  2⤵
  PID:1248
- C:\Windows\System\ojPirJe.exe
  C:\Windows\System\ojPirJe.exe
  2⤵
  PID:2648
- C:\Windows\System\KadLUWa.exe
  C:\Windows\System\KadLUWa.exe
  2⤵
  PID:5448
- C:\Windows\System\hRsgYhr.exe
  C:\Windows\System\hRsgYhr.exe
  2⤵
  PID:5548
- C:\Windows\System\KSMSZlX.exe
  C:\Windows\System\KSMSZlX.exe
  2⤵
  PID:5244
- C:\Windows\System\SsKzQPA.exe
  C:\Windows\System\SsKzQPA.exe
  2⤵
  PID:5716
- C:\Windows\System\uVMejRn.exe
  C:\Windows\System\uVMejRn.exe
  2⤵
  PID:5336
- C:\Windows\System\vQIQPbq.exe
  C:\Windows\System\vQIQPbq.exe
  2⤵
  PID:5668
- C:\Windows\System\BHwPPuH.exe
  C:\Windows\System\BHwPPuH.exe
  2⤵
  PID:1884
- C:\Windows\System\rCuDVEz.exe
  C:\Windows\System\rCuDVEz.exe
  2⤵
  PID:5944
- C:\Windows\System\EMpjafg.exe
  C:\Windows\System\EMpjafg.exe
  2⤵
  PID:5764
- C:\Windows\System\eJitHMu.exe
  C:\Windows\System\eJitHMu.exe
  2⤵
  PID:5844
- C:\Windows\System\zaWKPye.exe
  C:\Windows\System\zaWKPye.exe
  2⤵
  PID:5972
- C:\Windows\System\JKQnuaE.exe
  C:\Windows\System\JKQnuaE.exe
  2⤵
  PID:6036
- C:\Windows\System\Vbbkgyx.exe
  C:\Windows\System\Vbbkgyx.exe
  2⤵
  PID:2944
- C:\Windows\System\ILlqqlp.exe
  C:\Windows\System\ILlqqlp.exe
  2⤵
  PID:4620
- C:\Windows\System\wnlSyHj.exe
  C:\Windows\System\wnlSyHj.exe
  2⤵
  PID:3964
- C:\Windows\System\RDKVFxd.exe
  C:\Windows\System\RDKVFxd.exe
  2⤵
  PID:5432
- C:\Windows\System\JFwzrPg.exe
  C:\Windows\System\JFwzrPg.exe
  2⤵
  PID:6060
- C:\Windows\System\PXcATbl.exe
  C:\Windows\System\PXcATbl.exe
  2⤵
  PID:5212
- C:\Windows\System\JlelTku.exe
  C:\Windows\System\JlelTku.exe
  2⤵
  PID:5852
- C:\Windows\System\nFHDljh.exe
  C:\Windows\System\nFHDljh.exe
  2⤵
  PID:5164
- C:\Windows\System\UxeiEaw.exe
  C:\Windows\System\UxeiEaw.exe
  2⤵
  PID:5632
- C:\Windows\System\ZqabIAi.exe
  C:\Windows\System\ZqabIAi.exe
  2⤵
  PID:5652
- C:\Windows\System\QkVxLYV.exe
  C:\Windows\System\QkVxLYV.exe
  2⤵
  PID:5352
- C:\Windows\System\gMkRnoX.exe
  C:\Windows\System\gMkRnoX.exe
  2⤵
  PID:2268
- C:\Windows\System\bbAWYvU.exe
  C:\Windows\System\bbAWYvU.exe
  2⤵
  PID:5720
- C:\Windows\System\BqQUFfi.exe
  C:\Windows\System\BqQUFfi.exe
  2⤵
  PID:6088
- C:\Windows\System\kevVSdA.exe
  C:\Windows\System\kevVSdA.exe
  2⤵
  PID:5176
- C:\Windows\System\OQObVxF.exe
  C:\Windows\System\OQObVxF.exe
  2⤵
  PID:5768
- C:\Windows\System\tTrCGhT.exe
  C:\Windows\System\tTrCGhT.exe
  2⤵
  PID:5616
- C:\Windows\System\phqPrtr.exe
  C:\Windows\System\phqPrtr.exe
  2⤵
  PID:5580
- C:\Windows\System\QofpaMz.exe
  C:\Windows\System\QofpaMz.exe
  2⤵
  PID:6148
- C:\Windows\System\BCniBMk.exe
  C:\Windows\System\BCniBMk.exe
  2⤵
  PID:6164
- C:\Windows\System\cBVxZyW.exe
  C:\Windows\System\cBVxZyW.exe
  2⤵
  PID:6184
- C:\Windows\System\FvYCQay.exe
  C:\Windows\System\FvYCQay.exe
  2⤵
  PID:6200
- C:\Windows\System\GBuICso.exe
  C:\Windows\System\GBuICso.exe
  2⤵
  PID:6216
- C:\Windows\System\bvKTKCp.exe
  C:\Windows\System\bvKTKCp.exe
  2⤵
  PID:6232
- C:\Windows\System\oufmhdz.exe
  C:\Windows\System\oufmhdz.exe
  2⤵
  PID:6248
- C:\Windows\System\qKurkdJ.exe
  C:\Windows\System\qKurkdJ.exe
  2⤵
  PID:6264
- C:\Windows\System\JmdacyV.exe
  C:\Windows\System\JmdacyV.exe
  2⤵
  PID:6280
- C:\Windows\System\cTZvLwF.exe
  C:\Windows\System\cTZvLwF.exe
  2⤵
  PID:6296
- C:\Windows\System\eAQqgzN.exe
  C:\Windows\System\eAQqgzN.exe
  2⤵
  PID:6312
- C:\Windows\System\xnOexGR.exe
  C:\Windows\System\xnOexGR.exe
  2⤵
  PID:6328
- C:\Windows\System\deBOjtG.exe
  C:\Windows\System\deBOjtG.exe
  2⤵
  PID:6344
- C:\Windows\System\ktnKUsz.exe
  C:\Windows\System\ktnKUsz.exe
  2⤵
  PID:6360
- C:\Windows\System\DvMoMvQ.exe
  C:\Windows\System\DvMoMvQ.exe
  2⤵
  PID:6376
- C:\Windows\System\aUenAjZ.exe
  C:\Windows\System\aUenAjZ.exe
  2⤵
  PID:6392
- C:\Windows\System\HgWLCHu.exe
  C:\Windows\System\HgWLCHu.exe
  2⤵
  PID:6408
- C:\Windows\System\bRlVcyb.exe
  C:\Windows\System\bRlVcyb.exe
  2⤵
  PID:6424
- C:\Windows\System\IvQzggs.exe
  C:\Windows\System\IvQzggs.exe
  2⤵
  PID:6440
- C:\Windows\System\HvpzKoR.exe
  C:\Windows\System\HvpzKoR.exe
  2⤵
  PID:6456
- C:\Windows\System\UoStxQi.exe
  C:\Windows\System\UoStxQi.exe
  2⤵
  PID:6472
- C:\Windows\System\zfBlSbh.exe
  C:\Windows\System\zfBlSbh.exe
  2⤵
  PID:6488
- C:\Windows\System\mPdfEWa.exe
  C:\Windows\System\mPdfEWa.exe
  2⤵
  PID:6504
- C:\Windows\System\BSkvmjx.exe
  C:\Windows\System\BSkvmjx.exe
  2⤵
  PID:6520
- C:\Windows\System\ZFkYJOb.exe
  C:\Windows\System\ZFkYJOb.exe
  2⤵
  PID:6540
- C:\Windows\System\KiSKlKW.exe
  C:\Windows\System\KiSKlKW.exe
  2⤵
  PID:6556
- C:\Windows\System\pDeYqGZ.exe
  C:\Windows\System\pDeYqGZ.exe
  2⤵
  PID:6572
- C:\Windows\System\adIrYNq.exe
  C:\Windows\System\adIrYNq.exe
  2⤵
  PID:6588
- C:\Windows\System\wqeXSVX.exe
  C:\Windows\System\wqeXSVX.exe
  2⤵
  PID:6604
- C:\Windows\System\OuAjrIA.exe
  C:\Windows\System\OuAjrIA.exe
  2⤵
  PID:6620
- C:\Windows\System\DgGbyZZ.exe
  C:\Windows\System\DgGbyZZ.exe
  2⤵
  PID:6640
- C:\Windows\System\vkUHwyx.exe
  C:\Windows\System\vkUHwyx.exe
  2⤵
  PID:6656
- C:\Windows\System\mjIkrcf.exe
  C:\Windows\System\mjIkrcf.exe
  2⤵
  PID:6672
- C:\Windows\System\QWHYcZJ.exe
  C:\Windows\System\QWHYcZJ.exe
  2⤵
  PID:6692
- C:\Windows\System\aFcKBki.exe
  C:\Windows\System\aFcKBki.exe
  2⤵
  PID:6708
- C:\Windows\System\yEncWnV.exe
  C:\Windows\System\yEncWnV.exe
  2⤵
  PID:6724
- C:\Windows\System\ZspHryE.exe
  C:\Windows\System\ZspHryE.exe
  2⤵
  PID:6744
- C:\Windows\System\pfRCwaz.exe
  C:\Windows\System\pfRCwaz.exe
  2⤵
  PID:6760
- C:\Windows\System\ZBmjrQt.exe
  C:\Windows\System\ZBmjrQt.exe
  2⤵
  PID:6780
- C:\Windows\System\HGQNOTC.exe
  C:\Windows\System\HGQNOTC.exe
  2⤵
  PID:6796
- C:\Windows\System\yrgSLDI.exe
  C:\Windows\System\yrgSLDI.exe
  2⤵
  PID:6812
- C:\Windows\System\fBtZFTW.exe
  C:\Windows\System\fBtZFTW.exe
  2⤵
  PID:6828
- C:\Windows\System\GvsCUEd.exe
  C:\Windows\System\GvsCUEd.exe
  2⤵
  PID:6844
- C:\Windows\System\peyMupu.exe
  C:\Windows\System\peyMupu.exe
  2⤵
  PID:6860
- C:\Windows\System\fTmLhQX.exe
  C:\Windows\System\fTmLhQX.exe
  2⤵
  PID:6876
- C:\Windows\System\DJIaNLC.exe
  C:\Windows\System\DJIaNLC.exe
  2⤵
  PID:6992
- C:\Windows\System\OccCDQB.exe
  C:\Windows\System\OccCDQB.exe
  2⤵
  PID:7012
- C:\Windows\System\XRhxjdd.exe
  C:\Windows\System\XRhxjdd.exe
  2⤵
  PID:7028
- C:\Windows\System\PdPlVIP.exe
  C:\Windows\System\PdPlVIP.exe
  2⤵
  PID:7044
- C:\Windows\System\qOiFeSD.exe
  C:\Windows\System\qOiFeSD.exe
  2⤵
  PID:7060
- C:\Windows\System\ccrKpxL.exe
  C:\Windows\System\ccrKpxL.exe
  2⤵
  PID:7076
- C:\Windows\System\yTeZRKh.exe
  C:\Windows\System\yTeZRKh.exe
  2⤵
  PID:7092
- C:\Windows\System\wUpInez.exe
  C:\Windows\System\wUpInez.exe
  2⤵
  PID:7108
- C:\Windows\System\ZZIcXPd.exe
  C:\Windows\System\ZZIcXPd.exe
  2⤵
  PID:7124
- C:\Windows\System\RkHVjqh.exe
  C:\Windows\System\RkHVjqh.exe
  2⤵
  PID:7140
- C:\Windows\System\curddEp.exe
  C:\Windows\System\curddEp.exe
  2⤵
  PID:7156
- C:\Windows\System\RgYtzJc.exe
  C:\Windows\System\RgYtzJc.exe
  2⤵
  PID:6160
- C:\Windows\System\wumLWDo.exe
  C:\Windows\System\wumLWDo.exe
  2⤵
  PID:6228
- C:\Windows\System\jtLpfDH.exe
  C:\Windows\System\jtLpfDH.exe
  2⤵
  PID:5848
- C:\Windows\System\CDNmoey.exe
  C:\Windows\System\CDNmoey.exe
  2⤵
  PID:5128
- C:\Windows\System\RdSwPhP.exe
  C:\Windows\System\RdSwPhP.exe
  2⤵
  PID:2368
- C:\Windows\System\TmeviOz.exe
  C:\Windows\System\TmeviOz.exe
  2⤵
  PID:5896
- C:\Windows\System\tvbEYPw.exe
  C:\Windows\System\tvbEYPw.exe
  2⤵
  PID:6208
- C:\Windows\System\XhEHmaU.exe
  C:\Windows\System\XhEHmaU.exe
  2⤵
  PID:6272
- C:\Windows\System\KHuaqTu.exe
  C:\Windows\System\KHuaqTu.exe
  2⤵
  PID:6308
- C:\Windows\System\pDIRTMZ.exe
  C:\Windows\System\pDIRTMZ.exe
  2⤵
  PID:6400
- C:\Windows\System\XmwvXna.exe
  C:\Windows\System\XmwvXna.exe
  2⤵
  PID:6288
- C:\Windows\System\ntITzMR.exe
  C:\Windows\System\ntITzMR.exe
  2⤵
  PID:6356
- C:\Windows\System\ayeKaRs.exe
  C:\Windows\System\ayeKaRs.exe
  2⤵
  PID:6420
- C:\Windows\System\jJmkclz.exe
  C:\Windows\System\jJmkclz.exe
  2⤵
  PID:6480
- C:\Windows\System\gctkGkX.exe
  C:\Windows\System\gctkGkX.exe
  2⤵
  PID:6512
- C:\Windows\System\ucvPwYa.exe
  C:\Windows\System\ucvPwYa.exe
  2⤵
  PID:6464
- C:\Windows\System\KQiqqTM.exe
  C:\Windows\System\KQiqqTM.exe
  2⤵
  PID:6536
- C:\Windows\System\zrDcaUF.exe
  C:\Windows\System\zrDcaUF.exe
  2⤵
  PID:6584
- C:\Windows\System\NSYXyMx.exe
  C:\Windows\System\NSYXyMx.exe
  2⤵
  PID:6648
- C:\Windows\System\XcRrLVB.exe
  C:\Windows\System\XcRrLVB.exe
  2⤵
  PID:6688
- C:\Windows\System\hNySGFQ.exe
  C:\Windows\System\hNySGFQ.exe
  2⤵
  PID:6596
- C:\Windows\System\GdzFQvu.exe
  C:\Windows\System\GdzFQvu.exe
  2⤵
  PID:6628
- C:\Windows\System\uMocvvQ.exe
  C:\Windows\System\uMocvvQ.exe
  2⤵
  PID:6704
- C:\Windows\System\qyJbPXF.exe
  C:\Windows\System\qyJbPXF.exe
  2⤵
  PID:6756
- C:\Windows\System\JuXpgpj.exe
  C:\Windows\System\JuXpgpj.exe
  2⤵
  PID:6824
- C:\Windows\System\tedJymD.exe
  C:\Windows\System\tedJymD.exe
  2⤵
  PID:6768
- C:\Windows\System\SXvFrRR.exe
  C:\Windows\System\SXvFrRR.exe
  2⤵
  PID:6836
- C:\Windows\System\GwMZIaj.exe
  C:\Windows\System\GwMZIaj.exe
  2⤵
  PID:6884
- C:\Windows\System\UGsRoCa.exe
  C:\Windows\System\UGsRoCa.exe
  2⤵
  PID:6900
- C:\Windows\System\GWgbekJ.exe
  C:\Windows\System\GWgbekJ.exe
  2⤵
  PID:2492
- C:\Windows\System\bhXjBNp.exe
  C:\Windows\System\bhXjBNp.exe
  2⤵
  PID:6936
- C:\Windows\System\fYFoLWm.exe
  C:\Windows\System\fYFoLWm.exe
  2⤵
  PID:6948
- C:\Windows\System\ggkcODU.exe
  C:\Windows\System\ggkcODU.exe
  2⤵
  PID:6964
- C:\Windows\System\RhjLkOH.exe
  C:\Windows\System\RhjLkOH.exe
  2⤵
  PID:6988
- C:\Windows\System\GsepzST.exe
  C:\Windows\System\GsepzST.exe
  2⤵
  PID:7056
- C:\Windows\System\ybHETtO.exe
  C:\Windows\System\ybHETtO.exe
  2⤵
  PID:7148
- C:\Windows\System\ZaWCpIO.exe
  C:\Windows\System\ZaWCpIO.exe
  2⤵
  PID:7084
- C:\Windows\System\belnYbf.exe
  C:\Windows\System\belnYbf.exe
  2⤵
  PID:5892
- C:\Windows\System\modsYwq.exe
  C:\Windows\System\modsYwq.exe
  2⤵
  PID:6340
- C:\Windows\System\bnkqmsJ.exe
  C:\Windows\System\bnkqmsJ.exe
  2⤵
  PID:6320
- C:\Windows\System\HOqUuEO.exe
  C:\Windows\System\HOqUuEO.exe
  2⤵
  PID:6552
- C:\Windows\System\tdpBQYd.exe
  C:\Windows\System\tdpBQYd.exe
  2⤵
  PID:6684
- C:\Windows\System\MTGvnDo.exe
  C:\Windows\System\MTGvnDo.exe
  2⤵
  PID:2920
- C:\Windows\System\sQDyqwP.exe
  C:\Windows\System\sQDyqwP.exe
  2⤵
  PID:7132
- C:\Windows\System\apjnybT.exe
  C:\Windows\System\apjnybT.exe
  2⤵
  PID:6304
- C:\Windows\System\upncECN.exe
  C:\Windows\System\upncECN.exe
  2⤵
  PID:7040
- C:\Windows\System\KJlChtY.exe
  C:\Windows\System\KJlChtY.exe
  2⤵
  PID:7104
- C:\Windows\System\HmhtHUU.exe
  C:\Windows\System\HmhtHUU.exe
  2⤵
  PID:5464
- C:\Windows\System\DcGmbap.exe
  C:\Windows\System\DcGmbap.exe
  2⤵
  PID:6532
- C:\Windows\System\IJigota.exe
  C:\Windows\System\IJigota.exe
  2⤵
  PID:6636
- C:\Windows\System\PhOVkxI.exe
  C:\Windows\System\PhOVkxI.exe
  2⤵
  PID:6788
- C:\Windows\System\pOcFIZz.exe
  C:\Windows\System\pOcFIZz.exe
  2⤵
  PID:6776
- C:\Windows\System\WnnDJrC.exe
  C:\Windows\System\WnnDJrC.exe
  2⤵
  PID:6856
- C:\Windows\System\lKMxZgK.exe
  C:\Windows\System\lKMxZgK.exe
  2⤵
  PID:6944
- C:\Windows\System\jxccCuR.exe
  C:\Windows\System\jxccCuR.exe
  2⤵
  PID:6980
- C:\Windows\System\ljNjZdw.exe
  C:\Windows\System\ljNjZdw.exe
  2⤵
  PID:6104
- C:\Windows\System\sPPeXAY.exe
  C:\Windows\System\sPPeXAY.exe
  2⤵
  PID:6224
- C:\Windows\System\kRwWtic.exe
  C:\Windows\System\kRwWtic.exe
  2⤵
  PID:7024
- C:\Windows\System\VFDJhRB.exe
  C:\Windows\System\VFDJhRB.exe
  2⤵
  PID:5420
- C:\Windows\System\RHeLdEV.exe
  C:\Windows\System\RHeLdEV.exe
  2⤵
  PID:6172
- C:\Windows\System\NxRmsEn.exe
  C:\Windows\System\NxRmsEn.exe
  2⤵
  PID:7072
- C:\Windows\System\SclUfIX.exe
  C:\Windows\System\SclUfIX.exe
  2⤵
  PID:7008
- C:\Windows\System\KxuhqYZ.exe
  C:\Windows\System\KxuhqYZ.exe
  2⤵
  PID:6260
- C:\Windows\System\uKBlrZn.exe
  C:\Windows\System\uKBlrZn.exe
  2⤵
  PID:5780
- C:\Windows\System\YhJCuCr.exe
  C:\Windows\System\YhJCuCr.exe
  2⤵
  PID:6564
- C:\Windows\System\thlTPsN.exe
  C:\Windows\System\thlTPsN.exe
  2⤵
  PID:6820
- C:\Windows\System\mJZzjYJ.exe
  C:\Windows\System\mJZzjYJ.exe
  2⤵
  PID:7120
- C:\Windows\System\hdPpbzF.exe
  C:\Windows\System\hdPpbzF.exe
  2⤵
  PID:6452
- C:\Windows\System\lSWfeOA.exe
  C:\Windows\System\lSWfeOA.exe
  2⤵
  PID:6336
- C:\Windows\System\MsbWHnG.exe
  C:\Windows\System\MsbWHnG.exe
  2⤵
  PID:7176
- C:\Windows\System\zMtHKMw.exe
  C:\Windows\System\zMtHKMw.exe
  2⤵
  PID:7192
- C:\Windows\System\UzPfGoT.exe
  C:\Windows\System\UzPfGoT.exe
  2⤵
  PID:7208
- C:\Windows\System\KjDdlsG.exe
  C:\Windows\System\KjDdlsG.exe
  2⤵
  PID:7224
- C:\Windows\System\DBPiVeL.exe
  C:\Windows\System\DBPiVeL.exe
  2⤵
  PID:7240
- C:\Windows\System\NlvFRRm.exe
  C:\Windows\System\NlvFRRm.exe
  2⤵
  PID:7256
- C:\Windows\System\mDthFAp.exe
  C:\Windows\System\mDthFAp.exe
  2⤵
  PID:7272
- C:\Windows\System\peSsXmy.exe
  C:\Windows\System\peSsXmy.exe
  2⤵
  PID:7288
- C:\Windows\System\SffcARM.exe
  C:\Windows\System\SffcARM.exe
  2⤵
  PID:7304
- C:\Windows\System\tiOsikY.exe
  C:\Windows\System\tiOsikY.exe
  2⤵
  PID:7384
- C:\Windows\System\pOULRTh.exe
  C:\Windows\System\pOULRTh.exe
  2⤵
  PID:7400
- C:\Windows\System\ZvZevBX.exe
  C:\Windows\System\ZvZevBX.exe
  2⤵
  PID:7416
- C:\Windows\System\ODIeJDp.exe
  C:\Windows\System\ODIeJDp.exe
  2⤵
  PID:7432
- C:\Windows\System\IkRLoej.exe
  C:\Windows\System\IkRLoej.exe
  2⤵
  PID:7448
- C:\Windows\System\SlmXlaG.exe
  C:\Windows\System\SlmXlaG.exe
  2⤵
  PID:7464
- C:\Windows\System\bKaWmyU.exe
  C:\Windows\System\bKaWmyU.exe
  2⤵
  PID:7480
- C:\Windows\System\fYTfxSH.exe
  C:\Windows\System\fYTfxSH.exe
  2⤵
  PID:7496
- C:\Windows\System\aKjmtFg.exe
  C:\Windows\System\aKjmtFg.exe
  2⤵
  PID:7512
- C:\Windows\System\aDvfsUC.exe
  C:\Windows\System\aDvfsUC.exe
  2⤵
  PID:7528
- C:\Windows\System\FFPwyqn.exe
  C:\Windows\System\FFPwyqn.exe
  2⤵
  PID:7548
- C:\Windows\System\MoYITlC.exe
  C:\Windows\System\MoYITlC.exe
  2⤵
  PID:7564
- C:\Windows\System\TOTcvzD.exe
  C:\Windows\System\TOTcvzD.exe
  2⤵
  PID:7580
- C:\Windows\System\WnVsuHx.exe
  C:\Windows\System\WnVsuHx.exe
  2⤵
  PID:7644
- C:\Windows\System\zaFBzVF.exe
  C:\Windows\System\zaFBzVF.exe
  2⤵
  PID:7680
- C:\Windows\System\VEOWwFq.exe
  C:\Windows\System\VEOWwFq.exe
  2⤵
  PID:7696
- C:\Windows\System\WTAMZDv.exe
  C:\Windows\System\WTAMZDv.exe
  2⤵
  PID:7712
- C:\Windows\System\xJrFttw.exe
  C:\Windows\System\xJrFttw.exe
  2⤵
  PID:7728
- C:\Windows\System\vLnrTmR.exe
  C:\Windows\System\vLnrTmR.exe
  2⤵
  PID:7744
- C:\Windows\System\pkmxJBH.exe
  C:\Windows\System\pkmxJBH.exe
  2⤵
  PID:7760
- C:\Windows\System\fcbRWrw.exe
  C:\Windows\System\fcbRWrw.exe
  2⤵
  PID:7776
- C:\Windows\System\MxwClYx.exe
  C:\Windows\System\MxwClYx.exe
  2⤵
  PID:7792
- C:\Windows\System\UdBIEXY.exe
  C:\Windows\System\UdBIEXY.exe
  2⤵
  PID:7808
- C:\Windows\System\vUOKGzM.exe
  C:\Windows\System\vUOKGzM.exe
  2⤵
  PID:7824
- C:\Windows\System\zVyuVjb.exe
  C:\Windows\System\zVyuVjb.exe
  2⤵
  PID:7840
- C:\Windows\System\OIIkFCz.exe
  C:\Windows\System\OIIkFCz.exe
  2⤵
  PID:7856
- C:\Windows\System\cueWZPm.exe
  C:\Windows\System\cueWZPm.exe
  2⤵
  PID:7872
- C:\Windows\System\DOFKXGA.exe
  C:\Windows\System\DOFKXGA.exe
  2⤵
  PID:7888
- C:\Windows\System\CjZNCng.exe
  C:\Windows\System\CjZNCng.exe
  2⤵
  PID:7904
- C:\Windows\System\ENWUGcR.exe
  C:\Windows\System\ENWUGcR.exe
  2⤵
  PID:7920
- C:\Windows\System\jglHduZ.exe
  C:\Windows\System\jglHduZ.exe
  2⤵
  PID:7936
- C:\Windows\System\Tuemnux.exe
  C:\Windows\System\Tuemnux.exe
  2⤵
  PID:7952
- C:\Windows\System\vJnDDNT.exe
  C:\Windows\System\vJnDDNT.exe
  2⤵
  PID:8048
- C:\Windows\System\ZoOAYBg.exe
  C:\Windows\System\ZoOAYBg.exe
  2⤵
  PID:8064
- C:\Windows\System\OdSvNEC.exe
  C:\Windows\System\OdSvNEC.exe
  2⤵
  PID:8080
- C:\Windows\System\WRZZGdm.exe
  C:\Windows\System\WRZZGdm.exe
  2⤵
  PID:8096
- C:\Windows\System\IuEXqLN.exe
  C:\Windows\System\IuEXqLN.exe
  2⤵
  PID:8112
- C:\Windows\System\nkArpYE.exe
  C:\Windows\System\nkArpYE.exe
  2⤵
  PID:8128
- C:\Windows\System\cZwSdHz.exe
  C:\Windows\System\cZwSdHz.exe
  2⤵
  PID:8144
- C:\Windows\System\mKsDjyI.exe
  C:\Windows\System\mKsDjyI.exe
  2⤵
  PID:8160
- C:\Windows\System\BHdlsWB.exe
  C:\Windows\System\BHdlsWB.exe
  2⤵
  PID:8176
- C:\Windows\System\tXdpEDI.exe
  C:\Windows\System\tXdpEDI.exe
  2⤵
  PID:6960
- C:\Windows\System\LmKcUmN.exe
  C:\Windows\System\LmKcUmN.exe
  2⤵
  PID:7172
- C:\Windows\System\rmjaYsu.exe
  C:\Windows\System\rmjaYsu.exe
  2⤵
  PID:7236
- C:\Windows\System\mxzXlpc.exe
  C:\Windows\System\mxzXlpc.exe
  2⤵
  PID:7300
- C:\Windows\System\GwEIIst.exe
  C:\Windows\System\GwEIIst.exe
  2⤵
  PID:7100
- C:\Windows\System\GhRUCHp.exe
  C:\Windows\System\GhRUCHp.exe
  2⤵
  PID:6940
- C:\Windows\System\DBRsPOY.exe
  C:\Windows\System\DBRsPOY.exe
  2⤵
  PID:6156
- C:\Windows\System\BBHvrZi.exe
  C:\Windows\System\BBHvrZi.exe
  2⤵
  PID:6664
- C:\Windows\System\cofmirK.exe
  C:\Windows\System\cofmirK.exe
  2⤵
  PID:7164
- C:\Windows\System\UqpVAQi.exe
  C:\Windows\System\UqpVAQi.exe
  2⤵
  PID:7220
- C:\Windows\System\HJPEcsS.exe
  C:\Windows\System\HJPEcsS.exe
  2⤵
  PID:7316
- C:\Windows\System\EYrVoJN.exe
  C:\Windows\System\EYrVoJN.exe
  2⤵
  PID:7332
- C:\Windows\System\dokaZAV.exe
  C:\Windows\System\dokaZAV.exe
  2⤵
  PID:7352
- C:\Windows\System\lWpGmLb.exe
  C:\Windows\System\lWpGmLb.exe
  2⤵
  PID:7372
- C:\Windows\System\rLUiuus.exe
  C:\Windows\System\rLUiuus.exe
  2⤵
  PID:7380
- C:\Windows\System\OdBkaIZ.exe
  C:\Windows\System\OdBkaIZ.exe
  2⤵
  PID:7456
- C:\Windows\System\xMRbfOo.exe
  C:\Windows\System\xMRbfOo.exe
  2⤵
  PID:7492
- C:\Windows\System\WvKamUu.exe
  C:\Windows\System\WvKamUu.exe
  2⤵
  PID:7560
- C:\Windows\System\qbYVVTB.exe
  C:\Windows\System\qbYVVTB.exe
  2⤵
  PID:7440
- C:\Windows\System\jytatXf.exe
  C:\Windows\System\jytatXf.exe
  2⤵
  PID:7476
- C:\Windows\System\uqBtSTV.exe
  C:\Windows\System\uqBtSTV.exe
  2⤵
  PID:7572
- C:\Windows\System\chSGxhj.exe
  C:\Windows\System\chSGxhj.exe
  2⤵
  PID:7604
- C:\Windows\System\sfssBFn.exe
  C:\Windows\System\sfssBFn.exe
  2⤵
  PID:7616
- C:\Windows\System\vZppJYN.exe
  C:\Windows\System\vZppJYN.exe
  2⤵
  PID:7636
- C:\Windows\System\XttmEfO.exe
  C:\Windows\System\XttmEfO.exe
  2⤵
  PID:7660
- C:\Windows\System\sWeRfbW.exe
  C:\Windows\System\sWeRfbW.exe
  2⤵
  PID:7720
- C:\Windows\System\DriFeUp.exe
  C:\Windows\System\DriFeUp.exe
  2⤵
  PID:7784
- C:\Windows\System\ePFnwxz.exe
  C:\Windows\System\ePFnwxz.exe
  2⤵
  PID:7848
- C:\Windows\System\iPhQaSr.exe
  C:\Windows\System\iPhQaSr.exe
  2⤵
  PID:7916
- C:\Windows\System\RtLlXYP.exe
  C:\Windows\System\RtLlXYP.exe
  2⤵
  PID:7932
- C:\Windows\System\QVrizHq.exe
  C:\Windows\System\QVrizHq.exe
  2⤵
  PID:7668
- C:\Windows\System\PYMhrSs.exe
  C:\Windows\System\PYMhrSs.exe
  2⤵
  PID:7708
- C:\Windows\System\AflrpmK.exe
  C:\Windows\System\AflrpmK.exe
  2⤵
  PID:7772
- C:\Windows\System\qMEJGWI.exe
  C:\Windows\System\qMEJGWI.exe
  2⤵
  PID:7960
- C:\Windows\System\UOdMkzC.exe
  C:\Windows\System\UOdMkzC.exe
  2⤵
  PID:7976
- C:\Windows\System\XfLGghc.exe
  C:\Windows\System\XfLGghc.exe
  2⤵
  PID:7992
- C:\Windows\System\zWANzyb.exe
  C:\Windows\System\zWANzyb.exe
  2⤵
  PID:8008
- C:\Windows\System\JCnNUMq.exe
  C:\Windows\System\JCnNUMq.exe
  2⤵
  PID:8028
- C:\Windows\System\XhJXDzx.exe
  C:\Windows\System\XhJXDzx.exe
  2⤵
  PID:8044
- C:\Windows\System\BGqzAbe.exe
  C:\Windows\System\BGqzAbe.exe
  2⤵
  PID:8060
- C:\Windows\System\aoFNFRZ.exe
  C:\Windows\System\aoFNFRZ.exe
  2⤵
  PID:8124
- C:\Windows\System\IOjLHAG.exe
  C:\Windows\System\IOjLHAG.exe
  2⤵
  PID:8188
- C:\Windows\System\VMORVmc.exe
  C:\Windows\System\VMORVmc.exe
  2⤵
  PID:6932
- C:\Windows\System\zyzBqND.exe
  C:\Windows\System\zyzBqND.exe
  2⤵
  PID:6808
- C:\Windows\System\CQIBfip.exe
  C:\Windows\System\CQIBfip.exe
  2⤵
  PID:7264
- C:\Windows\System\DitTdDk.exe
  C:\Windows\System\DitTdDk.exe
  2⤵
  PID:8152
- C:\Windows\System\OJLZOrL.exe
  C:\Windows\System\OJLZOrL.exe
  2⤵
  PID:7284
- C:\Windows\System\cmBOxfQ.exe
  C:\Windows\System\cmBOxfQ.exe
  2⤵
  PID:7216
- C:\Windows\System\csElNhj.exe
  C:\Windows\System\csElNhj.exe
  2⤵
  PID:7344
- C:\Windows\System\PmwNCIa.exe
  C:\Windows\System\PmwNCIa.exe
  2⤵
  PID:7368
- C:\Windows\System\yWXSNCU.exe
  C:\Windows\System\yWXSNCU.exe
  2⤵
  PID:7428
- C:\Windows\System\nyQarEq.exe
  C:\Windows\System\nyQarEq.exe
  2⤵
  PID:7408
- C:\Windows\System\kOaJRGP.exe
  C:\Windows\System\kOaJRGP.exe
  2⤵
  PID:7612
- C:\Windows\System\zODiKoQ.exe
  C:\Windows\System\zODiKoQ.exe
  2⤵
  PID:7752
- C:\Windows\System\nBBgevT.exe
  C:\Windows\System\nBBgevT.exe
  2⤵
  PID:7880
- C:\Windows\System\GiHxcIi.exe
  C:\Windows\System\GiHxcIi.exe
  2⤵
  PID:7768
- C:\Windows\System\PNLsjHS.exe
  C:\Windows\System\PNLsjHS.exe
  2⤵
  PID:7972
- C:\Windows\System\KHwDDtP.exe
  C:\Windows\System\KHwDDtP.exe
  2⤵
  PID:8120
- C:\Windows\System\ZiGLfUa.exe
  C:\Windows\System\ZiGLfUa.exe
  2⤵
  PID:6736
- C:\Windows\System\LoXJkex.exe
  C:\Windows\System\LoXJkex.exe
  2⤵
  PID:6616
- C:\Windows\System\iOSLGVk.exe
  C:\Windows\System\iOSLGVk.exe
  2⤵
  PID:7488
- C:\Windows\System\uOAqDbT.exe
  C:\Windows\System\uOAqDbT.exe
  2⤵
  PID:7868
- C:\Windows\System\hhsNGRt.exe
  C:\Windows\System\hhsNGRt.exe
  2⤵
  PID:7576
- C:\Windows\System\lNpjxkZ.exe
  C:\Windows\System\lNpjxkZ.exe
  2⤵
  PID:7632
- C:\Windows\System\ZWKSwRr.exe
  C:\Windows\System\ZWKSwRr.exe
  2⤵
  PID:7816
- C:\Windows\System\OGyDADG.exe
  C:\Windows\System\OGyDADG.exe
  2⤵
  PID:7896
- C:\Windows\System\MWBLWlz.exe
  C:\Windows\System\MWBLWlz.exe
  2⤵
  PID:7804
- C:\Windows\System\lXyljFS.exe
  C:\Windows\System\lXyljFS.exe
  2⤵
  PID:7336
- C:\Windows\System\PJUmPzx.exe
  C:\Windows\System\PJUmPzx.exe
  2⤵
  PID:7544
- C:\Windows\System\Zcdxhvd.exe
  C:\Windows\System\Zcdxhvd.exe
  2⤵
  PID:8076
- C:\Windows\System\iVKUoYu.exe
  C:\Windows\System\iVKUoYu.exe
  2⤵
  PID:8156
- C:\Windows\System\tjjXABL.exe
  C:\Windows\System\tjjXABL.exe
  2⤵
  PID:7188
- C:\Windows\System\kBFyaNI.exe
  C:\Windows\System\kBFyaNI.exe
  2⤵
  PID:8032
- C:\Windows\System\FIemCyx.exe
  C:\Windows\System\FIemCyx.exe
  2⤵
  PID:7232
- C:\Windows\System\PNnLYyD.exe
  C:\Windows\System\PNnLYyD.exe
  2⤵
  PID:7704
- C:\Windows\System\eyObnje.exe
  C:\Windows\System\eyObnje.exe
  2⤵
  PID:7004
- C:\Windows\System\GPWcjex.exe
  C:\Windows\System\GPWcjex.exe
  2⤵
  PID:7596
- C:\Windows\System\LlJgjWM.exe
  C:\Windows\System\LlJgjWM.exe
  2⤵
  PID:7988
- C:\Windows\System\OSSwiUE.exe
  C:\Windows\System\OSSwiUE.exe
  2⤵
  PID:8020
- C:\Windows\System\SebDGKn.exe
  C:\Windows\System\SebDGKn.exe
  2⤵
  PID:7864
- C:\Windows\System\tPnuelU.exe
  C:\Windows\System\tPnuelU.exe
  2⤵
  PID:7524
- C:\Windows\System\MgXcfeK.exe
  C:\Windows\System\MgXcfeK.exe
  2⤵
  PID:8140
- C:\Windows\System\CijBBve.exe
  C:\Windows\System\CijBBve.exe
  2⤵
  PID:8204
- C:\Windows\System\rvsniWq.exe
  C:\Windows\System\rvsniWq.exe
  2⤵
  PID:8220
- C:\Windows\System\vmmWKYZ.exe
  C:\Windows\System\vmmWKYZ.exe
  2⤵
  PID:8240
- C:\Windows\System\pmuDNMZ.exe
  C:\Windows\System\pmuDNMZ.exe
  2⤵
  PID:8256
- C:\Windows\System\aBJjyaw.exe
  C:\Windows\System\aBJjyaw.exe
  2⤵
  PID:8272
- C:\Windows\System\PBBEQqW.exe
  C:\Windows\System\PBBEQqW.exe
  2⤵
  PID:8288
- C:\Windows\System\lsiRDLN.exe
  C:\Windows\System\lsiRDLN.exe
  2⤵
  PID:8304
- C:\Windows\System\YOZJOHV.exe
  C:\Windows\System\YOZJOHV.exe
  2⤵
  PID:8320
- C:\Windows\System\ARCvHgh.exe
  C:\Windows\System\ARCvHgh.exe
  2⤵
  PID:8336
- C:\Windows\System\vdWPtYN.exe
  C:\Windows\System\vdWPtYN.exe
  2⤵
  PID:8352
- C:\Windows\System\TdOvSZA.exe
  C:\Windows\System\TdOvSZA.exe
  2⤵
  PID:8368
- C:\Windows\System\aMMMqSD.exe
  C:\Windows\System\aMMMqSD.exe
  2⤵
  PID:8384
- C:\Windows\System\fpvXaQs.exe
  C:\Windows\System\fpvXaQs.exe
  2⤵
  PID:8404
- C:\Windows\System\RDyyzis.exe
  C:\Windows\System\RDyyzis.exe
  2⤵
  PID:8420
- C:\Windows\System\llPSMcM.exe
  C:\Windows\System\llPSMcM.exe
  2⤵
  PID:8440
- C:\Windows\System\EEUnOwp.exe
  C:\Windows\System\EEUnOwp.exe
  2⤵
  PID:8456
- C:\Windows\System\tysSzHq.exe
  C:\Windows\System\tysSzHq.exe
  2⤵
  PID:8476
- C:\Windows\System\OfqAiwT.exe
  C:\Windows\System\OfqAiwT.exe
  2⤵
  PID:8564
- C:\Windows\System\WiNYDZB.exe
  C:\Windows\System\WiNYDZB.exe
  2⤵
  PID:8580
- C:\Windows\System\mndcWoh.exe
  C:\Windows\System\mndcWoh.exe
  2⤵
  PID:8596
- C:\Windows\System\wcABDFP.exe
  C:\Windows\System\wcABDFP.exe
  2⤵
  PID:8612
- C:\Windows\System\qaOvieN.exe
  C:\Windows\System\qaOvieN.exe
  2⤵
  PID:8628
- C:\Windows\System\qqQVBiI.exe
  C:\Windows\System\qqQVBiI.exe
  2⤵
  PID:8644
- C:\Windows\System\mPeYWZT.exe
  C:\Windows\System\mPeYWZT.exe
  2⤵
  PID:8660
- C:\Windows\System\vwlHFiF.exe
  C:\Windows\System\vwlHFiF.exe
  2⤵
  PID:8680
- C:\Windows\System\pDUMPTr.exe
  C:\Windows\System\pDUMPTr.exe
  2⤵
  PID:8696
- C:\Windows\System\mUSmgOR.exe
  C:\Windows\System\mUSmgOR.exe
  2⤵
  PID:8712
- C:\Windows\System\FaJdCnq.exe
  C:\Windows\System\FaJdCnq.exe
  2⤵
  PID:8728
- C:\Windows\System\EJgsudY.exe
  C:\Windows\System\EJgsudY.exe
  2⤵
  PID:8744
- C:\Windows\System\aobzVrZ.exe
  C:\Windows\System\aobzVrZ.exe
  2⤵
  PID:8760
- C:\Windows\System\yfhWmEV.exe
  C:\Windows\System\yfhWmEV.exe
  2⤵
  PID:8776
- C:\Windows\System\IjkKrgi.exe
  C:\Windows\System\IjkKrgi.exe
  2⤵
  PID:8792
- C:\Windows\System\zEIDipw.exe
  C:\Windows\System\zEIDipw.exe
  2⤵
  PID:8808
- C:\Windows\System\HEneMJi.exe
  C:\Windows\System\HEneMJi.exe
  2⤵
  PID:8824
- C:\Windows\System\ZwVXXyt.exe
  C:\Windows\System\ZwVXXyt.exe
  2⤵
  PID:8840
- C:\Windows\System\mCBNALa.exe
  C:\Windows\System\mCBNALa.exe
  2⤵
  PID:8864
- C:\Windows\System\aLwyWoH.exe
  C:\Windows\System\aLwyWoH.exe
  2⤵
  PID:8880
- C:\Windows\System\qUpJImk.exe
  C:\Windows\System\qUpJImk.exe
  2⤵
  PID:8896
- C:\Windows\System\sdByDqj.exe
  C:\Windows\System\sdByDqj.exe
  2⤵
  PID:8912
- C:\Windows\System\LNAYoUZ.exe
  C:\Windows\System\LNAYoUZ.exe
  2⤵
  PID:8996
- C:\Windows\System\BkeLHZG.exe
  C:\Windows\System\BkeLHZG.exe
  2⤵
  PID:9012
- C:\Windows\System\meSmnhm.exe
  C:\Windows\System\meSmnhm.exe
  2⤵
  PID:9032
- C:\Windows\System\SBKFhNt.exe
  C:\Windows\System\SBKFhNt.exe
  2⤵
  PID:9048
- C:\Windows\System\fiNsWzV.exe
  C:\Windows\System\fiNsWzV.exe
  2⤵
  PID:9064
- C:\Windows\System\AGIrRIz.exe
  C:\Windows\System\AGIrRIz.exe
  2⤵
  PID:9080
- C:\Windows\System\yZzThxt.exe
  C:\Windows\System\yZzThxt.exe
  2⤵
  PID:9096
- C:\Windows\System\YPGvlnw.exe
  C:\Windows\System\YPGvlnw.exe
  2⤵
  PID:9112
- C:\Windows\System\yetRUmv.exe
  C:\Windows\System\yetRUmv.exe
  2⤵
  PID:9128
- C:\Windows\System\agFRHFh.exe
  C:\Windows\System\agFRHFh.exe
  2⤵
  PID:9144
- C:\Windows\System\stOPeWy.exe
  C:\Windows\System\stOPeWy.exe
  2⤵
  PID:9164
- C:\Windows\System\ejLFlMp.exe
  C:\Windows\System\ejLFlMp.exe
  2⤵
  PID:9180
- C:\Windows\System\UdFKqkH.exe
  C:\Windows\System\UdFKqkH.exe
  2⤵
  PID:9200
- C:\Windows\System\hfHvHWr.exe
  C:\Windows\System\hfHvHWr.exe
  2⤵
  PID:6244
- C:\Windows\System\PtYUMzI.exe
  C:\Windows\System\PtYUMzI.exe
  2⤵
  PID:8004
- C:\Windows\System\EoguLAI.exe
  C:\Windows\System\EoguLAI.exe
  2⤵
  PID:7688
- C:\Windows\System\EPWoGOc.exe
  C:\Windows\System\EPWoGOc.exe
  2⤵
  PID:8212
- C:\Windows\System\XOJHrXo.exe
  C:\Windows\System\XOJHrXo.exe
  2⤵
  PID:8280
- C:\Windows\System\mWZQTai.exe
  C:\Windows\System\mWZQTai.exe
  2⤵
  PID:8360
- C:\Windows\System\gDPgnkt.exe
  C:\Windows\System\gDPgnkt.exe
  2⤵
  PID:8436
- C:\Windows\System\AiBSKYH.exe
  C:\Windows\System\AiBSKYH.exe
  2⤵
  PID:8316
- C:\Windows\System\srHzTQW.exe
  C:\Windows\System\srHzTQW.exe
  2⤵
  PID:8464
- C:\Windows\System\zRMDpTY.exe
  C:\Windows\System\zRMDpTY.exe
  2⤵
  PID:8508
- C:\Windows\System\QZihBhR.exe
  C:\Windows\System\QZihBhR.exe
  2⤵
  PID:8496
- C:\Windows\System\bBSMYsu.exe
  C:\Windows\System\bBSMYsu.exe
  2⤵
  PID:8516
- C:\Windows\System\SCBbINc.exe
  C:\Windows\System\SCBbINc.exe
  2⤵
  PID:8540
- C:\Windows\System\bNjYMZf.exe
  C:\Windows\System\bNjYMZf.exe
  2⤵
  PID:8552
- C:\Windows\System\heOFSgG.exe
  C:\Windows\System\heOFSgG.exe
  2⤵
  PID:8640
- C:\Windows\System\SCWkZvm.exe
  C:\Windows\System\SCWkZvm.exe
  2⤵
  PID:8656
- C:\Windows\System\KKOjVYn.exe
  C:\Windows\System\KKOjVYn.exe
  2⤵
  PID:8620
- C:\Windows\System\TFcphvv.exe
  C:\Windows\System\TFcphvv.exe
  2⤵
  PID:8704
- C:\Windows\System\BZPYAIG.exe
  C:\Windows\System\BZPYAIG.exe
  2⤵
  PID:8772
- C:\Windows\System\iDiXYyB.exe
  C:\Windows\System\iDiXYyB.exe
  2⤵
  PID:8872
- C:\Windows\System\jPJmzLd.exe
  C:\Windows\System\jPJmzLd.exe
  2⤵
  PID:8692
- C:\Windows\System\fuLSHzm.exe
  C:\Windows\System\fuLSHzm.exe
  2⤵
  PID:8784
- C:\Windows\System\KApoJWd.exe
  C:\Windows\System\KApoJWd.exe
  2⤵
  PID:8964
- C:\Windows\System\vslnRRe.exe
  C:\Windows\System\vslnRRe.exe
  2⤵
  PID:8980
- C:\Windows\System\eIYxjZL.exe
  C:\Windows\System\eIYxjZL.exe
  2⤵
  PID:8928
- C:\Windows\System\IuTZXZM.exe
  C:\Windows\System\IuTZXZM.exe
  2⤵
  PID:9092
- C:\Windows\System\ixeFIbz.exe
  C:\Windows\System\ixeFIbz.exe
  2⤵
  PID:9008
- C:\Windows\System\eRGwddG.exe
  C:\Windows\System\eRGwddG.exe
  2⤵
  PID:9108
- C:\Windows\System\LtFVqWi.exe
  C:\Windows\System\LtFVqWi.exe
  2⤵
  PID:9176
- C:\Windows\System\opXRFck.exe
  C:\Windows\System\opXRFck.exe
  2⤵
  PID:8228
- C:\Windows\System\hmBNXVc.exe
  C:\Windows\System\hmBNXVc.exe
  2⤵
  PID:8268
- C:\Windows\System\zYwvhNn.exe
  C:\Windows\System\zYwvhNn.exe
  2⤵
  PID:8248
- C:\Windows\System\NOjeUwi.exe
  C:\Windows\System\NOjeUwi.exe
  2⤵
  PID:8348
- C:\Windows\System\wnlxcAQ.exe
  C:\Windows\System\wnlxcAQ.exe
  2⤵
  PID:8416
- C:\Windows\System\SDiBPvN.exe
  C:\Windows\System\SDiBPvN.exe
  2⤵
  PID:8524
- C:\Windows\System\IIvDMcx.exe
  C:\Windows\System\IIvDMcx.exe
  2⤵
  PID:8604
- C:\Windows\System\fKOywoz.exe
  C:\Windows\System\fKOywoz.exe
  2⤵
  PID:8588
- C:\Windows\System\rHRLFym.exe
  C:\Windows\System\rHRLFym.exe
  2⤵
  PID:8788
- C:\Windows\System\WciVstJ.exe
  C:\Windows\System\WciVstJ.exe
  2⤵
  PID:8860
- C:\Windows\System\qgZehAi.exe
  C:\Windows\System\qgZehAi.exe
  2⤵
  PID:9196
- C:\Windows\System\pnqmweL.exe
  C:\Windows\System\pnqmweL.exe
  2⤵
  PID:9188
- C:\Windows\System\KTyGvBW.exe
  C:\Windows\System\KTyGvBW.exe
  2⤵
  PID:7536
- C:\Windows\System\mUxbQki.exe
  C:\Windows\System\mUxbQki.exe
  2⤵
  PID:8484
- C:\Windows\System\BxGdKyS.exe
  C:\Windows\System\BxGdKyS.exe
  2⤵
  PID:8548
- C:\Windows\System\oiDSezM.exe
  C:\Windows\System\oiDSezM.exe
  2⤵
  PID:8832
- C:\Windows\System\ecCHLqZ.exe
  C:\Windows\System\ecCHLqZ.exe
  2⤵
  PID:8924
- C:\Windows\System\ojSfQej.exe
  C:\Windows\System\ojSfQej.exe
  2⤵
  PID:8908
- C:\Windows\System\sVjsIje.exe
  C:\Windows\System\sVjsIje.exe
  2⤵
  PID:9056
- C:\Windows\System\ofHXgKZ.exe
  C:\Windows\System\ofHXgKZ.exe
  2⤵
  PID:9076
- C:\Windows\System\fnJXDOQ.exe
  C:\Windows\System\fnJXDOQ.exe
  2⤵
  PID:8892
- C:\Windows\System\MXiRsZl.exe
  C:\Windows\System\MXiRsZl.exe
  2⤵
  PID:8944
- C:\Windows\System\JkaynOe.exe
  C:\Windows\System\JkaynOe.exe
  2⤵
  PID:8296
- C:\Windows\System\neLJbKW.exe
  C:\Windows\System\neLJbKW.exe
  2⤵
  PID:8380
- C:\Windows\System\MKJvkBt.exe
  C:\Windows\System\MKJvkBt.exe
  2⤵
  PID:9004
- C:\Windows\System\bIwIEnO.exe
  C:\Windows\System\bIwIEnO.exe
  2⤵
  PID:8264
- C:\Windows\System\CICvasE.exe
  C:\Windows\System\CICvasE.exe
  2⤵
  PID:9040
- C:\Windows\System\zqlUmcM.exe
  C:\Windows\System\zqlUmcM.exe
  2⤵
  PID:8252
- C:\Windows\System\kkzcxtW.exe
  C:\Windows\System\kkzcxtW.exe
  2⤵
  PID:7656
- C:\Windows\System\TXbQoyz.exe
  C:\Windows\System\TXbQoyz.exe
  2⤵
  PID:8556
- C:\Windows\System\QbSYCYs.exe
  C:\Windows\System\QbSYCYs.exe
  2⤵
  PID:8676
- C:\Windows\System\MGvpXvj.exe
  C:\Windows\System\MGvpXvj.exe
  2⤵
  PID:8852
- C:\Windows\System\aQzwdYg.exe
  C:\Windows\System\aQzwdYg.exe
  2⤵
  PID:9088
- C:\Windows\System\SyjCVkl.exe
  C:\Windows\System\SyjCVkl.exe
  2⤵
  PID:8756
- C:\Windows\System\mhZbXpL.exe
  C:\Windows\System\mhZbXpL.exe
  2⤵
  PID:7364
- C:\Windows\System\zwNOLdS.exe
  C:\Windows\System\zwNOLdS.exe
  2⤵
  PID:9172
- C:\Windows\System\RDQPnQF.exe
  C:\Windows\System\RDQPnQF.exe
  2⤵
  PID:8904
- C:\Windows\System\fuSxxzm.exe
  C:\Windows\System\fuSxxzm.exe
  2⤵
  PID:8708
- C:\Windows\System\DuUselA.exe
  C:\Windows\System\DuUselA.exe
  2⤵
  PID:8952
- C:\Windows\System\NjptCDF.exe
  C:\Windows\System\NjptCDF.exe
  2⤵
  PID:8768
- C:\Windows\System\OBYtHtM.exe
  C:\Windows\System\OBYtHtM.exe
  2⤵
  PID:8488
- C:\Windows\System\UfGKOMF.exe
  C:\Windows\System\UfGKOMF.exe
  2⤵
  PID:7328
- C:\Windows\System\puxPpAs.exe
  C:\Windows\System\puxPpAs.exe
  2⤵
  PID:8992
- C:\Windows\System\tjsNtEe.exe
  C:\Windows\System\tjsNtEe.exe
  2⤵
  PID:8504
- C:\Windows\System\pwSRvmZ.exe
  C:\Windows\System\pwSRvmZ.exe
  2⤵
  PID:8976
- C:\Windows\System\uaEUSSY.exe
  C:\Windows\System\uaEUSSY.exe
  2⤵
  PID:8752
- C:\Windows\System\SnkhvXu.exe
  C:\Windows\System\SnkhvXu.exe
  2⤵
  PID:8092
- C:\Windows\System\teNbKOS.exe
  C:\Windows\System\teNbKOS.exe
  2⤵
  PID:8724
- C:\Windows\System\BLuAvtL.exe
  C:\Windows\System\BLuAvtL.exe
  2⤵
  PID:9224
- C:\Windows\System\gvYmgHy.exe
  C:\Windows\System\gvYmgHy.exe
  2⤵
  PID:9240
- C:\Windows\System\BIShLwt.exe
  C:\Windows\System\BIShLwt.exe
  2⤵
  PID:9256
- C:\Windows\System\uyflZfk.exe
  C:\Windows\System\uyflZfk.exe
  2⤵
  PID:9276
- C:\Windows\System\NSFribs.exe
  C:\Windows\System\NSFribs.exe
  2⤵
  PID:9296
- C:\Windows\System\NBZaJmO.exe
  C:\Windows\System\NBZaJmO.exe
  2⤵
  PID:9320
- C:\Windows\System\ZBFqJHo.exe
  C:\Windows\System\ZBFqJHo.exe
  2⤵
  PID:9336
- C:\Windows\System\TFFKGVR.exe
  C:\Windows\System\TFFKGVR.exe
  2⤵
  PID:9356
- C:\Windows\System\veUpCQY.exe
  C:\Windows\System\veUpCQY.exe
  2⤵
  PID:9372
- C:\Windows\System\xsHOfZu.exe
  C:\Windows\System\xsHOfZu.exe
  2⤵
  PID:9388
- C:\Windows\System\eweValb.exe
  C:\Windows\System\eweValb.exe
  2⤵
  PID:9404
- C:\Windows\System\TdgagYZ.exe
  C:\Windows\System\TdgagYZ.exe
  2⤵
  PID:9420
- C:\Windows\System\VfahWmd.exe
  C:\Windows\System\VfahWmd.exe
  2⤵
  PID:9436
- C:\Windows\System\uURzZSB.exe
  C:\Windows\System\uURzZSB.exe
  2⤵
  PID:9452
- C:\Windows\System\vemtfQQ.exe
  C:\Windows\System\vemtfQQ.exe
  2⤵
  PID:9468
- C:\Windows\System\eCwKPry.exe
  C:\Windows\System\eCwKPry.exe
  2⤵
  PID:9484
- C:\Windows\System\iGrCKsz.exe
  C:\Windows\System\iGrCKsz.exe
  2⤵
  PID:9500
- C:\Windows\System\qjmXVRK.exe
  C:\Windows\System\qjmXVRK.exe
  2⤵
  PID:9516
- C:\Windows\System\mLaNpvm.exe
  C:\Windows\System\mLaNpvm.exe
  2⤵
  PID:9536
- C:\Windows\System\cWrrvLk.exe
  C:\Windows\System\cWrrvLk.exe
  2⤵
  PID:9552
- C:\Windows\System\ajhVcsv.exe
  C:\Windows\System\ajhVcsv.exe
  2⤵
  PID:9572
- C:\Windows\System\IyMcCdU.exe
  C:\Windows\System\IyMcCdU.exe
  2⤵
  PID:9588
- C:\Windows\System\QJaYRKu.exe
  C:\Windows\System\QJaYRKu.exe
  2⤵
  PID:9604
- C:\Windows\System\bbWfZtM.exe
  C:\Windows\System\bbWfZtM.exe
  2⤵
  PID:9620
- C:\Windows\System\RJWOVmU.exe
  C:\Windows\System\RJWOVmU.exe
  2⤵
  PID:9636
- C:\Windows\System\QJYSfud.exe
  C:\Windows\System\QJYSfud.exe
  2⤵
  PID:9652
- C:\Windows\System\eNRXpeB.exe
  C:\Windows\System\eNRXpeB.exe
  2⤵
  PID:9668
- C:\Windows\System\yIvMXps.exe
  C:\Windows\System\yIvMXps.exe
  2⤵
  PID:9684
- C:\Windows\System\TWAXhCg.exe
  C:\Windows\System\TWAXhCg.exe
  2⤵
  PID:9700
- C:\Windows\System\SguHbVE.exe
  C:\Windows\System\SguHbVE.exe
  2⤵
  PID:9716
- C:\Windows\System\PLrZlbW.exe
  C:\Windows\System\PLrZlbW.exe
  2⤵
  PID:9732
- C:\Windows\System\bsjiurI.exe
  C:\Windows\System\bsjiurI.exe
  2⤵
  PID:9748
- C:\Windows\System\czJreFW.exe
  C:\Windows\System\czJreFW.exe
  2⤵
  PID:9764
- C:\Windows\System\Yipcgsq.exe
  C:\Windows\System\Yipcgsq.exe
  2⤵
  PID:9780
- C:\Windows\System\xbWnsQT.exe
  C:\Windows\System\xbWnsQT.exe
  2⤵
  PID:9796
- C:\Windows\System\puOrmlx.exe
  C:\Windows\System\puOrmlx.exe
  2⤵
  PID:9812
- C:\Windows\System\ZWvOttz.exe
  C:\Windows\System\ZWvOttz.exe
  2⤵
  PID:9828
- C:\Windows\System\XMTHuJx.exe
  C:\Windows\System\XMTHuJx.exe
  2⤵
  PID:9844
- C:\Windows\System\FYbuaLI.exe
  C:\Windows\System\FYbuaLI.exe
  2⤵
  PID:9860
- C:\Windows\System\NNHwNQj.exe
  C:\Windows\System\NNHwNQj.exe
  2⤵
  PID:9876
- C:\Windows\System\ZhwoFGH.exe
  C:\Windows\System\ZhwoFGH.exe
  2⤵
  PID:9892
- C:\Windows\System\toBtGQg.exe
  C:\Windows\System\toBtGQg.exe
  2⤵
  PID:9908
- C:\Windows\System\RRTxjyO.exe
  C:\Windows\System\RRTxjyO.exe
  2⤵
  PID:9924
- C:\Windows\System\kBtFgFf.exe
  C:\Windows\System\kBtFgFf.exe
  2⤵
  PID:9944
- C:\Windows\System\HBdLzXy.exe
  C:\Windows\System\HBdLzXy.exe
  2⤵
  PID:9960
- C:\Windows\System\YaLkXWc.exe
  C:\Windows\System\YaLkXWc.exe
  2⤵
  PID:9976
- C:\Windows\System\zhdpklN.exe
  C:\Windows\System\zhdpklN.exe
  2⤵
  PID:9996
- C:\Windows\System\ApcLSkR.exe
  C:\Windows\System\ApcLSkR.exe
  2⤵
  PID:10012
- C:\Windows\System\TbPVnzU.exe
  C:\Windows\System\TbPVnzU.exe
  2⤵
  PID:10028
- C:\Windows\System\PVuhdnm.exe
  C:\Windows\System\PVuhdnm.exe
  2⤵
  PID:10044
- C:\Windows\System\HTWjaSS.exe
  C:\Windows\System\HTWjaSS.exe
  2⤵
  PID:10060
- C:\Windows\System\ocekclq.exe
  C:\Windows\System\ocekclq.exe
  2⤵
  PID:10076
- C:\Windows\System\MvlTJTu.exe
  C:\Windows\System\MvlTJTu.exe
  2⤵
  PID:10092
- C:\Windows\System\xHVExkO.exe
  C:\Windows\System\xHVExkO.exe
  2⤵
  PID:10108
- C:\Windows\System\QOMeJOT.exe
  C:\Windows\System\QOMeJOT.exe
  2⤵
  PID:10124
- C:\Windows\System\guPhfuL.exe
  C:\Windows\System\guPhfuL.exe
  2⤵
  PID:10140
- C:\Windows\System\EGfOlVw.exe
  C:\Windows\System\EGfOlVw.exe
  2⤵
  PID:10156
- C:\Windows\System\MgblFfa.exe
  C:\Windows\System\MgblFfa.exe
  2⤵
  PID:10172
- C:\Windows\System\pclUtQA.exe
  C:\Windows\System\pclUtQA.exe
  2⤵
  PID:10188
- C:\Windows\System\NRKncdN.exe
  C:\Windows\System\NRKncdN.exe
  2⤵
  PID:10204
- C:\Windows\System\EHfQMMn.exe
  C:\Windows\System\EHfQMMn.exe
  2⤵
  PID:10220
- C:\Windows\System\XVriUHG.exe
  C:\Windows\System\XVriUHG.exe
  2⤵
  PID:10236
- C:\Windows\System\nuDktij.exe
  C:\Windows\System\nuDktij.exe
  2⤵
  PID:8672
- C:\Windows\System\oPKsrtU.exe
  C:\Windows\System\oPKsrtU.exe
  2⤵
  PID:9268
- C:\Windows\System\zPuwwet.exe
  C:\Windows\System\zPuwwet.exe
  2⤵
  PID:9316
- C:\Windows\System\EMMAecP.exe
  C:\Windows\System\EMMAecP.exe
  2⤵
  PID:9352
- C:\Windows\System\wFmlSIy.exe
  C:\Windows\System\wFmlSIy.exe
  2⤵
  PID:9412
- C:\Windows\System\kAhACCU.exe
  C:\Windows\System\kAhACCU.exe
  2⤵
  PID:9248
- C:\Windows\System\rjpfidB.exe
  C:\Windows\System\rjpfidB.exe
  2⤵
  PID:9548
- C:\Windows\System\cTesgYE.exe
  C:\Windows\System\cTesgYE.exe
  2⤵
  PID:8960
- C:\Windows\System\RXLPufM.exe
  C:\Windows\System\RXLPufM.exe
  2⤵
  PID:9528
- C:\Windows\System\cNIgIti.exe
  C:\Windows\System\cNIgIti.exe
  2⤵
  PID:9292
- C:\Windows\System\hQVnqlV.exe
  C:\Windows\System\hQVnqlV.exe
  2⤵
  PID:9400
- C:\Windows\System\CQHlxIv.exe
  C:\Windows\System\CQHlxIv.exe
  2⤵
  PID:9464
- C:\Windows\System\ICnbfJa.exe
  C:\Windows\System\ICnbfJa.exe
  2⤵
  PID:9544
- C:\Windows\System\kNBGHrV.exe
  C:\Windows\System\kNBGHrV.exe
  2⤵
  PID:9600
- C:\Windows\System\ObczkZN.exe
  C:\Windows\System\ObczkZN.exe
  2⤵
  PID:9660
- C:\Windows\System\FSnOnql.exe
  C:\Windows\System\FSnOnql.exe
  2⤵
  PID:9724
- C:\Windows\System\YMgdoyV.exe
  C:\Windows\System\YMgdoyV.exe
  2⤵
  PID:9788
- C:\Windows\System\XDJIgfq.exe
  C:\Windows\System\XDJIgfq.exe
  2⤵
  PID:9884
- C:\Windows\System\SCLbbZM.exe
  C:\Windows\System\SCLbbZM.exe
  2⤵
  PID:9888
- C:\Windows\System\blGWrnN.exe
  C:\Windows\System\blGWrnN.exe
  2⤵
  PID:9984
- C:\Windows\System\FZIYaZr.exe
  C:\Windows\System\FZIYaZr.exe
  2⤵
  PID:10020
- C:\Windows\System\GtiviQI.exe
  C:\Windows\System\GtiviQI.exe
  2⤵
  PID:9712
- C:\Windows\System\eJoyYyO.exe
  C:\Windows\System\eJoyYyO.exe
  2⤵
  PID:10084
- C:\Windows\System\WEHLmfl.exe
  C:\Windows\System\WEHLmfl.exe
  2⤵
  PID:10148
- C:\Windows\System\hHfOZzs.exe
  C:\Windows\System\hHfOZzs.exe
  2⤵
  PID:10212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CcLvdBx.exe

Filesize
3.0MB

MD5
5d1891ab84a86dc611079b0cc4bc80b2

SHA1
090d1ea4f3dc0a40ccd2e9470326c29d0fca2dc7

SHA256
3bc08aefc7de06fbd6f6cc2640086bf96931a67935eb0b655f3c4df6cf8296fc

SHA512
623b5495215c4f9562202899f7939d86d80d976951a05017f99731260072ab997ede94124dc2e286bfbb5f2fe0228584eb6c2289449f23905d78f0a3def58432

Download Submit
C:\Windows\system\FhiZJOU.exe

Filesize
3.0MB

MD5
af01c14478db6ff92f4e62a54250f7df

SHA1
cba0b049d322cb42df69950502795b46ed50c477

SHA256
faeeca7afa954cd0ae3c2ae3ac36c57c8e11fdf9369cef2a5c54350f246e6078

SHA512
d93c60ce13f03ed8af8c1fb08571c7cf2cb1efb120a98d190a722ab3000ea6898472efbbcfbadcad01ee5523333f9840d69ae5d3ccf7f7e574c26ba60c97b770

Download Submit
C:\Windows\system\GXULOAj.exe

Filesize
3.0MB

MD5
ba01d5b08594a547b4def297ad6d1e59

SHA1
4eb68fefdff1aee4ef5f000b4d4556944d22364f

SHA256
6ed3eca141fd620949fa573ca7642db4fdb20d98cd1dd5d0089278c20bafd09a

SHA512
da80c05aecbf170c83b6fe3ed4011b370d2143767676c4afa965ab57ea5d45c932e17a37a4bbecfe2a31824f53c74d54d5615145abd46999c7e5962004e6d209

Download Submit
C:\Windows\system\KcHObkJ.exe

Filesize
3.0MB

MD5
5d62c76bb876cf66bdd46fe46bbda7e5

SHA1
d844cadef17f57b86e86855562fcea16303da524

SHA256
05ddc787cc239d4673b4d7a60d9575b29e3c9af2620ba530ab9fce6290b1b269

SHA512
0236ddb51204764e7541e1aaf13168da2d9ee50d7df867d70f0fda5ddc8185cdc0fa23cab61ac390fce7ac1301a35184def09f9b033ba6d4f5282d57cfee95fc

Download Submit
C:\Windows\system\KjHExPk.exe

Filesize
3.0MB

MD5
61f278bd0add512b7b50faf5d20d6f35

SHA1
ac9181921e0fc8971ad9922a6a77d1b0ec1ec83e

SHA256
2672f15f376356518a2747649ba06b7590a26622f5bd076cbb668a6c4fa8d8e7

SHA512
9e62e3c7109a5a40579666b2371e3288376765a1e2f59deb7f68c460aea331496e002411bf179de5bc091fe11d8d2398268da0efdc714cc7390a5b3f8919c247

Download Submit
C:\Windows\system\LRbDBdj.exe

Filesize
3.0MB

MD5
c2f0a49020a2611ef0d83f3f0ac6a6b1

SHA1
6749c170719727687a815c0680e6b4bf9441e891

SHA256
d0ea8c424b1a3e32ddcc17d0ca716003361714c0856ff44c042f74091e3e4d97

SHA512
ef2ca55516292c8809e53d8f6eac51a9f45ca9376a757316bfe982fb05efdb35e29af8b762708b04c96b7165ac6a99df4ad03b36c23ea4766fadb2f71b5ddac6

Download Submit
C:\Windows\system\MFPkUrx.exe

Filesize
3.0MB

MD5
34560b53c8dc1a75214d95632ed3887b

SHA1
6a667b2a6fa996d3ace021d0c9b9b2f1d9f4bf65

SHA256
a478cfbb6b7686f2522ac168cd6336e845470ed18f6a68a6c43a534adfbe302d

SHA512
513c0491433f201819b51e32da552f1f3889cc7de091619c4f8b47e436d6e178f8c66126a8f2b8b954fa1f1ca0b68745d1f3d874bff772006a313b0099e938ef

Download Submit
C:\Windows\system\OGflcib.exe

Filesize
3.0MB

MD5
42f1718f34a2ce89f94936af9bf62bc3

SHA1
fd42c915c68b05ffe9a435e72b538845beb4b3d4

SHA256
56b14f17026513ccee6a150417c9cebc6d297301f5dfe250a024977e4772604d

SHA512
e6e9a5b387cd2a219b905d369af317b00a22028cd14df02a4c6017e22e880df3b81d1aca90e17d809dc59f9a6feba08c2a282accd1f56139bd06a9be113593d2

Download Submit
C:\Windows\system\PmsOTMS.exe

Filesize
1.6MB

MD5
81d4d5d084f2338fcab1c1e236092bb3

SHA1
ee0b958744bb2fd528f1aa07609f1f9854820f7a

SHA256
3742b9beb6804ddb5b5635936966540b5e0948346c1efd3b6b4617c3d434181e

SHA512
2f1ee474ed548c818e4158ecbf211a45f39660ae74934d94f499b49d9b783a7d95fc08f967e7162374901354af5dfd6e85a76c2c7ac54b2be707a0efa67c0541

Download Submit
C:\Windows\system\QrBzRLt.exe

Filesize
3.0MB

MD5
28fac95c3ecfaecd0ef7ef6edb7ccbd9

SHA1
14f540ac61b4b2e8eb4510f718ddb603ce46fb11

SHA256
38fc89f411b5759ca60b58975b769d79e840d7ddc27157b5e428b7270366ef75

SHA512
380362b10ce96f392fe53830fcafcb7d9157e4e075352d49ba174ed5edb07a30891055cd6672f3d865b516748ca274341e5dead2d92fd46cc977b64ddbabc75f

Download Submit
C:\Windows\system\SaVNOkg.exe

Filesize
2.8MB

MD5
132a2f99ca817e15b2b5a46daa27896c

SHA1
729038941ceb44b4aa51a53834439c9fe0115d31

SHA256
d7fa2012ed9e7830951ecc3d24591cb9da44c7d26062bee6227aa07124197588

SHA512
a12c9eeb17d6b106acddca89364a2783abd93932ed24c1a69b10eb7aa290c13820a1ef2e61dcbec9a3b3a9e5d586c1f2c5a50162d5a6e4f5390aeb19af0a27d2

Download Submit
C:\Windows\system\TBeIsYj.exe

Filesize
3.0MB

MD5
48b26d0485f843af6a03eebed190c3e6

SHA1
6ba47b72442967f154710a711ec924189c862c60

SHA256
0de239384d7d9d00b67bc6168ba1fa53153bf90536fdbe69bcc1b68abf18f81d

SHA512
082dbdb3a651c253765a7dbded09f120c74f54c576fe999dc407aee85f3fb21525587669ada6aefc3107d3e1d8b7012e39db5abeeb0762c56e1b9af273e27232

Download Submit
C:\Windows\system\ZLAaoqX.exe

Filesize
3.0MB

MD5
b7eee0fa1e97e723ca54a4e8268f1b41

SHA1
8f02f32395fd32f768abeff7bbb2ebbfab0ec8fe

SHA256
a49b41debd6295c2eaa19ba328db341d62c3cc93e18ebaaf00c1d0f006c47c02

SHA512
f29445298db7febba5283362a23f6f085e3999c3f031d88b31d985ed53801c416f7a0d71e44e0d49ef9c1940caf7b7473d66ca30b6d563b7a7ade02ea61b49d6

Download Submit
C:\Windows\system\csKCVuQ.exe

Filesize
3.0MB

MD5
684d6b650cd16d961fd78056997bb018

SHA1
6aee09c8ab77faa074f91ef56bd64bedb604c01f

SHA256
e86175148bfa93a688f138483d63c07d3f79847b4cc7cba77a65f33fe897e28a

SHA512
161bd3abc584ad461ed220f81743807e32ab574a66a5693e96c6142e4365cf3061464e792946961889308c451335babeb87858bb441572134e335d539c9f021d

Download Submit
C:\Windows\system\eKjsjLn.exe

Filesize
3.0MB

MD5
37690536dcf3c1b8a74868cbb1858b4c

SHA1
c02b3dbde6010e9d5f61a85815d2ebe72ad34c10

SHA256
538df8c22dfe5ee42bcc1d96183fbe3625a28c745b7f0a1025d72300bcbedc2a

SHA512
489c68b3cce441366dc3743d0c8d060017ab8f284f43c1e03a0b2439601fff8a02e0ac80776d5a7cb29affd915f9fe7531dd81898cea97967fd27a0654b014eb

Download Submit
C:\Windows\system\iVeYRxI.exe

Filesize
8B

MD5
2f610ed4fd34c7b93dede1793521baba

SHA1
5daae5f3b2625b6a326bfb1be39046cb371fc4a6

SHA256
d587df361f44238ccf5a60428309780a9b6bde224606e4679c94364299985684

SHA512
367244af67370594aa8df8799be42b55afcd8abd950bf66980b9cb155b499d06ebcadc359f153586f1736d1a5dd7bea12b69a39d93e67441419399282c1888bb

Download Submit
C:\Windows\system\kYgELkk.exe

Filesize
3.0MB

MD5
0496f52b8af67f5231362c85092dd03a

SHA1
4469a4e996fd388a78cf250c13a823afe7886af4

SHA256
db7902ca3c39666c10defb1f679705cc7e8d99e5c76d7f4ff48f65aaccf6e58f

SHA512
580362df3ad4dc1ce8f34de28c1824ba6e1946ff33b1c8136a5a1e5903153c74fab58d6e4e26333037b1ea2c84d98076669cfd0c200d07062b418540d1679d70

Download Submit
C:\Windows\system\rtmkACc.exe

Filesize
3.0MB

MD5
b4572951e3c48030fc0981c84c791e40

SHA1
1db1ff13e261538bc0a036b1300c05efe2e574e9

SHA256
a391f678f2bac9608b42497ef2ac92da7e41b81a7ab4df3fc0ad40de35ac5816

SHA512
93208198b22822cd661e20ea4d0f61247d5a75f3f89be7bb61adffb853040802de79e6a85331cafb05cb9921a2f1fb92c1146cb3e77694a73eae8c772f5b3250

Download Submit
C:\Windows\system\stnfuvH.exe

Filesize
3.0MB

MD5
0a5c58802265c947cbac6e0c612ec57d

SHA1
fade2dde18a64d8f9c7b37e55e1aaa2b4cde8a46

SHA256
b1a75842bd3e19632776aa8a9976069e463bc82c1a460c5a494fadfdba628a15

SHA512
c7f046796163ae64d0a73f9ffa3b8a1bbe79945c6de40988a7378100cb77d2daaab0f3707b31dd5054b3c15ddf21c00248fbdc62442b06dafacec8a94fe546f4

Download Submit
C:\Windows\system\vDXGOfd.exe

Filesize
3.0MB

MD5
0db53458e7f5f189a7c45c243c8ab8cf

SHA1
e236fff37aa1c6166befdf7009c2ac38b145f168

SHA256
ec48f6c6889a3c861663fef242a83050a676519bece88005e6ac30688fed3f41

SHA512
3d61ea30751450e5de0b66d7f8545a8175ab4fb28d680a339ff84cc5101e08a15528545e34e3fed7d71763d0a05ac8873dc0944dd6c366121a87fa2737ef6427

Download Submit
C:\Windows\system\vVmuUXA.exe

Filesize
3.0MB

MD5
e1e090a5204c9cfee6bcfaf190d0f964

SHA1
c890d81a2e52c0dee142878b76d03224a1518068

SHA256
07e03820893c724138f7f6a6b6620a518af18e3a56a6cc73bade04b2263ef2e5

SHA512
8e1278f52befe1396d02225c1736940677e539d06ee6d8bf2312e061487e38679c2e0c91b4b91b7cdefcaa2fd6bf97868ed368ef193cdbc72f7bd5ce53184aff

Download Submit
C:\Windows\system\wNsoHjs.exe

Filesize
1.1MB

MD5
a978c66280810bbe4171fd9248b29e22

SHA1
4af77bf15d85231e85da7adf8e27706a4f58548c

SHA256
ac6c85ac628af7426e6bd9501236d83a2eadea5db4484e86cf28455b6782228e

SHA512
528c2ea75da4e53440719ac4b504365f37103af2407f8ceacc03e90fb3dda9387ca23f9e734471fa0e1e8ab7966df8da444371708898287c00a441ff97e5e33a

Download Submit
C:\Windows\system\wklCoyl.exe

Filesize
3.0MB

MD5
cef21855ca30472096e7a22dd3de6873

SHA1
7c21cddac8db3e91ef28836ce103495132ce8b5d

SHA256
e2d2181aaef2fd50c8541275a227420d4a85eb1b056ca5e75243db7da049a888

SHA512
6c31ef316e21f6a2ca1db0c81646adc93946a00b148f67e8148add07517c27d221af351c71ffdaf8545ae284b64de7b299f378ecbdd2ced54f077c1ac3c2c1dc

Download Submit
C:\Windows\system\xzGtKva.exe

Filesize
3.0MB

MD5
156b42ca4251ae71d341b022b8f09d43

SHA1
1d7efe6ce196c7f6a41e36b5be7e3bb741eacaa5

SHA256
97d1ed6516910f373e3062a230b3077485d7ec08259e7881963f41a2e3526b0b

SHA512
0aeca9aa856de52b8c16e90d22d05059682c38e9556561f81bca0b6cc3cfbf484850ba7483842be62ed02cbc3d0229292aab7c41e3e7129b81607e0b24e5373f

Download Submit
\Windows\system\AnjiLlh.exe

Filesize
3.0MB

MD5
a1a8bee75babd9b92fb0e74a84724739

SHA1
58803d49b5df075bc177db1c0c1eb7161aee0f76

SHA256
a4feeb5fdf98f151fc56d8d59335bf562f8681a6ef656752786525026a4a4671

SHA512
604b130e7dd8e6a73780ae53e656555308b52872101004a1cb0cec89718f722bfc1713f7c83b67fe5794e1ebdae60b439787be1c097996d9cfe9f809c7f96f34

Download Submit
\Windows\system\IeyIwnL.exe

Filesize
3.0MB

MD5
9cf168d970055def117c58933d026a3d

SHA1
26b30a86b15b25dceb37a792d45c7980e3cc9bfc

SHA256
8b96ae3c8b3d08be382f6e814953edadb2f95842d047e99976f364d80c547feb

SHA512
ce9b9400626deaec6117192d068716fae515518aa64ff3edd68cdc19918dc7a33823895b343e8eadd1bf17abf97a69d38a4a30b4f89292e65161073b2e8fa3d5

Download Submit
\Windows\system\PmsOTMS.exe

Filesize
3.0MB

MD5
0eb7bac4ef6020f46dae6532e699cdaf

SHA1
84437759bd99add1f8268e5bcf4dc874e8960eff

SHA256
5604ede8eb6aeadb5de0578fa6ec4706a19d0815b16c213ced10ed17ed4b12f7

SHA512
67a2a898b6dec36721cd699c55828b233dce04a46e935d38cddf11b223cda86a9765483ecae871ac6401e47029a2ca27d5cd74a25c42453aab4ab66d7f39e190

Download Submit
\Windows\system\SHMlkRQ.exe

Filesize
3.0MB

MD5
ff48eebf004ac69204b64a17a5791c73

SHA1
138306810d160edcff70f0683734a1dd8c6ea520

SHA256
cd37ab747f78a89babff63febc944521fda3d6d4fc06990bd32c91b72ee30bd5

SHA512
bde9c2631096dde1d1845a0bafaaab998b03c3409aecd31ee6973ec83fdefef8667dc9b743b86d3fb2f647a60279dd75f6496d2b89cc813d7c332d37c4fc5cb8

Download Submit
\Windows\system\SaVNOkg.exe

Filesize
2.2MB

MD5
18ce87d9b8ae56a89da30e504c16e42f

SHA1
c425c8b362d46d3bd9c420b33e595d4cd4fbc55a

SHA256
ab376b12f4e637196ad06b166da76879c46b7a4243d2055ba338eabec900f2f5

SHA512
453abbc0d5b75d571273f19f1ce85a1ca2772e50d837988cadaec376235a8abfefae69c46a9141ab2b6501a5045bcaba56ee76d29c6327c5659154618cec7479

Download Submit
\Windows\system\cgZEOuz.exe

Filesize
3.0MB

MD5
f8a95d599fcd9bef0cdb72aaf236e0ac

SHA1
be3eb5ccad78c39a671159515e5b134a13abe078

SHA256
a3662a5fc5008f44eda64032e7d9c66522396ee8ddd58503d1e957a3fd1a6618

SHA512
aae7f693db4cacda182654cbb041716d6e62d17ee2739ec6a58ece53691ddb3b7eaa2fb1000af4f1d629083de146bfe2140248fa7b27fa2841832cb7fc8d1904

Download Submit
\Windows\system\juoXbeu.exe

Filesize
3.0MB

MD5
646f0e793ec739a07a2220913fadff53

SHA1
c60bc714b11e7faf078a82bd59572ba8a08e1bff

SHA256
5e41b87ce12f48b70e5f6c8c67523f7cb6d7c71779cf28ed77c04fbbe2f65ee8

SHA512
1c6bdc47b519c3854116e62e1a318dcfa7f0dad946b70882e99664f03b63adf949a711b6790e33c1ee12c6fb611033f28852d9cc7aee07d85ab89198c17adaa7

Download Submit
\Windows\system\kYgELkk.exe

Filesize
1.8MB

MD5
94b474923515af9437cf8395634eeab0

SHA1
d3ba32e622da731dc7c330fa86a98a33f984b596

SHA256
2652ec49f8647096e9b3fe97520b65c4db569f1b14dbf2b81e8a820ea2e49b97

SHA512
ea5051d4288c6666e5d780aba4aebe52c0b81ce210b3f4a279efffed7c46b423393c54905daa4e1e9c1d1b1ca61fc2a8398a8a3dff3b2b06c499ac6cfebca31f

Download Submit
\Windows\system\mubempN.exe

Filesize
3.0MB

MD5
9b14ee2ecafdb5f34f0e0720f9fc3225

SHA1
b0e54f6c375fb85dbbb71f0a26b1df17067e699f

SHA256
db6fded4680dc2e515b76fccae1f2c90b4155f587594dd7855af980068457dfd

SHA512
37b9ea2cb87e40d60ba87844e56adda037eb5371cb67a2d98ac399094131279ec3c09b7ff713b80c28033941f3de8c9cf6b68dba0b750a3639e0f9788aa4e231

Download Submit
\Windows\system\otKSOdr.exe

Filesize
3.0MB

MD5
daea63d27facbb1a5c974415769fa6f1

SHA1
fae528469adb7fe7d012d04b8b911d918b086ad2

SHA256
c6f20ed5b224cf0a55643b0598d33d7661aa07db91fddbfedec70787d2da5b6a

SHA512
7074427bfb734387670c5407fa216934b08e24a36293f175ff9a03a803c3fc590a722aeb5b890095ad36b0f56f4dc5f44ed082a1fed93797a70ff9008f8cf4c5

Download Submit
\Windows\system\smxpJkJ.exe

Filesize
3.0MB

MD5
451ec26566e3cf38ac07f366a098c7ae

SHA1
8b4be6a9de1db426fbb364a5c39f7556e4871a79

SHA256
ee2373a524344705c05d2d99f012033eea80e009ae79f2f61deb97e155fde254

SHA512
cb1dd467dc706a867b57dbde8a40a304f54a90e8a9dfadd3df884b47eb8fd8b9c80b049d1c645fbe5ae04bda951e2f146c1abbdc603a8f962cd205dd5a7a897a

Download Submit
\Windows\system\wNsoHjs.exe

Filesize
3.0MB

MD5
5e81164ee333f895aefdcd8059b091f1

SHA1
a900d8ec4ef6967a58528ecbc517aae03b02ee47

SHA256
89ce620c530c7cce71a7351b5f9c7ebc582b3bb839d187f366d98306a5a895a3

SHA512
697ca910f9f119eea6cfab4e130777eaecfe9f5a8369973c1c61273d315aaba6b6523e01221b87f33972d374efcf9600cc58813421601da6a93204c4dc08628e

Download Submit
\Windows\system\xpeVauA.exe

Filesize
3.0MB

MD5
d709f224e6bfd369bfbcc03c4dd0c8dc

SHA1
d203d7663a777f2d2b3a05f57630e89637018e40

SHA256
0b74a9fd8ae365182ddb0ca8f0be28d58d448f881fc9e5a61ac49baea6900b21

SHA512
b7aeeb92da33cee7a6717848bc1992d4a9d36c8ee2005024eb9c16f0ebd677b753b45e036825789fc2934b7721989d76bc58fd2fd6fcaf21fa5d079d9db0ab53

Download Submit
memory/2144-18-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-147-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2144-140-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2144-152-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-162-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-12001-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-137-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-159-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2144-158-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2144-6-0x0000000002DE0000-0x00000000031D2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-127-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-161-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-11696-0x00000000030B0000-0x00000000034A2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-129-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2144-156-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2180-5526-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2180-134-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2184-5538-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-153-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-5543-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2352-148-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2428-5531-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2428-139-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2436-5542-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2436-128-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2520-8-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5528-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2532-145-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2644-157-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2644-5539-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2736-126-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-5529-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-21-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp

Filesize
4KB

Download
memory/2744-57-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2744-20-0x0000000002990000-0x0000000002A10000-memory.dmp

Filesize
512KB

Download
memory/2744-70-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2744-124-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2744-135-0x0000000002994000-0x0000000002997000-memory.dmp

Filesize
12KB

Download
memory/2744-138-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2748-5537-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2748-160-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2836-19-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2836-5536-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download