xmrig | 761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49

Analysis

max time kernel
150s
max time network
91s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28-07-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
Size

2.2MB
MD5

03c113b2dc2ebd2e7014fbd723bdad45
SHA1

a0524d7f3c77dd8ea6ba60f831272bd676de93b4
SHA256

761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49
SHA512

f781b4a673edc11f64446e7f56f64e89c8cd59a18dd51cd6810b195e028390d53490517c48a53806d05d3f085ba39ec44eda34f6e1c896a48539cf346b8b3ae2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cw+:NABF

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2112-10-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2700-55-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2920-64-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2836-52-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2848-61-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/3040-146-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2008-102-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2748-68-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2136-141-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2864-58-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2360-1659-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/3040-3987-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2136-3983-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2700-3982-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2748-3981-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2008-5274-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2864-5276-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2920-5278-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2848-5342-0x000000013F420000-0x000000013F812000-memory.dmp	xmrig
behavioral1/memory/2832-5344-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2836-5350-0x000000013FD50000-0x0000000140142000-memory.dmp	xmrig
behavioral1/memory/2112-5349-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2360-8858-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2052	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2112	OPefVEd.exe
2832	JWQxqml.exe
2836	ydMwMKM.exe
2700	XIFtBZi.exe
2864	oRjZHRB.exe
2848	XwLzYLK.exe
2920	CUctpUF.exe
2748	LCxnMEl.exe
2008	IezzPqK.exe
2136	GIYhEuW.exe
3040	EzwNyIC.exe
2156	Muguxtn.exe
2712	dmuJqaY.exe
2632	JrtWTha.exe
1328	ahQuzHP.exe
2116	iLPLDkz.exe
2532	BZceLtV.exe
1944	FUWykPY.exe
2464	iZlraGx.exe
1804	pdVBCQm.exe
1708	KlGWqco.exe
2004	kmJEHtt.exe
1332	UrBYFwE.exe
2376	MafNxLX.exe
2284	VGftAjo.exe
2044	BNXxmkz.exe
2992	HIpKnYT.exe
1184	AHzUdOG.exe
2420	vFzWifz.exe
2424	BxsbhGR.exe
2072	OhGWXhK.exe
1252	BCprkxj.exe
884	CHHgUge.exe
780	ZBzEncE.exe
2908	EKmCxge.exe
1100	CHKPcIP.exe
1784	avxWXId.exe
1632	blRYBOX.exe
1728	ifwgJGQ.exe
1760	kQTyJgw.exe
1012	xresgxf.exe
804	RaOKNtr.exe
896	moRviUO.exe
2628	CNIVXGA.exe
2076	azxBQLE.exe
2648	dZScaUA.exe
560	hJTOXUT.exe
2756	VMtVbBK.exe
2296	PeEJAsB.exe
1696	wsbswtR.exe
2204	XGaFkrZ.exe
2860	nZewOkm.exe
1604	uXdHluM.exe
2428	EJcENud.exe
2952	DwJmBfV.exe
2828	jAPNLHa.exe
2708	GaPZhkr.exe
2668	ENWHcmI.exe
1656	qUlmCos.exe
2728	IvAdROo.exe
2396	TCHjQFU.exe
2256	MGiLEHb.exe
2936	xHiuLnR.exe
1920	nCUHxeJ.exe

Loads dropped DLL 64 IoCs

pid	Process
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-0-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-6.dat	upx
behavioral1/memory/2112-10-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0009000000016433-14.dat	upx
behavioral1/files/0x000f00000000549c-25.dat	upx
behavioral1/files/0x00080000000167b4-34.dat	upx
behavioral1/files/0x0007000000016a93-37.dat	upx
behavioral1/files/0x0007000000016c51-46.dat	upx
behavioral1/files/0x0007000000016c49-42.dat	upx
behavioral1/files/0x000800000001659d-29.dat	upx
behavioral1/memory/2700-55-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2920-64-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2836-52-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2848-61-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/files/0x000500000001961b-163.dat	upx
behavioral1/files/0x000500000001960d-191.dat	upx
behavioral1/files/0x0037000000015fd2-173.dat	upx
behavioral1/files/0x000500000001961d-166.dat	upx
behavioral1/files/0x0005000000019619-160.dat	upx
behavioral1/files/0x0005000000019613-152.dat	upx
behavioral1/memory/3040-146-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/files/0x0005000000019609-130.dat	upx
behavioral1/files/0x0005000000019585-125.dat	upx
behavioral1/files/0x00050000000195d8-122.dat	upx
behavioral1/files/0x00050000000194f7-115.dat	upx
behavioral1/files/0x000500000001950b-114.dat	upx
behavioral1/files/0x00050000000193c5-82.dat	upx
behavioral1/files/0x000500000001945a-186.dat	upx
behavioral1/files/0x0005000000019427-184.dat	upx
behavioral1/files/0x0005000000019409-182.dat	upx
behavioral1/files/0x000500000001961e-177.dat	upx
behavioral1/memory/2008-102-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2748-68-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0005000000019615-158.dat	upx
behavioral1/files/0x000500000001960f-149.dat	upx
behavioral1/memory/2136-141-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x000500000001960b-138.dat	upx
behavioral1/files/0x0005000000019607-137.dat	upx
behavioral1/files/0x0005000000019452-105.dat	upx
behavioral1/files/0x000500000001940b-96.dat	upx
behavioral1/files/0x00050000000193df-87.dat	upx
behavioral1/files/0x00050000000193bb-80.dat	upx
behavioral1/files/0x0009000000016c5a-72.dat	upx
behavioral1/memory/2864-58-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2832-19-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2360-1659-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/3040-3987-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2136-3983-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2700-3982-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2748-3981-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2008-5274-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2864-5276-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2920-5278-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2848-5342-0x000000013F420000-0x000000013F812000-memory.dmp	upx
behavioral1/memory/2832-5344-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2836-5350-0x000000013FD50000-0x0000000140142000-memory.dmp	upx
behavioral1/memory/2112-5349-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2360-8858-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zJorUBl.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\odPcxaT.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\FsQtgka.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\IsUVLok.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\RRaZuOx.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\gIFgcEX.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\eCfLPbD.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\JckqAeC.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\oMYESsD.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\mApLckc.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\GbhIDGK.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\LnYhWYe.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\jSPEPnZ.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\tODUyUq.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\JtlzxXE.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\BdQpQpn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\UyUzMFB.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\wfaBnbK.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\DYlfuZr.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\bxkGSYm.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\LTEMthN.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\WiCXFjD.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\CVVgBQh.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\DoLjHtI.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\YQVLzkq.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\pcIshKV.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\NxeHCED.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\tiknDPJ.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\XFMjVLv.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\PKrWDGs.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\BMqXNwH.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\PTkmvcw.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\RNQYDAO.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\UmmogkD.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\vcGNJVe.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\nIPSjgo.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\LTIhgEw.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\CKgECTL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\tzRyQyl.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\qNJGriE.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\dUcoJqL.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\tGOEPhg.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\xtxwsic.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ZThsaTm.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\oZTtyZt.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\CoxdHAg.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\QAQFMgR.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\rPeGJiM.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\FnSJEvF.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\HKbsplE.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ntEYykX.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\yIEDhrh.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\YKQdgZM.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\vAhLaEW.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\ssLxscn.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\RiZvubt.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\gljuXFi.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\iBsAcWI.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\nGgSJyA.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\EXShzaW.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\cBZlOIi.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\XJvLqlY.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\GOlBfnm.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
File created	C:\Windows\System\LmpccDY.exe	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
Token: SeDebugPrivilege	2052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2052	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2052	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2052	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	31
PID 2360 wrote to memory of 2112	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2112	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2112	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2832	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2832	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2832	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	33
PID 2360 wrote to memory of 2836	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2836	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2836	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	34
PID 2360 wrote to memory of 2700	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2700	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2700	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	35
PID 2360 wrote to memory of 2864	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2864	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2864	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	36
PID 2360 wrote to memory of 2848	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2848	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2848	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	37
PID 2360 wrote to memory of 2920	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2920	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2920	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	38
PID 2360 wrote to memory of 2748	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2748	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2748	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	39
PID 2360 wrote to memory of 2008	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2008	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	40
PID 2360 wrote to memory of 2008	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	40
PID 2360 wrote to memory of 1708	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	41
PID 2360 wrote to memory of 1708	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	41
PID 2360 wrote to memory of 1708	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	41
PID 2360 wrote to memory of 2136	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2136	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	42
PID 2360 wrote to memory of 2136	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	42
PID 2360 wrote to memory of 1332	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	43
PID 2360 wrote to memory of 1332	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	43
PID 2360 wrote to memory of 1332	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	43
PID 2360 wrote to memory of 3040	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	44
PID 2360 wrote to memory of 3040	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	44
PID 2360 wrote to memory of 3040	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	44
PID 2360 wrote to memory of 2376	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2376	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2376	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	45
PID 2360 wrote to memory of 2156	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2156	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2156	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	46
PID 2360 wrote to memory of 2284	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2284	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2284	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	47
PID 2360 wrote to memory of 2712	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2712	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2712	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	48
PID 2360 wrote to memory of 2044	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2044	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2044	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	49
PID 2360 wrote to memory of 2632	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	50
PID 2360 wrote to memory of 2632	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	50
PID 2360 wrote to memory of 2632	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	50
PID 2360 wrote to memory of 2992	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	51
PID 2360 wrote to memory of 2992	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	51
PID 2360 wrote to memory of 2992	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	51
PID 2360 wrote to memory of 1328	2360	03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System\OPefVEd.exe
  C:\Windows\System\OPefVEd.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\JWQxqml.exe
  C:\Windows\System\JWQxqml.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ydMwMKM.exe
  C:\Windows\System\ydMwMKM.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\XIFtBZi.exe
  C:\Windows\System\XIFtBZi.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\oRjZHRB.exe
  C:\Windows\System\oRjZHRB.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\XwLzYLK.exe
  C:\Windows\System\XwLzYLK.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\CUctpUF.exe
  C:\Windows\System\CUctpUF.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\LCxnMEl.exe
  C:\Windows\System\LCxnMEl.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\IezzPqK.exe
  C:\Windows\System\IezzPqK.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\KlGWqco.exe
  C:\Windows\System\KlGWqco.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\GIYhEuW.exe
  C:\Windows\System\GIYhEuW.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\UrBYFwE.exe
  C:\Windows\System\UrBYFwE.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\EzwNyIC.exe
  C:\Windows\System\EzwNyIC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\MafNxLX.exe
  C:\Windows\System\MafNxLX.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\Muguxtn.exe
  C:\Windows\System\Muguxtn.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\VGftAjo.exe
  C:\Windows\System\VGftAjo.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\dmuJqaY.exe
  C:\Windows\System\dmuJqaY.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\BNXxmkz.exe
  C:\Windows\System\BNXxmkz.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\JrtWTha.exe
  C:\Windows\System\JrtWTha.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\HIpKnYT.exe
  C:\Windows\System\HIpKnYT.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ahQuzHP.exe
  C:\Windows\System\ahQuzHP.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\AHzUdOG.exe
  C:\Windows\System\AHzUdOG.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\iLPLDkz.exe
  C:\Windows\System\iLPLDkz.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\vFzWifz.exe
  C:\Windows\System\vFzWifz.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\BZceLtV.exe
  C:\Windows\System\BZceLtV.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\BxsbhGR.exe
  C:\Windows\System\BxsbhGR.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\FUWykPY.exe
  C:\Windows\System\FUWykPY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\OhGWXhK.exe
  C:\Windows\System\OhGWXhK.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\iZlraGx.exe
  C:\Windows\System\iZlraGx.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\BCprkxj.exe
  C:\Windows\System\BCprkxj.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\pdVBCQm.exe
  C:\Windows\System\pdVBCQm.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\CHHgUge.exe
  C:\Windows\System\CHHgUge.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\kmJEHtt.exe
  C:\Windows\System\kmJEHtt.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ZBzEncE.exe
  C:\Windows\System\ZBzEncE.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\EKmCxge.exe
  C:\Windows\System\EKmCxge.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\CHKPcIP.exe
  C:\Windows\System\CHKPcIP.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\avxWXId.exe
  C:\Windows\System\avxWXId.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\blRYBOX.exe
  C:\Windows\System\blRYBOX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ifwgJGQ.exe
  C:\Windows\System\ifwgJGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\kQTyJgw.exe
  C:\Windows\System\kQTyJgw.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\xresgxf.exe
  C:\Windows\System\xresgxf.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\RaOKNtr.exe
  C:\Windows\System\RaOKNtr.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\moRviUO.exe
  C:\Windows\System\moRviUO.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\CNIVXGA.exe
  C:\Windows\System\CNIVXGA.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\azxBQLE.exe
  C:\Windows\System\azxBQLE.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\hJTOXUT.exe
  C:\Windows\System\hJTOXUT.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\dZScaUA.exe
  C:\Windows\System\dZScaUA.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\VMtVbBK.exe
  C:\Windows\System\VMtVbBK.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\PeEJAsB.exe
  C:\Windows\System\PeEJAsB.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\wsbswtR.exe
  C:\Windows\System\wsbswtR.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\XGaFkrZ.exe
  C:\Windows\System\XGaFkrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\nZewOkm.exe
  C:\Windows\System\nZewOkm.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\uXdHluM.exe
  C:\Windows\System\uXdHluM.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\EJcENud.exe
  C:\Windows\System\EJcENud.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\DwJmBfV.exe
  C:\Windows\System\DwJmBfV.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\jAPNLHa.exe
  C:\Windows\System\jAPNLHa.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\GaPZhkr.exe
  C:\Windows\System\GaPZhkr.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ENWHcmI.exe
  C:\Windows\System\ENWHcmI.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\qUlmCos.exe
  C:\Windows\System\qUlmCos.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\IvAdROo.exe
  C:\Windows\System\IvAdROo.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\TCHjQFU.exe
  C:\Windows\System\TCHjQFU.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\MGiLEHb.exe
  C:\Windows\System\MGiLEHb.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\xHiuLnR.exe
  C:\Windows\System\xHiuLnR.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\nCUHxeJ.exe
  C:\Windows\System\nCUHxeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\RZvMuZk.exe
  C:\Windows\System\RZvMuZk.exe
  2⤵
  PID:2988
- C:\Windows\System\pndVquL.exe
  C:\Windows\System\pndVquL.exe
  2⤵
  PID:2840
- C:\Windows\System\qmYluuk.exe
  C:\Windows\System\qmYluuk.exe
  2⤵
  PID:1908
- C:\Windows\System\tGOEPhg.exe
  C:\Windows\System\tGOEPhg.exe
  2⤵
  PID:708
- C:\Windows\System\frVsrUU.exe
  C:\Windows\System\frVsrUU.exe
  2⤵
  PID:1600
- C:\Windows\System\UdSQyMR.exe
  C:\Windows\System\UdSQyMR.exe
  2⤵
  PID:320
- C:\Windows\System\lxPCgKJ.exe
  C:\Windows\System\lxPCgKJ.exe
  2⤵
  PID:2516
- C:\Windows\System\yXnJpIN.exe
  C:\Windows\System\yXnJpIN.exe
  2⤵
  PID:1628
- C:\Windows\System\DqJZrRQ.exe
  C:\Windows\System\DqJZrRQ.exe
  2⤵
  PID:2956
- C:\Windows\System\tbWluFj.exe
  C:\Windows\System\tbWluFj.exe
  2⤵
  PID:2276
- C:\Windows\System\nuABPey.exe
  C:\Windows\System\nuABPey.exe
  2⤵
  PID:924
- C:\Windows\System\jOpdAhe.exe
  C:\Windows\System\jOpdAhe.exe
  2⤵
  PID:2776
- C:\Windows\System\EJlqKLT.exe
  C:\Windows\System\EJlqKLT.exe
  2⤵
  PID:276
- C:\Windows\System\XJvLqlY.exe
  C:\Windows\System\XJvLqlY.exe
  2⤵
  PID:1836
- C:\Windows\System\UTpLdXD.exe
  C:\Windows\System\UTpLdXD.exe
  2⤵
  PID:556
- C:\Windows\System\vCPnoip.exe
  C:\Windows\System\vCPnoip.exe
  2⤵
  PID:1880
- C:\Windows\System\KhQZpew.exe
  C:\Windows\System\KhQZpew.exe
  2⤵
  PID:2416
- C:\Windows\System\WNEvMaC.exe
  C:\Windows\System\WNEvMaC.exe
  2⤵
  PID:2400
- C:\Windows\System\oeczggG.exe
  C:\Windows\System\oeczggG.exe
  2⤵
  PID:1888
- C:\Windows\System\kdZLIFL.exe
  C:\Windows\System\kdZLIFL.exe
  2⤵
  PID:1732
- C:\Windows\System\zFKfsEy.exe
  C:\Windows\System\zFKfsEy.exe
  2⤵
  PID:1212
- C:\Windows\System\CNnYAzi.exe
  C:\Windows\System\CNnYAzi.exe
  2⤵
  PID:484
- C:\Windows\System\aHGZdzM.exe
  C:\Windows\System\aHGZdzM.exe
  2⤵
  PID:1524
- C:\Windows\System\MGWmNBB.exe
  C:\Windows\System\MGWmNBB.exe
  2⤵
  PID:280
- C:\Windows\System\ybPNaZl.exe
  C:\Windows\System\ybPNaZl.exe
  2⤵
  PID:2304
- C:\Windows\System\GDyeAqX.exe
  C:\Windows\System\GDyeAqX.exe
  2⤵
  PID:1716
- C:\Windows\System\dLsZCaB.exe
  C:\Windows\System\dLsZCaB.exe
  2⤵
  PID:1796
- C:\Windows\System\OXHLZbi.exe
  C:\Windows\System\OXHLZbi.exe
  2⤵
  PID:2716
- C:\Windows\System\XnrKoro.exe
  C:\Windows\System\XnrKoro.exe
  2⤵
  PID:2816
- C:\Windows\System\GOlBfnm.exe
  C:\Windows\System\GOlBfnm.exe
  2⤵
  PID:2688
- C:\Windows\System\hkalEtX.exe
  C:\Windows\System\hkalEtX.exe
  2⤵
  PID:2152
- C:\Windows\System\UunCxBn.exe
  C:\Windows\System\UunCxBn.exe
  2⤵
  PID:3044
- C:\Windows\System\PEcSBUP.exe
  C:\Windows\System\PEcSBUP.exe
  2⤵
  PID:788
- C:\Windows\System\yDTzFKi.exe
  C:\Windows\System\yDTzFKi.exe
  2⤵
  PID:2432
- C:\Windows\System\gVliAiP.exe
  C:\Windows\System\gVliAiP.exe
  2⤵
  PID:2608
- C:\Windows\System\ENOsvJo.exe
  C:\Windows\System\ENOsvJo.exe
  2⤵
  PID:1756
- C:\Windows\System\YwsiHwv.exe
  C:\Windows\System\YwsiHwv.exe
  2⤵
  PID:2904
- C:\Windows\System\YuzaIRl.exe
  C:\Windows\System\YuzaIRl.exe
  2⤵
  PID:2744
- C:\Windows\System\qPTNHQk.exe
  C:\Windows\System\qPTNHQk.exe
  2⤵
  PID:2640
- C:\Windows\System\EHguwrE.exe
  C:\Windows\System\EHguwrE.exe
  2⤵
  PID:3088
- C:\Windows\System\uWwxQYK.exe
  C:\Windows\System\uWwxQYK.exe
  2⤵
  PID:3104
- C:\Windows\System\bnrSsWB.exe
  C:\Windows\System\bnrSsWB.exe
  2⤵
  PID:3120
- C:\Windows\System\GymbJow.exe
  C:\Windows\System\GymbJow.exe
  2⤵
  PID:3136
- C:\Windows\System\fnMJlev.exe
  C:\Windows\System\fnMJlev.exe
  2⤵
  PID:3156
- C:\Windows\System\iSasOVu.exe
  C:\Windows\System\iSasOVu.exe
  2⤵
  PID:3172
- C:\Windows\System\uBfretJ.exe
  C:\Windows\System\uBfretJ.exe
  2⤵
  PID:3188
- C:\Windows\System\MMiqffI.exe
  C:\Windows\System\MMiqffI.exe
  2⤵
  PID:3204
- C:\Windows\System\eAqbjQu.exe
  C:\Windows\System\eAqbjQu.exe
  2⤵
  PID:3220
- C:\Windows\System\TCgWPOt.exe
  C:\Windows\System\TCgWPOt.exe
  2⤵
  PID:3244
- C:\Windows\System\iCcVvqF.exe
  C:\Windows\System\iCcVvqF.exe
  2⤵
  PID:3264
- C:\Windows\System\LqrhIBJ.exe
  C:\Windows\System\LqrhIBJ.exe
  2⤵
  PID:3280
- C:\Windows\System\waQOpbd.exe
  C:\Windows\System\waQOpbd.exe
  2⤵
  PID:3300
- C:\Windows\System\NPXEWwy.exe
  C:\Windows\System\NPXEWwy.exe
  2⤵
  PID:3320
- C:\Windows\System\SvmlugE.exe
  C:\Windows\System\SvmlugE.exe
  2⤵
  PID:3340
- C:\Windows\System\xeBnmGY.exe
  C:\Windows\System\xeBnmGY.exe
  2⤵
  PID:3376
- C:\Windows\System\BPFjIZs.exe
  C:\Windows\System\BPFjIZs.exe
  2⤵
  PID:3396
- C:\Windows\System\xnmqHDF.exe
  C:\Windows\System\xnmqHDF.exe
  2⤵
  PID:3424
- C:\Windows\System\AnxpDWo.exe
  C:\Windows\System\AnxpDWo.exe
  2⤵
  PID:3440
- C:\Windows\System\EWEJsnD.exe
  C:\Windows\System\EWEJsnD.exe
  2⤵
  PID:3460
- C:\Windows\System\WflJSLp.exe
  C:\Windows\System\WflJSLp.exe
  2⤵
  PID:3480
- C:\Windows\System\NFtzkBH.exe
  C:\Windows\System\NFtzkBH.exe
  2⤵
  PID:3496
- C:\Windows\System\TtnEVVb.exe
  C:\Windows\System\TtnEVVb.exe
  2⤵
  PID:3512
- C:\Windows\System\JuuXGrh.exe
  C:\Windows\System\JuuXGrh.exe
  2⤵
  PID:3528
- C:\Windows\System\JcZSCDk.exe
  C:\Windows\System\JcZSCDk.exe
  2⤵
  PID:3544
- C:\Windows\System\xHlqBpC.exe
  C:\Windows\System\xHlqBpC.exe
  2⤵
  PID:3560
- C:\Windows\System\HaVaVju.exe
  C:\Windows\System\HaVaVju.exe
  2⤵
  PID:3576
- C:\Windows\System\zaazQyB.exe
  C:\Windows\System\zaazQyB.exe
  2⤵
  PID:3592
- C:\Windows\System\KokCrYw.exe
  C:\Windows\System\KokCrYw.exe
  2⤵
  PID:3608
- C:\Windows\System\BAxjfZF.exe
  C:\Windows\System\BAxjfZF.exe
  2⤵
  PID:3624
- C:\Windows\System\QTyLKYy.exe
  C:\Windows\System\QTyLKYy.exe
  2⤵
  PID:3640
- C:\Windows\System\fzaJhHm.exe
  C:\Windows\System\fzaJhHm.exe
  2⤵
  PID:3656
- C:\Windows\System\EbbeSqm.exe
  C:\Windows\System\EbbeSqm.exe
  2⤵
  PID:3672
- C:\Windows\System\ZPUpurh.exe
  C:\Windows\System\ZPUpurh.exe
  2⤵
  PID:3688
- C:\Windows\System\iwdcBCk.exe
  C:\Windows\System\iwdcBCk.exe
  2⤵
  PID:3704
- C:\Windows\System\pTvxSrd.exe
  C:\Windows\System\pTvxSrd.exe
  2⤵
  PID:3720
- C:\Windows\System\hPdPJlj.exe
  C:\Windows\System\hPdPJlj.exe
  2⤵
  PID:3736
- C:\Windows\System\RiZvubt.exe
  C:\Windows\System\RiZvubt.exe
  2⤵
  PID:3752
- C:\Windows\System\KMDnIaT.exe
  C:\Windows\System\KMDnIaT.exe
  2⤵
  PID:3768
- C:\Windows\System\zinxsYC.exe
  C:\Windows\System\zinxsYC.exe
  2⤵
  PID:3784
- C:\Windows\System\LdulMOf.exe
  C:\Windows\System\LdulMOf.exe
  2⤵
  PID:3800
- C:\Windows\System\WRWPdyj.exe
  C:\Windows\System\WRWPdyj.exe
  2⤵
  PID:3816
- C:\Windows\System\lgZWaFm.exe
  C:\Windows\System\lgZWaFm.exe
  2⤵
  PID:3844
- C:\Windows\System\dUElmNK.exe
  C:\Windows\System\dUElmNK.exe
  2⤵
  PID:3860
- C:\Windows\System\BKFiYCt.exe
  C:\Windows\System\BKFiYCt.exe
  2⤵
  PID:3876
- C:\Windows\System\oJWLxiL.exe
  C:\Windows\System\oJWLxiL.exe
  2⤵
  PID:3892
- C:\Windows\System\AYDHGrw.exe
  C:\Windows\System\AYDHGrw.exe
  2⤵
  PID:3908
- C:\Windows\System\erHksJg.exe
  C:\Windows\System\erHksJg.exe
  2⤵
  PID:3948
- C:\Windows\System\favxUJb.exe
  C:\Windows\System\favxUJb.exe
  2⤵
  PID:3976
- C:\Windows\System\iTzJfHz.exe
  C:\Windows\System\iTzJfHz.exe
  2⤵
  PID:3992
- C:\Windows\System\WFasOPB.exe
  C:\Windows\System\WFasOPB.exe
  2⤵
  PID:4012
- C:\Windows\System\VhtYIir.exe
  C:\Windows\System\VhtYIir.exe
  2⤵
  PID:2684
- C:\Windows\System\rpUXYMI.exe
  C:\Windows\System\rpUXYMI.exe
  2⤵
  PID:2892
- C:\Windows\System\qUcUmGj.exe
  C:\Windows\System\qUcUmGj.exe
  2⤵
  PID:3116
- C:\Windows\System\XoKhTJz.exe
  C:\Windows\System\XoKhTJz.exe
  2⤵
  PID:2852
- C:\Windows\System\htRTYun.exe
  C:\Windows\System\htRTYun.exe
  2⤵
  PID:3184
- C:\Windows\System\tEapmCJ.exe
  C:\Windows\System\tEapmCJ.exe
  2⤵
  PID:3256
- C:\Windows\System\GDtpByc.exe
  C:\Windows\System\GDtpByc.exe
  2⤵
  PID:3296
- C:\Windows\System\ogiyWhu.exe
  C:\Windows\System\ogiyWhu.exe
  2⤵
  PID:3384
- C:\Windows\System\LevFQZA.exe
  C:\Windows\System\LevFQZA.exe
  2⤵
  PID:3436
- C:\Windows\System\NgmTUyz.exe
  C:\Windows\System\NgmTUyz.exe
  2⤵
  PID:1160
- C:\Windows\System\QpBJHGl.exe
  C:\Windows\System\QpBJHGl.exe
  2⤵
  PID:3060
- C:\Windows\System\ZYhHhaa.exe
  C:\Windows\System\ZYhHhaa.exe
  2⤵
  PID:1980
- C:\Windows\System\ScPTfJv.exe
  C:\Windows\System\ScPTfJv.exe
  2⤵
  PID:2084
- C:\Windows\System\eBoyaMi.exe
  C:\Windows\System\eBoyaMi.exe
  2⤵
  PID:2960
- C:\Windows\System\CqTsNpB.exe
  C:\Windows\System\CqTsNpB.exe
  2⤵
  PID:3508
- C:\Windows\System\agPlThz.exe
  C:\Windows\System\agPlThz.exe
  2⤵
  PID:3468
- C:\Windows\System\zHCPfGm.exe
  C:\Windows\System\zHCPfGm.exe
  2⤵
  PID:3964
- C:\Windows\System\reYTlul.exe
  C:\Windows\System\reYTlul.exe
  2⤵
  PID:3900
- C:\Windows\System\IApzYvJ.exe
  C:\Windows\System\IApzYvJ.exe
  2⤵
  PID:3836
- C:\Windows\System\yPnSUWS.exe
  C:\Windows\System\yPnSUWS.exe
  2⤵
  PID:3796
- C:\Windows\System\jDKdvqe.exe
  C:\Windows\System\jDKdvqe.exe
  2⤵
  PID:3732
- C:\Windows\System\dPrZzxu.exe
  C:\Windows\System\dPrZzxu.exe
  2⤵
  PID:3668
- C:\Windows\System\vvJhscO.exe
  C:\Windows\System\vvJhscO.exe
  2⤵
  PID:3604
- C:\Windows\System\GWPqLIm.exe
  C:\Windows\System\GWPqLIm.exe
  2⤵
  PID:3536
- C:\Windows\System\dKfQTQB.exe
  C:\Windows\System\dKfQTQB.exe
  2⤵
  PID:4004
- C:\Windows\System\wZSHtaz.exe
  C:\Windows\System\wZSHtaz.exe
  2⤵
  PID:2676
- C:\Windows\System\pKtkaCp.exe
  C:\Windows\System\pKtkaCp.exe
  2⤵
  PID:1484
- C:\Windows\System\zzNtwWu.exe
  C:\Windows\System\zzNtwWu.exe
  2⤵
  PID:2940
- C:\Windows\System\fqNWAQV.exe
  C:\Windows\System\fqNWAQV.exe
  2⤵
  PID:2364
- C:\Windows\System\oMVBUHK.exe
  C:\Windows\System\oMVBUHK.exe
  2⤵
  PID:1156
- C:\Windows\System\bleyuZU.exe
  C:\Windows\System\bleyuZU.exe
  2⤵
  PID:2232
- C:\Windows\System\CtWfhkR.exe
  C:\Windows\System\CtWfhkR.exe
  2⤵
  PID:3100
- C:\Windows\System\UIWwxws.exe
  C:\Windows\System\UIWwxws.exe
  2⤵
  PID:3168
- C:\Windows\System\kYLcwEU.exe
  C:\Windows\System\kYLcwEU.exe
  2⤵
  PID:3232
- C:\Windows\System\cXBQIGi.exe
  C:\Windows\System\cXBQIGi.exe
  2⤵
  PID:3316
- C:\Windows\System\lVkEpOi.exe
  C:\Windows\System\lVkEpOi.exe
  2⤵
  PID:3352
- C:\Windows\System\VPaqXts.exe
  C:\Windows\System\VPaqXts.exe
  2⤵
  PID:3364
- C:\Windows\System\EWddmxN.exe
  C:\Windows\System\EWddmxN.exe
  2⤵
  PID:3408
- C:\Windows\System\fbsvdpz.exe
  C:\Windows\System\fbsvdpz.exe
  2⤵
  PID:3448
- C:\Windows\System\CUfnlhh.exe
  C:\Windows\System\CUfnlhh.exe
  2⤵
  PID:3520
- C:\Windows\System\qRXVkgr.exe
  C:\Windows\System\qRXVkgr.exe
  2⤵
  PID:3584
- C:\Windows\System\UQfyZWz.exe
  C:\Windows\System\UQfyZWz.exe
  2⤵
  PID:3648
- C:\Windows\System\nbkLHDV.exe
  C:\Windows\System\nbkLHDV.exe
  2⤵
  PID:3712
- C:\Windows\System\pmvlsTG.exe
  C:\Windows\System\pmvlsTG.exe
  2⤵
  PID:3776
- C:\Windows\System\QPamoYX.exe
  C:\Windows\System\QPamoYX.exe
  2⤵
  PID:3852
- C:\Windows\System\KbSQuFH.exe
  C:\Windows\System\KbSQuFH.exe
  2⤵
  PID:3920
- C:\Windows\System\zGDbBAB.exe
  C:\Windows\System\zGDbBAB.exe
  2⤵
  PID:3936
- C:\Windows\System\QMmUkdx.exe
  C:\Windows\System\QMmUkdx.exe
  2⤵
  PID:3988
- C:\Windows\System\lgwhURy.exe
  C:\Windows\System\lgwhURy.exe
  2⤵
  PID:4032
- C:\Windows\System\DwSgIZK.exe
  C:\Windows\System\DwSgIZK.exe
  2⤵
  PID:4056
- C:\Windows\System\cqEAStY.exe
  C:\Windows\System\cqEAStY.exe
  2⤵
  PID:2760
- C:\Windows\System\gEPNUJC.exe
  C:\Windows\System\gEPNUJC.exe
  2⤵
  PID:2612
- C:\Windows\System\qSOSodQ.exe
  C:\Windows\System\qSOSodQ.exe
  2⤵
  PID:1876
- C:\Windows\System\VYcngTR.exe
  C:\Windows\System\VYcngTR.exe
  2⤵
  PID:1508
- C:\Windows\System\iSkvyWc.exe
  C:\Windows\System\iSkvyWc.exe
  2⤵
  PID:4092
- C:\Windows\System\FiQFrJX.exe
  C:\Windows\System\FiQFrJX.exe
  2⤵
  PID:2196
- C:\Windows\System\YMIPfnK.exe
  C:\Windows\System\YMIPfnK.exe
  2⤵
  PID:3028
- C:\Windows\System\ZpdUpqH.exe
  C:\Windows\System\ZpdUpqH.exe
  2⤵
  PID:3144
- C:\Windows\System\TTAEJFA.exe
  C:\Windows\System\TTAEJFA.exe
  2⤵
  PID:3252
- C:\Windows\System\pcIshKV.exe
  C:\Windows\System\pcIshKV.exe
  2⤵
  PID:3336
- C:\Windows\System\RFsOVvy.exe
  C:\Windows\System\RFsOVvy.exe
  2⤵
  PID:2448
- C:\Windows\System\fVbBimt.exe
  C:\Windows\System\fVbBimt.exe
  2⤵
  PID:1640
- C:\Windows\System\CDMcdpQ.exe
  C:\Windows\System\CDMcdpQ.exe
  2⤵
  PID:2732
- C:\Windows\System\LGFjgBs.exe
  C:\Windows\System\LGFjgBs.exe
  2⤵
  PID:3540
- C:\Windows\System\IWgHVoZ.exe
  C:\Windows\System\IWgHVoZ.exe
  2⤵
  PID:1676
- C:\Windows\System\TdusKEF.exe
  C:\Windows\System\TdusKEF.exe
  2⤵
  PID:3904
- C:\Windows\System\STLLItr.exe
  C:\Windows\System\STLLItr.exe
  2⤵
  PID:3828
- C:\Windows\System\PKQXKRr.exe
  C:\Windows\System\PKQXKRr.exe
  2⤵
  PID:3700
- C:\Windows\System\FKzryul.exe
  C:\Windows\System\FKzryul.exe
  2⤵
  PID:3572
- C:\Windows\System\DWbgLIr.exe
  C:\Windows\System\DWbgLIr.exe
  2⤵
  PID:2948
- C:\Windows\System\JEOzGXE.exe
  C:\Windows\System\JEOzGXE.exe
  2⤵
  PID:4104
- C:\Windows\System\YwUhnKZ.exe
  C:\Windows\System\YwUhnKZ.exe
  2⤵
  PID:4120
- C:\Windows\System\qnzZaZi.exe
  C:\Windows\System\qnzZaZi.exe
  2⤵
  PID:4136
- C:\Windows\System\ycjIbSl.exe
  C:\Windows\System\ycjIbSl.exe
  2⤵
  PID:4152
- C:\Windows\System\ysWZKwF.exe
  C:\Windows\System\ysWZKwF.exe
  2⤵
  PID:4168
- C:\Windows\System\VsABLjy.exe
  C:\Windows\System\VsABLjy.exe
  2⤵
  PID:4184
- C:\Windows\System\SSHDoFN.exe
  C:\Windows\System\SSHDoFN.exe
  2⤵
  PID:4200
- C:\Windows\System\hijpclX.exe
  C:\Windows\System\hijpclX.exe
  2⤵
  PID:4216
- C:\Windows\System\yrHpDKu.exe
  C:\Windows\System\yrHpDKu.exe
  2⤵
  PID:4232
- C:\Windows\System\MzmFyAz.exe
  C:\Windows\System\MzmFyAz.exe
  2⤵
  PID:4248
- C:\Windows\System\emBfhYR.exe
  C:\Windows\System\emBfhYR.exe
  2⤵
  PID:4264
- C:\Windows\System\LKyTKFm.exe
  C:\Windows\System\LKyTKFm.exe
  2⤵
  PID:4280
- C:\Windows\System\oyHuRfc.exe
  C:\Windows\System\oyHuRfc.exe
  2⤵
  PID:4688
- C:\Windows\System\recXupe.exe
  C:\Windows\System\recXupe.exe
  2⤵
  PID:4704
- C:\Windows\System\agPDssL.exe
  C:\Windows\System\agPDssL.exe
  2⤵
  PID:4720
- C:\Windows\System\eNejmbG.exe
  C:\Windows\System\eNejmbG.exe
  2⤵
  PID:4736
- C:\Windows\System\TISKDYv.exe
  C:\Windows\System\TISKDYv.exe
  2⤵
  PID:4752
- C:\Windows\System\nmuTWKf.exe
  C:\Windows\System\nmuTWKf.exe
  2⤵
  PID:4768
- C:\Windows\System\wgaElVK.exe
  C:\Windows\System\wgaElVK.exe
  2⤵
  PID:4784
- C:\Windows\System\oMhlDkU.exe
  C:\Windows\System\oMhlDkU.exe
  2⤵
  PID:4804
- C:\Windows\System\jEJVGGY.exe
  C:\Windows\System\jEJVGGY.exe
  2⤵
  PID:4820
- C:\Windows\System\wfkboKC.exe
  C:\Windows\System\wfkboKC.exe
  2⤵
  PID:4836
- C:\Windows\System\MWuOAxQ.exe
  C:\Windows\System\MWuOAxQ.exe
  2⤵
  PID:4852
- C:\Windows\System\FJgakux.exe
  C:\Windows\System\FJgakux.exe
  2⤵
  PID:4868
- C:\Windows\System\hMjkfmH.exe
  C:\Windows\System\hMjkfmH.exe
  2⤵
  PID:4888
- C:\Windows\System\GlDKaby.exe
  C:\Windows\System\GlDKaby.exe
  2⤵
  PID:4904
- C:\Windows\System\pEScqaU.exe
  C:\Windows\System\pEScqaU.exe
  2⤵
  PID:4920
- C:\Windows\System\izucYIW.exe
  C:\Windows\System\izucYIW.exe
  2⤵
  PID:4936
- C:\Windows\System\OkLtvca.exe
  C:\Windows\System\OkLtvca.exe
  2⤵
  PID:4952
- C:\Windows\System\TSSNaSb.exe
  C:\Windows\System\TSSNaSb.exe
  2⤵
  PID:4976
- C:\Windows\System\JRDjBjh.exe
  C:\Windows\System\JRDjBjh.exe
  2⤵
  PID:4992
- C:\Windows\System\NLYgnIt.exe
  C:\Windows\System\NLYgnIt.exe
  2⤵
  PID:5012
- C:\Windows\System\GJnWvLi.exe
  C:\Windows\System\GJnWvLi.exe
  2⤵
  PID:5032
- C:\Windows\System\miEzPAy.exe
  C:\Windows\System\miEzPAy.exe
  2⤵
  PID:5048
- C:\Windows\System\rEnjFzl.exe
  C:\Windows\System\rEnjFzl.exe
  2⤵
  PID:5072
- C:\Windows\System\NtSEJgo.exe
  C:\Windows\System\NtSEJgo.exe
  2⤵
  PID:5088
- C:\Windows\System\oqezmSj.exe
  C:\Windows\System\oqezmSj.exe
  2⤵
  PID:5104
- C:\Windows\System\ASUQnJd.exe
  C:\Windows\System\ASUQnJd.exe
  2⤵
  PID:1952
- C:\Windows\System\uwmeoky.exe
  C:\Windows\System\uwmeoky.exe
  2⤵
  PID:2436
- C:\Windows\System\bxkGSYm.exe
  C:\Windows\System\bxkGSYm.exe
  2⤵
  PID:568
- C:\Windows\System\hZrvTwf.exe
  C:\Windows\System\hZrvTwf.exe
  2⤵
  PID:3368
- C:\Windows\System\EHCImtG.exe
  C:\Windows\System\EHCImtG.exe
  2⤵
  PID:4048
- C:\Windows\System\LbIpakj.exe
  C:\Windows\System\LbIpakj.exe
  2⤵
  PID:2932
- C:\Windows\System\FfHDIrY.exe
  C:\Windows\System\FfHDIrY.exe
  2⤵
  PID:4176
- C:\Windows\System\cxdVqfj.exe
  C:\Windows\System\cxdVqfj.exe
  2⤵
  PID:1616
- C:\Windows\System\elMxOsj.exe
  C:\Windows\System\elMxOsj.exe
  2⤵
  PID:4276
- C:\Windows\System\ALJJCgE.exe
  C:\Windows\System\ALJJCgE.exe
  2⤵
  PID:4244
- C:\Windows\System\IGRRnlA.exe
  C:\Windows\System\IGRRnlA.exe
  2⤵
  PID:3764
- C:\Windows\System\pVMGGcj.exe
  C:\Windows\System\pVMGGcj.exe
  2⤵
  PID:3332
- C:\Windows\System\fvVAzbc.exe
  C:\Windows\System\fvVAzbc.exe
  2⤵
  PID:3984
- C:\Windows\System\sNiBLms.exe
  C:\Windows\System\sNiBLms.exe
  2⤵
  PID:3620
- C:\Windows\System\tBrHcOf.exe
  C:\Windows\System\tBrHcOf.exe
  2⤵
  PID:3488
- C:\Windows\System\EtCRFla.exe
  C:\Windows\System\EtCRFla.exe
  2⤵
  PID:2176
- C:\Windows\System\StBfJcg.exe
  C:\Windows\System\StBfJcg.exe
  2⤵
  PID:3632
- C:\Windows\System\FQtiMDL.exe
  C:\Windows\System\FQtiMDL.exe
  2⤵
  PID:2680
- C:\Windows\System\YAeJIAl.exe
  C:\Windows\System\YAeJIAl.exe
  2⤵
  PID:2344
- C:\Windows\System\elxltKk.exe
  C:\Windows\System\elxltKk.exe
  2⤵
  PID:4496
- C:\Windows\System\lmTZZlA.exe
  C:\Windows\System\lmTZZlA.exe
  2⤵
  PID:4588
- C:\Windows\System\QWVeNuh.exe
  C:\Windows\System\QWVeNuh.exe
  2⤵
  PID:4652
- C:\Windows\System\Oipkgvg.exe
  C:\Windows\System\Oipkgvg.exe
  2⤵
  PID:2912
- C:\Windows\System\AqxWlaQ.exe
  C:\Windows\System\AqxWlaQ.exe
  2⤵
  PID:3132
- C:\Windows\System\bWSIqJV.exe
  C:\Windows\System\bWSIqJV.exe
  2⤵
  PID:3356
- C:\Windows\System\kAHCRCS.exe
  C:\Windows\System\kAHCRCS.exe
  2⤵
  PID:3412
- C:\Windows\System\LqrozEm.exe
  C:\Windows\System\LqrozEm.exe
  2⤵
  PID:3932
- C:\Windows\System\HJLDBLP.exe
  C:\Windows\System\HJLDBLP.exe
  2⤵
  PID:2184
- C:\Windows\System\RvMDcjG.exe
  C:\Windows\System\RvMDcjG.exe
  2⤵
  PID:4364
- C:\Windows\System\cXalNqc.exe
  C:\Windows\System\cXalNqc.exe
  2⤵
  PID:4396
- C:\Windows\System\zCwHDlu.exe
  C:\Windows\System\zCwHDlu.exe
  2⤵
  PID:4404
- C:\Windows\System\ZfhltEg.exe
  C:\Windows\System\ZfhltEg.exe
  2⤵
  PID:4464
- C:\Windows\System\IAEebPY.exe
  C:\Windows\System\IAEebPY.exe
  2⤵
  PID:4504
- C:\Windows\System\RtzyHoi.exe
  C:\Windows\System\RtzyHoi.exe
  2⤵
  PID:4520
- C:\Windows\System\qCUtqzO.exe
  C:\Windows\System\qCUtqzO.exe
  2⤵
  PID:4568
- C:\Windows\System\FZjpEJF.exe
  C:\Windows\System\FZjpEJF.exe
  2⤵
  PID:4596
- C:\Windows\System\rSLUkhf.exe
  C:\Windows\System\rSLUkhf.exe
  2⤵
  PID:4616
- C:\Windows\System\DpOXvgA.exe
  C:\Windows\System\DpOXvgA.exe
  2⤵
  PID:4644
- C:\Windows\System\mfnJmTN.exe
  C:\Windows\System\mfnJmTN.exe
  2⤵
  PID:4676
- C:\Windows\System\drjtPcb.exe
  C:\Windows\System\drjtPcb.exe
  2⤵
  PID:4760
- C:\Windows\System\iqBaLLQ.exe
  C:\Windows\System\iqBaLLQ.exe
  2⤵
  PID:4864
- C:\Windows\System\shIfCdm.exe
  C:\Windows\System\shIfCdm.exe
  2⤵
  PID:4960
- C:\Windows\System\gqAtBpM.exe
  C:\Windows\System\gqAtBpM.exe
  2⤵
  PID:5040
- C:\Windows\System\qLTWzoW.exe
  C:\Windows\System\qLTWzoW.exe
  2⤵
  PID:4716
- C:\Windows\System\OJmwwiw.exe
  C:\Windows\System\OJmwwiw.exe
  2⤵
  PID:5112
- C:\Windows\System\NuMYUzk.exe
  C:\Windows\System\NuMYUzk.exe
  2⤵
  PID:2340
- C:\Windows\System\AZVSfcL.exe
  C:\Windows\System\AZVSfcL.exe
  2⤵
  PID:4812
- C:\Windows\System\raXWufg.exe
  C:\Windows\System\raXWufg.exe
  2⤵
  PID:340
- C:\Windows\System\FRgLNak.exe
  C:\Windows\System\FRgLNak.exe
  2⤵
  PID:4884
- C:\Windows\System\VwstKVa.exe
  C:\Windows\System\VwstKVa.exe
  2⤵
  PID:4948
- C:\Windows\System\IBOoYnF.exe
  C:\Windows\System\IBOoYnF.exe
  2⤵
  PID:5028
- C:\Windows\System\OZJcKfQ.exe
  C:\Windows\System\OZJcKfQ.exe
  2⤵
  PID:3228
- C:\Windows\System\vNeBHfU.exe
  C:\Windows\System\vNeBHfU.exe
  2⤵
  PID:5068
- C:\Windows\System\AkBDfdO.exe
  C:\Windows\System\AkBDfdO.exe
  2⤵
  PID:576
- C:\Windows\System\bOwvuHv.exe
  C:\Windows\System\bOwvuHv.exe
  2⤵
  PID:4240
- C:\Windows\System\cFsWaTX.exe
  C:\Windows\System\cFsWaTX.exe
  2⤵
  PID:4180
- C:\Windows\System\FFBVROr.exe
  C:\Windows\System\FFBVROr.exe
  2⤵
  PID:1060
- C:\Windows\System\ootjVXa.exe
  C:\Windows\System\ootjVXa.exe
  2⤵
  PID:3024
- C:\Windows\System\wverCUv.exe
  C:\Windows\System\wverCUv.exe
  2⤵
  PID:2868
- C:\Windows\System\ErTDfdb.exe
  C:\Windows\System\ErTDfdb.exe
  2⤵
  PID:2040
- C:\Windows\System\xezVGEu.exe
  C:\Windows\System\xezVGEu.exe
  2⤵
  PID:4448
- C:\Windows\System\RhJVdHA.exe
  C:\Windows\System\RhJVdHA.exe
  2⤵
  PID:2584
- C:\Windows\System\tXqISQY.exe
  C:\Windows\System\tXqISQY.exe
  2⤵
  PID:2968
- C:\Windows\System\WluvJip.exe
  C:\Windows\System\WluvJip.exe
  2⤵
  PID:3240
- C:\Windows\System\cTqaQXy.exe
  C:\Windows\System\cTqaQXy.exe
  2⤵
  PID:1644
- C:\Windows\System\fOvfWbY.exe
  C:\Windows\System\fOvfWbY.exe
  2⤵
  PID:3680
- C:\Windows\System\RnlIRBM.exe
  C:\Windows\System\RnlIRBM.exe
  2⤵
  PID:644
- C:\Windows\System\mSMeOrA.exe
  C:\Windows\System\mSMeOrA.exe
  2⤵
  PID:2248
- C:\Windows\System\OdNvYeE.exe
  C:\Windows\System\OdNvYeE.exe
  2⤵
  PID:1492
- C:\Windows\System\uevVTEo.exe
  C:\Windows\System\uevVTEo.exe
  2⤵
  PID:3084
- C:\Windows\System\ejONqFN.exe
  C:\Windows\System\ejONqFN.exe
  2⤵
  PID:2324
- C:\Windows\System\aPlmJmL.exe
  C:\Windows\System\aPlmJmL.exe
  2⤵
  PID:1208
- C:\Windows\System\MQqzteO.exe
  C:\Windows\System\MQqzteO.exe
  2⤵
  PID:4128
- C:\Windows\System\uJxeJDb.exe
  C:\Windows\System\uJxeJDb.exe
  2⤵
  PID:4192
- C:\Windows\System\BqIPysk.exe
  C:\Windows\System\BqIPysk.exe
  2⤵
  PID:4228
- C:\Windows\System\sIUuXxe.exe
  C:\Windows\System\sIUuXxe.exe
  2⤵
  PID:2856
- C:\Windows\System\fsRbIVG.exe
  C:\Windows\System\fsRbIVG.exe
  2⤵
  PID:2380
- C:\Windows\System\RcvDvKO.exe
  C:\Windows\System\RcvDvKO.exe
  2⤵
  PID:4300
- C:\Windows\System\YPNpYwx.exe
  C:\Windows\System\YPNpYwx.exe
  2⤵
  PID:4320
- C:\Windows\System\zCNGFHY.exe
  C:\Windows\System\zCNGFHY.exe
  2⤵
  PID:2372
- C:\Windows\System\WIoQDJC.exe
  C:\Windows\System\WIoQDJC.exe
  2⤵
  PID:2224
- C:\Windows\System\zAfswbu.exe
  C:\Windows\System\zAfswbu.exe
  2⤵
  PID:2012
- C:\Windows\System\opvBdTt.exe
  C:\Windows\System\opvBdTt.exe
  2⤵
  PID:2328
- C:\Windows\System\FMTcKqH.exe
  C:\Windows\System\FMTcKqH.exe
  2⤵
  PID:4344
- C:\Windows\System\FhXwuVE.exe
  C:\Windows\System\FhXwuVE.exe
  2⤵
  PID:4376
- C:\Windows\System\CueaiiU.exe
  C:\Windows\System\CueaiiU.exe
  2⤵
  PID:4400
- C:\Windows\System\hYkGJuf.exe
  C:\Windows\System\hYkGJuf.exe
  2⤵
  PID:4388
- C:\Windows\System\HcJyOgl.exe
  C:\Windows\System\HcJyOgl.exe
  2⤵
  PID:4424
- C:\Windows\System\OnxzbQz.exe
  C:\Windows\System\OnxzbQz.exe
  2⤵
  PID:4432
- C:\Windows\System\HwDWuYV.exe
  C:\Windows\System\HwDWuYV.exe
  2⤵
  PID:4476
- C:\Windows\System\kqKHWoi.exe
  C:\Windows\System\kqKHWoi.exe
  2⤵
  PID:4500
- C:\Windows\System\FYxFJyk.exe
  C:\Windows\System\FYxFJyk.exe
  2⤵
  PID:4528
- C:\Windows\System\odnrgCj.exe
  C:\Windows\System\odnrgCj.exe
  2⤵
  PID:4592
- C:\Windows\System\vWzKnZH.exe
  C:\Windows\System\vWzKnZH.exe
  2⤵
  PID:4628
- C:\Windows\System\zESQJnB.exe
  C:\Windows\System\zESQJnB.exe
  2⤵
  PID:4664
- C:\Windows\System\ecqtsIJ.exe
  C:\Windows\System\ecqtsIJ.exe
  2⤵
  PID:4764
- C:\Windows\System\XGMwAiR.exe
  C:\Windows\System\XGMwAiR.exe
  2⤵
  PID:4800
- C:\Windows\System\DtteYLx.exe
  C:\Windows\System\DtteYLx.exe
  2⤵
  PID:4972
- C:\Windows\System\hVkJLbd.exe
  C:\Windows\System\hVkJLbd.exe
  2⤵
  PID:5004
- C:\Windows\System\gwIOGcf.exe
  C:\Windows\System\gwIOGcf.exe
  2⤵
  PID:5080
- C:\Windows\System\vMjsWyn.exe
  C:\Windows\System\vMjsWyn.exe
  2⤵
  PID:4780
- C:\Windows\System\JEekgNE.exe
  C:\Windows\System\JEekgNE.exe
  2⤵
  PID:3944
- C:\Windows\System\hGuliRL.exe
  C:\Windows\System\hGuliRL.exe
  2⤵
  PID:5064
- C:\Windows\System\wOaETGw.exe
  C:\Windows\System\wOaETGw.exe
  2⤵
  PID:2780
- C:\Windows\System\OjXfxFF.exe
  C:\Windows\System\OjXfxFF.exe
  2⤵
  PID:468
- C:\Windows\System\KcyJGlx.exe
  C:\Windows\System\KcyJGlx.exe
  2⤵
  PID:4196
- C:\Windows\System\UyUzMFB.exe
  C:\Windows\System\UyUzMFB.exe
  2⤵
  PID:3684
- C:\Windows\System\ZnqbZjL.exe
  C:\Windows\System\ZnqbZjL.exe
  2⤵
  PID:3636
- C:\Windows\System\PLKxCPr.exe
  C:\Windows\System\PLKxCPr.exe
  2⤵
  PID:4408
- C:\Windows\System\kHQtOZK.exe
  C:\Windows\System\kHQtOZK.exe
  2⤵
  PID:2268
- C:\Windows\System\bXJNMkh.exe
  C:\Windows\System\bXJNMkh.exe
  2⤵
  PID:4356
- C:\Windows\System\IusrWtp.exe
  C:\Windows\System\IusrWtp.exe
  2⤵
  PID:5000
- C:\Windows\System\FsQtgka.exe
  C:\Windows\System\FsQtgka.exe
  2⤵
  PID:4084
- C:\Windows\System\muHjdUv.exe
  C:\Windows\System\muHjdUv.exe
  2⤵
  PID:2928
- C:\Windows\System\soLfjZR.exe
  C:\Windows\System\soLfjZR.exe
  2⤵
  PID:3840
- C:\Windows\System\zOTyWbU.exe
  C:\Windows\System\zOTyWbU.exe
  2⤵
  PID:5100
- C:\Windows\System\mLHIYUX.exe
  C:\Windows\System\mLHIYUX.exe
  2⤵
  PID:4296
- C:\Windows\System\hrPaXNk.exe
  C:\Windows\System\hrPaXNk.exe
  2⤵
  PID:712
- C:\Windows\System\EbMUtJX.exe
  C:\Windows\System\EbMUtJX.exe
  2⤵
  PID:4612
- C:\Windows\System\tEYQNYF.exe
  C:\Windows\System\tEYQNYF.exe
  2⤵
  PID:4680
- C:\Windows\System\rIMSNMR.exe
  C:\Windows\System\rIMSNMR.exe
  2⤵
  PID:2824
- C:\Windows\System\XMHxzng.exe
  C:\Windows\System\XMHxzng.exe
  2⤵
  PID:3812
- C:\Windows\System\omavylB.exe
  C:\Windows\System\omavylB.exe
  2⤵
  PID:4668
- C:\Windows\System\uenGoOM.exe
  C:\Windows\System\uenGoOM.exe
  2⤵
  PID:2788
- C:\Windows\System\UCGmQmo.exe
  C:\Windows\System\UCGmQmo.exe
  2⤵
  PID:5060
- C:\Windows\System\VquDpcH.exe
  C:\Windows\System\VquDpcH.exe
  2⤵
  PID:4640
- C:\Windows\System\RKGWIQq.exe
  C:\Windows\System\RKGWIQq.exe
  2⤵
  PID:1412
- C:\Windows\System\myZDDDU.exe
  C:\Windows\System\myZDDDU.exe
  2⤵
  PID:1104
- C:\Windows\System\XFptubH.exe
  C:\Windows\System\XFptubH.exe
  2⤵
  PID:4700
- C:\Windows\System\XRZXSNY.exe
  C:\Windows\System\XRZXSNY.exe
  2⤵
  PID:4532
- C:\Windows\System\UYYecfc.exe
  C:\Windows\System\UYYecfc.exe
  2⤵
  PID:4304
- C:\Windows\System\zXpmvhH.exe
  C:\Windows\System\zXpmvhH.exe
  2⤵
  PID:4428
- C:\Windows\System\VrOTyJj.exe
  C:\Windows\System\VrOTyJj.exe
  2⤵
  PID:2524
- C:\Windows\System\HfEyEab.exe
  C:\Windows\System\HfEyEab.exe
  2⤵
  PID:4116
- C:\Windows\System\PwwMyWY.exe
  C:\Windows\System\PwwMyWY.exe
  2⤵
  PID:3216
- C:\Windows\System\SlLjXjc.exe
  C:\Windows\System\SlLjXjc.exe
  2⤵
  PID:2884
- C:\Windows\System\NgILqbY.exe
  C:\Windows\System\NgILqbY.exe
  2⤵
  PID:4964
- C:\Windows\System\opFNmMU.exe
  C:\Windows\System\opFNmMU.exe
  2⤵
  PID:2408
- C:\Windows\System\gOtKUNI.exe
  C:\Windows\System\gOtKUNI.exe
  2⤵
  PID:960
- C:\Windows\System\TtAtyyz.exe
  C:\Windows\System\TtAtyyz.exe
  2⤵
  PID:4828
- C:\Windows\System\oDQSodF.exe
  C:\Windows\System\oDQSodF.exe
  2⤵
  PID:2984
- C:\Windows\System\ZWKZTkI.exe
  C:\Windows\System\ZWKZTkI.exe
  2⤵
  PID:2240
- C:\Windows\System\jFjxmRf.exe
  C:\Windows\System\jFjxmRf.exe
  2⤵
  PID:1552
- C:\Windows\System\fekXQZb.exe
  C:\Windows\System\fekXQZb.exe
  2⤵
  PID:2056
- C:\Windows\System\qTKnvJv.exe
  C:\Windows\System\qTKnvJv.exe
  2⤵
  PID:5136
- C:\Windows\System\uuKwSqY.exe
  C:\Windows\System\uuKwSqY.exe
  2⤵
  PID:5156
- C:\Windows\System\RGWJmAt.exe
  C:\Windows\System\RGWJmAt.exe
  2⤵
  PID:5172
- C:\Windows\System\MMZNyVM.exe
  C:\Windows\System\MMZNyVM.exe
  2⤵
  PID:5192
- C:\Windows\System\zLqDzed.exe
  C:\Windows\System\zLqDzed.exe
  2⤵
  PID:5208
- C:\Windows\System\NUplmvx.exe
  C:\Windows\System\NUplmvx.exe
  2⤵
  PID:5304
- C:\Windows\System\gncRXbv.exe
  C:\Windows\System\gncRXbv.exe
  2⤵
  PID:5320
- C:\Windows\System\gRoNzXL.exe
  C:\Windows\System\gRoNzXL.exe
  2⤵
  PID:5336
- C:\Windows\System\yFxbbGa.exe
  C:\Windows\System\yFxbbGa.exe
  2⤵
  PID:5352
- C:\Windows\System\OIDJENn.exe
  C:\Windows\System\OIDJENn.exe
  2⤵
  PID:5368
- C:\Windows\System\LIEiOqD.exe
  C:\Windows\System\LIEiOqD.exe
  2⤵
  PID:5384
- C:\Windows\System\SkkxMwP.exe
  C:\Windows\System\SkkxMwP.exe
  2⤵
  PID:5404
- C:\Windows\System\xWQmYCR.exe
  C:\Windows\System\xWQmYCR.exe
  2⤵
  PID:5420
- C:\Windows\System\cskKIsf.exe
  C:\Windows\System\cskKIsf.exe
  2⤵
  PID:5436
- C:\Windows\System\bkVfcsr.exe
  C:\Windows\System\bkVfcsr.exe
  2⤵
  PID:5500
- C:\Windows\System\FlCxOmO.exe
  C:\Windows\System\FlCxOmO.exe
  2⤵
  PID:5516
- C:\Windows\System\CxRVsAI.exe
  C:\Windows\System\CxRVsAI.exe
  2⤵
  PID:5532
- C:\Windows\System\yPrRKlu.exe
  C:\Windows\System\yPrRKlu.exe
  2⤵
  PID:5552
- C:\Windows\System\FnOKgjJ.exe
  C:\Windows\System\FnOKgjJ.exe
  2⤵
  PID:5568
- C:\Windows\System\DcSOxSY.exe
  C:\Windows\System\DcSOxSY.exe
  2⤵
  PID:5592
- C:\Windows\System\JlmYolo.exe
  C:\Windows\System\JlmYolo.exe
  2⤵
  PID:5608
- C:\Windows\System\xRNUxnk.exe
  C:\Windows\System\xRNUxnk.exe
  2⤵
  PID:5624
- C:\Windows\System\clJkZFr.exe
  C:\Windows\System\clJkZFr.exe
  2⤵
  PID:5648
- C:\Windows\System\khUboxR.exe
  C:\Windows\System\khUboxR.exe
  2⤵
  PID:5672
- C:\Windows\System\Ntmasew.exe
  C:\Windows\System\Ntmasew.exe
  2⤵
  PID:5688
- C:\Windows\System\UIZucwB.exe
  C:\Windows\System\UIZucwB.exe
  2⤵
  PID:5704
- C:\Windows\System\ZaXyCKo.exe
  C:\Windows\System\ZaXyCKo.exe
  2⤵
  PID:5720
- C:\Windows\System\TtpzVdY.exe
  C:\Windows\System\TtpzVdY.exe
  2⤵
  PID:5736
- C:\Windows\System\JckqAeC.exe
  C:\Windows\System\JckqAeC.exe
  2⤵
  PID:5764
- C:\Windows\System\kDzNjNl.exe
  C:\Windows\System\kDzNjNl.exe
  2⤵
  PID:5780
- C:\Windows\System\aZyeTXu.exe
  C:\Windows\System\aZyeTXu.exe
  2⤵
  PID:5800
- C:\Windows\System\bGUUFMS.exe
  C:\Windows\System\bGUUFMS.exe
  2⤵
  PID:5816
- C:\Windows\System\dhJqMyO.exe
  C:\Windows\System\dhJqMyO.exe
  2⤵
  PID:5832
- C:\Windows\System\eWCiNni.exe
  C:\Windows\System\eWCiNni.exe
  2⤵
  PID:5848
- C:\Windows\System\GumdSgC.exe
  C:\Windows\System\GumdSgC.exe
  2⤵
  PID:5868
- C:\Windows\System\MBSasFG.exe
  C:\Windows\System\MBSasFG.exe
  2⤵
  PID:5884
- C:\Windows\System\zRDjZKa.exe
  C:\Windows\System\zRDjZKa.exe
  2⤵
  PID:5900
- C:\Windows\System\TBPuDOf.exe
  C:\Windows\System\TBPuDOf.exe
  2⤵
  PID:5920
- C:\Windows\System\RVwbGih.exe
  C:\Windows\System\RVwbGih.exe
  2⤵
  PID:5936
- C:\Windows\System\GnKVPVz.exe
  C:\Windows\System\GnKVPVz.exe
  2⤵
  PID:5952
- C:\Windows\System\IVIKXhW.exe
  C:\Windows\System\IVIKXhW.exe
  2⤵
  PID:5972
- C:\Windows\System\BNCAOWK.exe
  C:\Windows\System\BNCAOWK.exe
  2⤵
  PID:5988
- C:\Windows\System\pcUaNjg.exe
  C:\Windows\System\pcUaNjg.exe
  2⤵
  PID:6004
- C:\Windows\System\nLgHnhz.exe
  C:\Windows\System\nLgHnhz.exe
  2⤵
  PID:6020
- C:\Windows\System\iVmDpQK.exe
  C:\Windows\System\iVmDpQK.exe
  2⤵
  PID:6040
- C:\Windows\System\LNRCdKP.exe
  C:\Windows\System\LNRCdKP.exe
  2⤵
  PID:6056
- C:\Windows\System\ZivTUfg.exe
  C:\Windows\System\ZivTUfg.exe
  2⤵
  PID:6072
- C:\Windows\System\TOyTxlf.exe
  C:\Windows\System\TOyTxlf.exe
  2⤵
  PID:6092
- C:\Windows\System\yZszCDF.exe
  C:\Windows\System\yZszCDF.exe
  2⤵
  PID:6108
- C:\Windows\System\fFHxzaz.exe
  C:\Windows\System\fFHxzaz.exe
  2⤵
  PID:6124
- C:\Windows\System\xcesTOQ.exe
  C:\Windows\System\xcesTOQ.exe
  2⤵
  PID:6140
- C:\Windows\System\YWTVpXV.exe
  C:\Windows\System\YWTVpXV.exe
  2⤵
  PID:4472
- C:\Windows\System\KvubksO.exe
  C:\Windows\System\KvubksO.exe
  2⤵
  PID:3272
- C:\Windows\System\NskCRcF.exe
  C:\Windows\System\NskCRcF.exe
  2⤵
  PID:4900
- C:\Windows\System\kWMhrWZ.exe
  C:\Windows\System\kWMhrWZ.exe
  2⤵
  PID:5168
- C:\Windows\System\zFgVJFp.exe
  C:\Windows\System\zFgVJFp.exe
  2⤵
  PID:3808
- C:\Windows\System\KdUlkUF.exe
  C:\Windows\System\KdUlkUF.exe
  2⤵
  PID:1596
- C:\Windows\System\hBGroZA.exe
  C:\Windows\System\hBGroZA.exe
  2⤵
  PID:4328
- C:\Windows\System\MZuIGON.exe
  C:\Windows\System\MZuIGON.exe
  2⤵
  PID:4368
- C:\Windows\System\NDGemlO.exe
  C:\Windows\System\NDGemlO.exe
  2⤵
  PID:4560
- C:\Windows\System\DqlhrCc.exe
  C:\Windows\System\DqlhrCc.exe
  2⤵
  PID:4444
- C:\Windows\System\GsAUCqU.exe
  C:\Windows\System\GsAUCqU.exe
  2⤵
  PID:5024
- C:\Windows\System\WcOrCeq.exe
  C:\Windows\System\WcOrCeq.exe
  2⤵
  PID:5180
- C:\Windows\System\RVlIDNa.exe
  C:\Windows\System\RVlIDNa.exe
  2⤵
  PID:5188
- C:\Windows\System\hAqhsoa.exe
  C:\Windows\System\hAqhsoa.exe
  2⤵
  PID:5236
- C:\Windows\System\wUlzSER.exe
  C:\Windows\System\wUlzSER.exe
  2⤵
  PID:5252
- C:\Windows\System\XJpdHFa.exe
  C:\Windows\System\XJpdHFa.exe
  2⤵
  PID:5280
- C:\Windows\System\uhAUWHv.exe
  C:\Windows\System\uhAUWHv.exe
  2⤵
  PID:5272
- C:\Windows\System\SFXmPFL.exe
  C:\Windows\System\SFXmPFL.exe
  2⤵
  PID:5292
- C:\Windows\System\OGKlVIO.exe
  C:\Windows\System\OGKlVIO.exe
  2⤵
  PID:5316
- C:\Windows\System\CgtLekb.exe
  C:\Windows\System\CgtLekb.exe
  2⤵
  PID:5380
- C:\Windows\System\XmyoXPJ.exe
  C:\Windows\System\XmyoXPJ.exe
  2⤵
  PID:5300
- C:\Windows\System\UcNinXx.exe
  C:\Windows\System\UcNinXx.exe
  2⤵
  PID:5396
- C:\Windows\System\YyAKUSI.exe
  C:\Windows\System\YyAKUSI.exe
  2⤵
  PID:5416
- C:\Windows\System\DyIiQBw.exe
  C:\Windows\System\DyIiQBw.exe
  2⤵
  PID:5452
- C:\Windows\System\ohITbRW.exe
  C:\Windows\System\ohITbRW.exe
  2⤵
  PID:5484
- C:\Windows\System\nXQFYTj.exe
  C:\Windows\System\nXQFYTj.exe
  2⤵
  PID:1548
- C:\Windows\System\ydGuuVL.exe
  C:\Windows\System\ydGuuVL.exe
  2⤵
  PID:5528
- C:\Windows\System\TUtdpMg.exe
  C:\Windows\System\TUtdpMg.exe
  2⤵
  PID:5564
- C:\Windows\System\RRNxoNU.exe
  C:\Windows\System\RRNxoNU.exe
  2⤵
  PID:5636
- C:\Windows\System\JVPwYlO.exe
  C:\Windows\System\JVPwYlO.exe
  2⤵
  PID:5716
- C:\Windows\System\YSlayJL.exe
  C:\Windows\System\YSlayJL.exe
  2⤵
  PID:5620
- C:\Windows\System\bBjmtxt.exe
  C:\Windows\System\bBjmtxt.exe
  2⤵
  PID:5588
- C:\Windows\System\CKgECTL.exe
  C:\Windows\System\CKgECTL.exe
  2⤵
  PID:5668
- C:\Windows\System\FVHMNNW.exe
  C:\Windows\System\FVHMNNW.exe
  2⤵
  PID:5644
- C:\Windows\System\qVmBNmm.exe
  C:\Windows\System\qVmBNmm.exe
  2⤵
  PID:5756
- C:\Windows\System\eGFsJsa.exe
  C:\Windows\System\eGFsJsa.exe
  2⤵
  PID:5796
- C:\Windows\System\KPITYeW.exe
  C:\Windows\System\KPITYeW.exe
  2⤵
  PID:5824
- C:\Windows\System\UlFgdpK.exe
  C:\Windows\System\UlFgdpK.exe
  2⤵
  PID:5932
- C:\Windows\System\dRUQPXZ.exe
  C:\Windows\System\dRUQPXZ.exe
  2⤵
  PID:5996
- C:\Windows\System\kxdUQwL.exe
  C:\Windows\System\kxdUQwL.exe
  2⤵
  PID:6032
- C:\Windows\System\JvYVaiX.exe
  C:\Windows\System\JvYVaiX.exe
  2⤵
  PID:6100
- C:\Windows\System\EklPxBh.exe
  C:\Windows\System\EklPxBh.exe
  2⤵
  PID:4384
- C:\Windows\System\GeQFMag.exe
  C:\Windows\System\GeQFMag.exe
  2⤵
  PID:4024
- C:\Windows\System\YBMFjpB.exe
  C:\Windows\System\YBMFjpB.exe
  2⤵
  PID:2636
- C:\Windows\System\YArBgoo.exe
  C:\Windows\System\YArBgoo.exe
  2⤵
  PID:5248
- C:\Windows\System\oGLULvh.exe
  C:\Windows\System\oGLULvh.exe
  2⤵
  PID:5332
- C:\Windows\System\eLVTsEc.exe
  C:\Windows\System\eLVTsEc.exe
  2⤵
  PID:5468
- C:\Windows\System\ZDgXpwT.exe
  C:\Windows\System\ZDgXpwT.exe
  2⤵
  PID:932
- C:\Windows\System\QkRQATX.exe
  C:\Windows\System\QkRQATX.exe
  2⤵
  PID:2368
- C:\Windows\System\xGSexVG.exe
  C:\Windows\System\xGSexVG.exe
  2⤵
  PID:4792
- C:\Windows\System\bCuyulK.exe
  C:\Windows\System\bCuyulK.exe
  2⤵
  PID:5348
- C:\Windows\System\ZERgMel.exe
  C:\Windows\System\ZERgMel.exe
  2⤵
  PID:5448
- C:\Windows\System\uNDnlER.exe
  C:\Windows\System\uNDnlER.exe
  2⤵
  PID:5544
- C:\Windows\System\syssLaW.exe
  C:\Windows\System\syssLaW.exe
  2⤵
  PID:5580
- C:\Windows\System\vTqySFW.exe
  C:\Windows\System\vTqySFW.exe
  2⤵
  PID:5856
- C:\Windows\System\ZOqaQer.exe
  C:\Windows\System\ZOqaQer.exe
  2⤵
  PID:5264
- C:\Windows\System\IYiOYkQ.exe
  C:\Windows\System\IYiOYkQ.exe
  2⤵
  PID:4436
- C:\Windows\System\RHCgXIJ.exe
  C:\Windows\System\RHCgXIJ.exe
  2⤵
  PID:5216
- C:\Windows\System\acbkUZg.exe
  C:\Windows\System\acbkUZg.exe
  2⤵
  PID:4672
- C:\Windows\System\krFtyhL.exe
  C:\Windows\System\krFtyhL.exe
  2⤵
  PID:5480
- C:\Windows\System\GyGfbNr.exe
  C:\Windows\System\GyGfbNr.exe
  2⤵
  PID:5364
- C:\Windows\System\klYXbab.exe
  C:\Windows\System\klYXbab.exe
  2⤵
  PID:5876
- C:\Windows\System\fKmJZSN.exe
  C:\Windows\System\fKmJZSN.exe
  2⤵
  PID:5916
- C:\Windows\System\kLCbGfI.exe
  C:\Windows\System\kLCbGfI.exe
  2⤵
  PID:5984
- C:\Windows\System\omOaRrS.exe
  C:\Windows\System\omOaRrS.exe
  2⤵
  PID:6052
- C:\Windows\System\tvUTddG.exe
  C:\Windows\System\tvUTddG.exe
  2⤵
  PID:4548
- C:\Windows\System\SoTvVkZ.exe
  C:\Windows\System\SoTvVkZ.exe
  2⤵
  PID:4260
- C:\Windows\System\gxsNupK.exe
  C:\Windows\System\gxsNupK.exe
  2⤵
  PID:4412
- C:\Windows\System\qRcuHEL.exe
  C:\Windows\System\qRcuHEL.exe
  2⤵
  PID:5696
- C:\Windows\System\maPGIvg.exe
  C:\Windows\System\maPGIvg.exe
  2⤵
  PID:5512
- C:\Windows\System\SDEulFr.exe
  C:\Windows\System\SDEulFr.exe
  2⤵
  PID:5712
- C:\Windows\System\xUNXUFS.exe
  C:\Windows\System\xUNXUFS.exe
  2⤵
  PID:6088
- C:\Windows\System\rhQgUkB.exe
  C:\Windows\System\rhQgUkB.exe
  2⤵
  PID:5840
- C:\Windows\System\AIplqIE.exe
  C:\Windows\System\AIplqIE.exe
  2⤵
  PID:6152
- C:\Windows\System\okZORmH.exe
  C:\Windows\System\okZORmH.exe
  2⤵
  PID:6168
- C:\Windows\System\IJaDPCF.exe
  C:\Windows\System\IJaDPCF.exe
  2⤵
  PID:6188
- C:\Windows\System\QbxFWOb.exe
  C:\Windows\System\QbxFWOb.exe
  2⤵
  PID:6208
- C:\Windows\System\lqOYDjg.exe
  C:\Windows\System\lqOYDjg.exe
  2⤵
  PID:6224
- C:\Windows\System\xHJrvFo.exe
  C:\Windows\System\xHJrvFo.exe
  2⤵
  PID:6240
- C:\Windows\System\oIqKLco.exe
  C:\Windows\System\oIqKLco.exe
  2⤵
  PID:6256
- C:\Windows\System\gncuhRe.exe
  C:\Windows\System\gncuhRe.exe
  2⤵
  PID:6284
- C:\Windows\System\rNjiHJR.exe
  C:\Windows\System\rNjiHJR.exe
  2⤵
  PID:6304
- C:\Windows\System\lfbNMDU.exe
  C:\Windows\System\lfbNMDU.exe
  2⤵
  PID:6320
- C:\Windows\System\AhCbzop.exe
  C:\Windows\System\AhCbzop.exe
  2⤵
  PID:6336
- C:\Windows\System\LRKAfEM.exe
  C:\Windows\System\LRKAfEM.exe
  2⤵
  PID:6356
- C:\Windows\System\HYOveHy.exe
  C:\Windows\System\HYOveHy.exe
  2⤵
  PID:6372
- C:\Windows\System\GZKNxOr.exe
  C:\Windows\System\GZKNxOr.exe
  2⤵
  PID:6388
- C:\Windows\System\uriBvRR.exe
  C:\Windows\System\uriBvRR.exe
  2⤵
  PID:6404
- C:\Windows\System\UDgEJWi.exe
  C:\Windows\System\UDgEJWi.exe
  2⤵
  PID:6420
- C:\Windows\System\LCjFnVm.exe
  C:\Windows\System\LCjFnVm.exe
  2⤵
  PID:6440
- C:\Windows\System\aKEnmPA.exe
  C:\Windows\System\aKEnmPA.exe
  2⤵
  PID:6456
- C:\Windows\System\auwxMIr.exe
  C:\Windows\System\auwxMIr.exe
  2⤵
  PID:6476
- C:\Windows\System\DUeNGFa.exe
  C:\Windows\System\DUeNGFa.exe
  2⤵
  PID:6492
- C:\Windows\System\fCFVvRH.exe
  C:\Windows\System\fCFVvRH.exe
  2⤵
  PID:6532
- C:\Windows\System\hBQFotC.exe
  C:\Windows\System\hBQFotC.exe
  2⤵
  PID:6548
- C:\Windows\System\jtTyxMe.exe
  C:\Windows\System\jtTyxMe.exe
  2⤵
  PID:6564
- C:\Windows\System\sMLMNTl.exe
  C:\Windows\System\sMLMNTl.exe
  2⤵
  PID:6580
- C:\Windows\System\CAKpiCs.exe
  C:\Windows\System\CAKpiCs.exe
  2⤵
  PID:6596
- C:\Windows\System\hdSONKH.exe
  C:\Windows\System\hdSONKH.exe
  2⤵
  PID:6612
- C:\Windows\System\QHdvGfU.exe
  C:\Windows\System\QHdvGfU.exe
  2⤵
  PID:6628
- C:\Windows\System\udbGEHQ.exe
  C:\Windows\System\udbGEHQ.exe
  2⤵
  PID:6644
- C:\Windows\System\GhtXccn.exe
  C:\Windows\System\GhtXccn.exe
  2⤵
  PID:6660
- C:\Windows\System\ejoRswT.exe
  C:\Windows\System\ejoRswT.exe
  2⤵
  PID:6676
- C:\Windows\System\wmtfpwT.exe
  C:\Windows\System\wmtfpwT.exe
  2⤵
  PID:6692
- C:\Windows\System\jGgxEDE.exe
  C:\Windows\System\jGgxEDE.exe
  2⤵
  PID:6708
- C:\Windows\System\GIwdyBF.exe
  C:\Windows\System\GIwdyBF.exe
  2⤵
  PID:6724
- C:\Windows\System\lscSpQg.exe
  C:\Windows\System\lscSpQg.exe
  2⤵
  PID:6740
- C:\Windows\System\azeihLn.exe
  C:\Windows\System\azeihLn.exe
  2⤵
  PID:6756
- C:\Windows\System\eyoLqaD.exe
  C:\Windows\System\eyoLqaD.exe
  2⤵
  PID:6772
- C:\Windows\System\TUZlmXy.exe
  C:\Windows\System\TUZlmXy.exe
  2⤵
  PID:6788
- C:\Windows\System\axeXYtN.exe
  C:\Windows\System\axeXYtN.exe
  2⤵
  PID:6804
- C:\Windows\System\iEoODZR.exe
  C:\Windows\System\iEoODZR.exe
  2⤵
  PID:6820
- C:\Windows\System\odtZRon.exe
  C:\Windows\System\odtZRon.exe
  2⤵
  PID:6836
- C:\Windows\System\lKIllFb.exe
  C:\Windows\System\lKIllFb.exe
  2⤵
  PID:6852
- C:\Windows\System\YnYatky.exe
  C:\Windows\System\YnYatky.exe
  2⤵
  PID:6868
- C:\Windows\System\hwjDcCN.exe
  C:\Windows\System\hwjDcCN.exe
  2⤵
  PID:6888
- C:\Windows\System\jSPEPnZ.exe
  C:\Windows\System\jSPEPnZ.exe
  2⤵
  PID:6904
- C:\Windows\System\MpaIMGU.exe
  C:\Windows\System\MpaIMGU.exe
  2⤵
  PID:6920
- C:\Windows\System\ZXGyZCB.exe
  C:\Windows\System\ZXGyZCB.exe
  2⤵
  PID:6936
- C:\Windows\System\WmZFazj.exe
  C:\Windows\System\WmZFazj.exe
  2⤵
  PID:6952
- C:\Windows\System\prIgieE.exe
  C:\Windows\System\prIgieE.exe
  2⤵
  PID:6968
- C:\Windows\System\iMIOAMI.exe
  C:\Windows\System\iMIOAMI.exe
  2⤵
  PID:6984
- C:\Windows\System\PyovmuF.exe
  C:\Windows\System\PyovmuF.exe
  2⤵
  PID:7000
- C:\Windows\System\vyDymWa.exe
  C:\Windows\System\vyDymWa.exe
  2⤵
  PID:7016
- C:\Windows\System\nkhUois.exe
  C:\Windows\System\nkhUois.exe
  2⤵
  PID:7032
- C:\Windows\System\eTltfgW.exe
  C:\Windows\System\eTltfgW.exe
  2⤵
  PID:7048
- C:\Windows\System\OkhnSCx.exe
  C:\Windows\System\OkhnSCx.exe
  2⤵
  PID:7064
- C:\Windows\System\RhVlEIO.exe
  C:\Windows\System\RhVlEIO.exe
  2⤵
  PID:7080
- C:\Windows\System\gHNBjXF.exe
  C:\Windows\System\gHNBjXF.exe
  2⤵
  PID:7096
- C:\Windows\System\xGdsVen.exe
  C:\Windows\System\xGdsVen.exe
  2⤵
  PID:7112
- C:\Windows\System\LTEMthN.exe
  C:\Windows\System\LTEMthN.exe
  2⤵
  PID:7128
- C:\Windows\System\zFgTebl.exe
  C:\Windows\System\zFgTebl.exe
  2⤵
  PID:7144
- C:\Windows\System\bzGsxQu.exe
  C:\Windows\System\bzGsxQu.exe
  2⤵
  PID:7160
- C:\Windows\System\OSTMatW.exe
  C:\Windows\System\OSTMatW.exe
  2⤵
  PID:5812
- C:\Windows\System\niOkWsc.exe
  C:\Windows\System\niOkWsc.exe
  2⤵
  PID:6216
- C:\Windows\System\BNyetxF.exe
  C:\Windows\System\BNyetxF.exe
  2⤵
  PID:6292
- C:\Windows\System\glaNDWJ.exe
  C:\Windows\System\glaNDWJ.exe
  2⤵
  PID:6364
- C:\Windows\System\SVgoxvZ.exe
  C:\Windows\System\SVgoxvZ.exe
  2⤵
  PID:6428
- C:\Windows\System\RkYJEyQ.exe
  C:\Windows\System\RkYJEyQ.exe
  2⤵
  PID:5964
- C:\Windows\System\OfWtigK.exe
  C:\Windows\System\OfWtigK.exe
  2⤵
  PID:5684
- C:\Windows\System\JNjiYsY.exe
  C:\Windows\System\JNjiYsY.exe
  2⤵
  PID:5616
- C:\Windows\System\IBCmUkd.exe
  C:\Windows\System\IBCmUkd.exe
  2⤵
  PID:5288
- C:\Windows\System\LMauepC.exe
  C:\Windows\System\LMauepC.exe
  2⤵
  PID:5908
- C:\Windows\System\JieiLLT.exe
  C:\Windows\System\JieiLLT.exe
  2⤵
  PID:5244
- C:\Windows\System\qvsFpFf.exe
  C:\Windows\System\qvsFpFf.exe
  2⤵
  PID:5432
- C:\Windows\System\GxKFeOE.exe
  C:\Windows\System\GxKFeOE.exe
  2⤵
  PID:5632
- C:\Windows\System\VONUzfy.exe
  C:\Windows\System\VONUzfy.exe
  2⤵
  PID:5776
- C:\Windows\System\ygbOmXW.exe
  C:\Windows\System\ygbOmXW.exe
  2⤵
  PID:4380
- C:\Windows\System\tMREyqk.exe
  C:\Windows\System\tMREyqk.exe
  2⤵
  PID:5164
- C:\Windows\System\dlXuaqS.exe
  C:\Windows\System\dlXuaqS.exe
  2⤵
  PID:6432
- C:\Windows\System\gtBShtV.exe
  C:\Windows\System\gtBShtV.exe
  2⤵
  PID:3916
- C:\Windows\System\djLFxeo.exe
  C:\Windows\System\djLFxeo.exe
  2⤵
  PID:6164
- C:\Windows\System\dPUqPyO.exe
  C:\Windows\System\dPUqPyO.exe
  2⤵
  PID:6232
- C:\Windows\System\NpYEWpq.exe
  C:\Windows\System\NpYEWpq.exe
  2⤵
  PID:6508
- C:\Windows\System\MRnAjeq.exe
  C:\Windows\System\MRnAjeq.exe
  2⤵
  PID:6448
- C:\Windows\System\htBysac.exe
  C:\Windows\System\htBysac.exe
  2⤵
  PID:6560
- C:\Windows\System\KiOmjWZ.exe
  C:\Windows\System\KiOmjWZ.exe
  2⤵
  PID:6624
- C:\Windows\System\xcDcHBW.exe
  C:\Windows\System\xcDcHBW.exe
  2⤵
  PID:6684
- C:\Windows\System\yasaDID.exe
  C:\Windows\System\yasaDID.exe
  2⤵
  PID:6748
- C:\Windows\System\gFhPpsk.exe
  C:\Windows\System\gFhPpsk.exe
  2⤵
  PID:6812
- C:\Windows\System\tEHuiHG.exe
  C:\Windows\System\tEHuiHG.exe
  2⤵
  PID:6344
- C:\Windows\System\RndlCwL.exe
  C:\Windows\System\RndlCwL.exe
  2⤵
  PID:6912
- C:\Windows\System\tMxiBkq.exe
  C:\Windows\System\tMxiBkq.exe
  2⤵
  PID:6672
- C:\Windows\System\KSiAyJw.exe
  C:\Windows\System\KSiAyJw.exe
  2⤵
  PID:6736
- C:\Windows\System\AJxijuX.exe
  C:\Windows\System\AJxijuX.exe
  2⤵
  PID:6800
- C:\Windows\System\gfGRFmS.exe
  C:\Windows\System\gfGRFmS.exe
  2⤵
  PID:6280
- C:\Windows\System\GytXDVA.exe
  C:\Windows\System\GytXDVA.exe
  2⤵
  PID:6380
- C:\Windows\System\LPcSGsf.exe
  C:\Windows\System\LPcSGsf.exe
  2⤵
  PID:6452
- C:\Windows\System\YHRTtaY.exe
  C:\Windows\System\YHRTtaY.exe
  2⤵
  PID:6828
- C:\Windows\System\VuiOfvK.exe
  C:\Windows\System\VuiOfvK.exe
  2⤵
  PID:6544
- C:\Windows\System\elenxkx.exe
  C:\Windows\System\elenxkx.exe
  2⤵
  PID:6608
- C:\Windows\System\oVMtNjD.exe
  C:\Windows\System\oVMtNjD.exe
  2⤵
  PID:6896
- C:\Windows\System\KHvsIYO.exe
  C:\Windows\System\KHvsIYO.exe
  2⤵
  PID:6960
- C:\Windows\System\SksLgam.exe
  C:\Windows\System\SksLgam.exe
  2⤵
  PID:7040
- C:\Windows\System\xEnAZZM.exe
  C:\Windows\System\xEnAZZM.exe
  2⤵
  PID:6964
- C:\Windows\System\FrngVns.exe
  C:\Windows\System\FrngVns.exe
  2⤵
  PID:7028
- C:\Windows\System\TzGHsIJ.exe
  C:\Windows\System\TzGHsIJ.exe
  2⤵
  PID:7088
- C:\Windows\System\GVAtMXw.exe
  C:\Windows\System\GVAtMXw.exe
  2⤵
  PID:7136
- C:\Windows\System\TqstINz.exe
  C:\Windows\System\TqstINz.exe
  2⤵
  PID:7156
- C:\Windows\System\gpJsekL.exe
  C:\Windows\System\gpJsekL.exe
  2⤵
  PID:7120
- C:\Windows\System\iCZGsIN.exe
  C:\Windows\System\iCZGsIN.exe
  2⤵
  PID:6464
- C:\Windows\System\gxriTwh.exe
  C:\Windows\System\gxriTwh.exe
  2⤵
  PID:6016
- C:\Windows\System\qLnkdiu.exe
  C:\Windows\System\qLnkdiu.exe
  2⤵
  PID:5600
- C:\Windows\System\sOgtsJb.exe
  C:\Windows\System\sOgtsJb.exe
  2⤵
  PID:6248
- C:\Windows\System\BvDHaQf.exe
  C:\Windows\System\BvDHaQf.exe
  2⤵
  PID:5860
- C:\Windows\System\oFoIsyA.exe
  C:\Windows\System\oFoIsyA.exe
  2⤵
  PID:5476
- C:\Windows\System\trvptjP.exe
  C:\Windows\System\trvptjP.exe
  2⤵
  PID:6296
- C:\Windows\System\Wlalvyf.exe
  C:\Windows\System\Wlalvyf.exe
  2⤵
  PID:6268
- C:\Windows\System\ZieIJbZ.exe
  C:\Windows\System\ZieIJbZ.exe
  2⤵
  PID:5128
- C:\Windows\System\TeuyzxB.exe
  C:\Windows\System\TeuyzxB.exe
  2⤵
  PID:6784
- C:\Windows\System\JAtjkMA.exe
  C:\Windows\System\JAtjkMA.exe
  2⤵
  PID:6704
- C:\Windows\System\PKPARjI.exe
  C:\Windows\System\PKPARjI.exe
  2⤵
  PID:6412
- C:\Windows\System\TadWyuz.exe
  C:\Windows\System\TadWyuz.exe
  2⤵
  PID:6640
- C:\Windows\System\TsVAJZU.exe
  C:\Windows\System\TsVAJZU.exe
  2⤵
  PID:6272
- C:\Windows\System\HCAdBfK.exe
  C:\Windows\System\HCAdBfK.exe
  2⤵
  PID:6472
- C:\Windows\System\PTJesga.exe
  C:\Windows\System\PTJesga.exe
  2⤵
  PID:6592
- C:\Windows\System\VZniiVp.exe
  C:\Windows\System\VZniiVp.exe
  2⤵
  PID:6844
- C:\Windows\System\KCYJtTz.exe
  C:\Windows\System\KCYJtTz.exe
  2⤵
  PID:6768
- C:\Windows\System\behXKqw.exe
  C:\Windows\System\behXKqw.exe
  2⤵
  PID:6352
- C:\Windows\System\WVfwehn.exe
  C:\Windows\System\WVfwehn.exe
  2⤵
  PID:6604
- C:\Windows\System\uLxhJLx.exe
  C:\Windows\System\uLxhJLx.exe
  2⤵
  PID:5980
- C:\Windows\System\aNxgkLK.exe
  C:\Windows\System\aNxgkLK.exe
  2⤵
  PID:6276
- C:\Windows\System\bTGLagp.exe
  C:\Windows\System\bTGLagp.exe
  2⤵
  PID:5508
- C:\Windows\System\AtYFzWK.exe
  C:\Windows\System\AtYFzWK.exe
  2⤵
  PID:2652
- C:\Windows\System\kNQceTB.exe
  C:\Windows\System\kNQceTB.exe
  2⤵
  PID:6540
- C:\Windows\System\GRcdqZo.exe
  C:\Windows\System\GRcdqZo.exe
  2⤵
  PID:5748
- C:\Windows\System\cCTCCcz.exe
  C:\Windows\System\cCTCCcz.exe
  2⤵
  PID:6520
- C:\Windows\System\VjszbkC.exe
  C:\Windows\System\VjszbkC.exe
  2⤵
  PID:6576
- C:\Windows\System\njJbiRG.exe
  C:\Windows\System\njJbiRG.exe
  2⤵
  PID:6796
- C:\Windows\System\Svskpcn.exe
  C:\Windows\System\Svskpcn.exe
  2⤵
  PID:7124
- C:\Windows\System\zhzlSJl.exe
  C:\Windows\System\zhzlSJl.exe
  2⤵
  PID:7104
- C:\Windows\System\framzhd.exe
  C:\Windows\System\framzhd.exe
  2⤵
  PID:6068
- C:\Windows\System\ZtvzFew.exe
  C:\Windows\System\ZtvzFew.exe
  2⤵
  PID:6780
- C:\Windows\System\ngBoUVY.exe
  C:\Windows\System\ngBoUVY.exe
  2⤵
  PID:7172
- C:\Windows\System\tWotWfq.exe
  C:\Windows\System\tWotWfq.exe
  2⤵
  PID:7188
- C:\Windows\System\TijBTcS.exe
  C:\Windows\System\TijBTcS.exe
  2⤵
  PID:7204
- C:\Windows\System\VvOjosY.exe
  C:\Windows\System\VvOjosY.exe
  2⤵
  PID:7220
- C:\Windows\System\MnoQoRm.exe
  C:\Windows\System\MnoQoRm.exe
  2⤵
  PID:7236
- C:\Windows\System\XcyATSQ.exe
  C:\Windows\System\XcyATSQ.exe
  2⤵
  PID:7252
- C:\Windows\System\TVyyOUt.exe
  C:\Windows\System\TVyyOUt.exe
  2⤵
  PID:7276
- C:\Windows\System\PjVmHRp.exe
  C:\Windows\System\PjVmHRp.exe
  2⤵
  PID:7292
- C:\Windows\System\GEDBsbg.exe
  C:\Windows\System\GEDBsbg.exe
  2⤵
  PID:7308
- C:\Windows\System\DEFJcKY.exe
  C:\Windows\System\DEFJcKY.exe
  2⤵
  PID:7324
- C:\Windows\System\DEujRdu.exe
  C:\Windows\System\DEujRdu.exe
  2⤵
  PID:7340
- C:\Windows\System\KxrOkhB.exe
  C:\Windows\System\KxrOkhB.exe
  2⤵
  PID:7356
- C:\Windows\System\CMSduQr.exe
  C:\Windows\System\CMSduQr.exe
  2⤵
  PID:7372
- C:\Windows\System\glqcEyF.exe
  C:\Windows\System\glqcEyF.exe
  2⤵
  PID:7388
- C:\Windows\System\jOvjqWf.exe
  C:\Windows\System\jOvjqWf.exe
  2⤵
  PID:7404
- C:\Windows\System\fYliKpr.exe
  C:\Windows\System\fYliKpr.exe
  2⤵
  PID:7420
- C:\Windows\System\KyrVTws.exe
  C:\Windows\System\KyrVTws.exe
  2⤵
  PID:7436
- C:\Windows\System\mPOQfJH.exe
  C:\Windows\System\mPOQfJH.exe
  2⤵
  PID:7452
- C:\Windows\System\DvqZbtk.exe
  C:\Windows\System\DvqZbtk.exe
  2⤵
  PID:7468
- C:\Windows\System\FJHLDFP.exe
  C:\Windows\System\FJHLDFP.exe
  2⤵
  PID:7484
- C:\Windows\System\dQfEviU.exe
  C:\Windows\System\dQfEviU.exe
  2⤵
  PID:7500
- C:\Windows\System\RGMHxQj.exe
  C:\Windows\System\RGMHxQj.exe
  2⤵
  PID:7516
- C:\Windows\System\OEgOvmW.exe
  C:\Windows\System\OEgOvmW.exe
  2⤵
  PID:7532
- C:\Windows\System\bXayOMJ.exe
  C:\Windows\System\bXayOMJ.exe
  2⤵
  PID:7548
- C:\Windows\System\AAMYfxA.exe
  C:\Windows\System\AAMYfxA.exe
  2⤵
  PID:7568
- C:\Windows\System\TxEYQYC.exe
  C:\Windows\System\TxEYQYC.exe
  2⤵
  PID:7584
- C:\Windows\System\NyFLSyr.exe
  C:\Windows\System\NyFLSyr.exe
  2⤵
  PID:7600
- C:\Windows\System\eSLEwbm.exe
  C:\Windows\System\eSLEwbm.exe
  2⤵
  PID:7616
- C:\Windows\System\NXugvFW.exe
  C:\Windows\System\NXugvFW.exe
  2⤵
  PID:7632
- C:\Windows\System\QBXqqXk.exe
  C:\Windows\System\QBXqqXk.exe
  2⤵
  PID:7648
- C:\Windows\System\zvLDFiv.exe
  C:\Windows\System\zvLDFiv.exe
  2⤵
  PID:7664
- C:\Windows\System\GpiINGB.exe
  C:\Windows\System\GpiINGB.exe
  2⤵
  PID:7680
- C:\Windows\System\QaWzIKx.exe
  C:\Windows\System\QaWzIKx.exe
  2⤵
  PID:7696
- C:\Windows\System\zRcNTKm.exe
  C:\Windows\System\zRcNTKm.exe
  2⤵
  PID:7712
- C:\Windows\System\RdttaDt.exe
  C:\Windows\System\RdttaDt.exe
  2⤵
  PID:7736
- C:\Windows\System\JsHpLUR.exe
  C:\Windows\System\JsHpLUR.exe
  2⤵
  PID:7752
- C:\Windows\System\wQDtYxl.exe
  C:\Windows\System\wQDtYxl.exe
  2⤵
  PID:7768
- C:\Windows\System\GbhIDGK.exe
  C:\Windows\System\GbhIDGK.exe
  2⤵
  PID:7784
- C:\Windows\System\YKWqexr.exe
  C:\Windows\System\YKWqexr.exe
  2⤵
  PID:7800
- C:\Windows\System\BveNqGf.exe
  C:\Windows\System\BveNqGf.exe
  2⤵
  PID:7816
- C:\Windows\System\dSfoiBC.exe
  C:\Windows\System\dSfoiBC.exe
  2⤵
  PID:7836
- C:\Windows\System\kYKZLOG.exe
  C:\Windows\System\kYKZLOG.exe
  2⤵
  PID:7852
- C:\Windows\System\KfrCrOm.exe
  C:\Windows\System\KfrCrOm.exe
  2⤵
  PID:7868
- C:\Windows\System\aVddHYE.exe
  C:\Windows\System\aVddHYE.exe
  2⤵
  PID:7884
- C:\Windows\System\jtLNdRi.exe
  C:\Windows\System\jtLNdRi.exe
  2⤵
  PID:7900
- C:\Windows\System\gTraECv.exe
  C:\Windows\System\gTraECv.exe
  2⤵
  PID:7916
- C:\Windows\System\iZzwohj.exe
  C:\Windows\System\iZzwohj.exe
  2⤵
  PID:7944
- C:\Windows\System\FWTIznZ.exe
  C:\Windows\System\FWTIznZ.exe
  2⤵
  PID:7960
- C:\Windows\System\WTukmMa.exe
  C:\Windows\System\WTukmMa.exe
  2⤵
  PID:7980
- C:\Windows\System\LSBhfkD.exe
  C:\Windows\System\LSBhfkD.exe
  2⤵
  PID:7996
- C:\Windows\System\BBJnyIf.exe
  C:\Windows\System\BBJnyIf.exe
  2⤵
  PID:8012
- C:\Windows\System\uBJqHfT.exe
  C:\Windows\System\uBJqHfT.exe
  2⤵
  PID:8044
- C:\Windows\System\nolMykb.exe
  C:\Windows\System\nolMykb.exe
  2⤵
  PID:8068
- C:\Windows\System\SRragjz.exe
  C:\Windows\System\SRragjz.exe
  2⤵
  PID:8084
- C:\Windows\System\hpxARDo.exe
  C:\Windows\System\hpxARDo.exe
  2⤵
  PID:8104
- C:\Windows\System\Etwqnzf.exe
  C:\Windows\System\Etwqnzf.exe
  2⤵
  PID:8120
- C:\Windows\System\YWlTuhy.exe
  C:\Windows\System\YWlTuhy.exe
  2⤵
  PID:8168
- C:\Windows\System\QVVZcva.exe
  C:\Windows\System\QVVZcva.exe
  2⤵
  PID:8184
- C:\Windows\System\yrhQqmF.exe
  C:\Windows\System\yrhQqmF.exe
  2⤵
  PID:6516
- C:\Windows\System\oxDjNIY.exe
  C:\Windows\System\oxDjNIY.exe
  2⤵
  PID:6932
- C:\Windows\System\EZIkULD.exe
  C:\Windows\System\EZIkULD.exe
  2⤵
  PID:6500
- C:\Windows\System\ywDBYjI.exe
  C:\Windows\System\ywDBYjI.exe
  2⤵
  PID:7232
- C:\Windows\System\QwBYNmj.exe
  C:\Windows\System\QwBYNmj.exe
  2⤵
  PID:7304
- C:\Windows\System\uSTnAet.exe
  C:\Windows\System\uSTnAet.exe
  2⤵
  PID:7012
- C:\Windows\System\wfIvvyp.exe
  C:\Windows\System\wfIvvyp.exe
  2⤵
  PID:7268
- C:\Windows\System\xcUPIoZ.exe
  C:\Windows\System\xcUPIoZ.exe
  2⤵
  PID:7428
- C:\Windows\System\GdOFknK.exe
  C:\Windows\System\GdOFknK.exe
  2⤵
  PID:7492
- C:\Windows\System\IxfOiuN.exe
  C:\Windows\System\IxfOiuN.exe
  2⤵
  PID:7556
- C:\Windows\System\pMLYWfT.exe
  C:\Windows\System\pMLYWfT.exe
  2⤵
  PID:7596
- C:\Windows\System\ECPZXXL.exe
  C:\Windows\System\ECPZXXL.exe
  2⤵
  PID:7688
- C:\Windows\System\RuMYOVY.exe
  C:\Windows\System\RuMYOVY.exe
  2⤵
  PID:7608
- C:\Windows\System\CUGbMol.exe
  C:\Windows\System\CUGbMol.exe
  2⤵
  PID:7724
- C:\Windows\System\PMbRwZM.exe
  C:\Windows\System\PMbRwZM.exe
  2⤵
  PID:7508
- C:\Windows\System\ErOOKzG.exe
  C:\Windows\System\ErOOKzG.exe
  2⤵
  PID:6864
- C:\Windows\System\kWucwLR.exe
  C:\Windows\System\kWucwLR.exe
  2⤵
  PID:6668
- C:\Windows\System\zCncTjb.exe
  C:\Windows\System\zCncTjb.exe
  2⤵
  PID:6848
- C:\Windows\System\QZdCGob.exe
  C:\Windows\System\QZdCGob.exe
  2⤵
  PID:7212
- C:\Windows\System\QOSBLKl.exe
  C:\Windows\System\QOSBLKl.exe
  2⤵
  PID:7248
- C:\Windows\System\QHRwFCh.exe
  C:\Windows\System\QHRwFCh.exe
  2⤵
  PID:7352
- C:\Windows\System\jDUKoqb.exe
  C:\Windows\System\jDUKoqb.exe
  2⤵
  PID:7416
- C:\Windows\System\HeFnTot.exe
  C:\Windows\System\HeFnTot.exe
  2⤵
  PID:7480
- C:\Windows\System\yIEDhrh.exe
  C:\Windows\System\yIEDhrh.exe
  2⤵
  PID:7708
- C:\Windows\System\oqyYbUq.exe
  C:\Windows\System\oqyYbUq.exe
  2⤵
  PID:7760
- C:\Windows\System\ijdFqWN.exe
  C:\Windows\System\ijdFqWN.exe
  2⤵
  PID:7824
- C:\Windows\System\oJemHJq.exe
  C:\Windows\System\oJemHJq.exe
  2⤵
  PID:7864
- C:\Windows\System\BZUEVFJ.exe
  C:\Windows\System\BZUEVFJ.exe
  2⤵
  PID:7748
- C:\Windows\System\vpcSJVg.exe
  C:\Windows\System\vpcSJVg.exe
  2⤵
  PID:7928
- C:\Windows\System\zWHIbky.exe
  C:\Windows\System\zWHIbky.exe
  2⤵
  PID:7844
- C:\Windows\System\CKsjgeF.exe
  C:\Windows\System\CKsjgeF.exe
  2⤵
  PID:7880
- C:\Windows\System\Gequhaz.exe
  C:\Windows\System\Gequhaz.exe
  2⤵
  PID:7976
- C:\Windows\System\vUNavrH.exe
  C:\Windows\System\vUNavrH.exe
  2⤵
  PID:7956
- C:\Windows\System\pPxHKmB.exe
  C:\Windows\System\pPxHKmB.exe
  2⤵
  PID:8060
- C:\Windows\System\qFUUKJw.exe
  C:\Windows\System\qFUUKJw.exe
  2⤵
  PID:8096
- C:\Windows\System\yagOclW.exe
  C:\Windows\System\yagOclW.exe
  2⤵
  PID:8032
- C:\Windows\System\qjHlmyH.exe
  C:\Windows\System\qjHlmyH.exe
  2⤵
  PID:8024
- C:\Windows\System\AQKCpJH.exe
  C:\Windows\System\AQKCpJH.exe
  2⤵
  PID:8132
- C:\Windows\System\HgJVWAP.exe
  C:\Windows\System\HgJVWAP.exe
  2⤵
  PID:8148
- C:\Windows\System\wsqDiYI.exe
  C:\Windows\System\wsqDiYI.exe
  2⤵
  PID:6328
- C:\Windows\System\avJRLri.exe
  C:\Windows\System\avJRLri.exe
  2⤵
  PID:5576
- C:\Windows\System\MqDNejZ.exe
  C:\Windows\System\MqDNejZ.exe
  2⤵
  PID:7284
- C:\Windows\System\GLVLMRG.exe
  C:\Windows\System\GLVLMRG.exe
  2⤵
  PID:7796
- C:\Windows\System\PjhnMGR.exe
  C:\Windows\System\PjhnMGR.exe
  2⤵
  PID:6880
- C:\Windows\System\OoWlWTF.exe
  C:\Windows\System\OoWlWTF.exe
  2⤵
  PID:7936
- C:\Windows\System\KfhOeCy.exe
  C:\Windows\System\KfhOeCy.exe
  2⤵
  PID:7988
- C:\Windows\System\lnCYKsa.exe
  C:\Windows\System\lnCYKsa.exe
  2⤵
  PID:8076
- C:\Windows\System\CWXZpXm.exe
  C:\Windows\System\CWXZpXm.exe
  2⤵
  PID:7896
- C:\Windows\System\QmeVMTZ.exe
  C:\Windows\System\QmeVMTZ.exe
  2⤵
  PID:7860
- C:\Windows\System\JlyvphP.exe
  C:\Windows\System\JlyvphP.exe
  2⤵
  PID:7320
- C:\Windows\System\QNIVtOx.exe
  C:\Windows\System\QNIVtOx.exe
  2⤵
  PID:5792
- C:\Windows\System\XbUjvit.exe
  C:\Windows\System\XbUjvit.exe
  2⤵
  PID:7776
- C:\Windows\System\ARWkRMO.exe
  C:\Windows\System\ARWkRMO.exe
  2⤵
  PID:8092
- C:\Windows\System\KuFWfiB.exe
  C:\Windows\System\KuFWfiB.exe
  2⤵
  PID:8144
- C:\Windows\System\ByAxpQk.exe
  C:\Windows\System\ByAxpQk.exe
  2⤵
  PID:6332
- C:\Windows\System\LtJxOQc.exe
  C:\Windows\System\LtJxOQc.exe
  2⤵
  PID:7464
- C:\Windows\System\dUvzaHb.exe
  C:\Windows\System\dUvzaHb.exe
  2⤵
  PID:7200
- C:\Windows\System\bgJxYGU.exe
  C:\Windows\System\bgJxYGU.exe
  2⤵
  PID:7528
- C:\Windows\System\COcYESy.exe
  C:\Windows\System\COcYESy.exe
  2⤵
  PID:8140
- C:\Windows\System\HueptHp.exe
  C:\Windows\System\HueptHp.exe
  2⤵
  PID:7704
- C:\Windows\System\CyEUBYx.exe
  C:\Windows\System\CyEUBYx.exe
  2⤵
  PID:7348
- C:\Windows\System\uYaIZwG.exe
  C:\Windows\System\uYaIZwG.exe
  2⤵
  PID:7628
- C:\Windows\System\Sosvgcm.exe
  C:\Windows\System\Sosvgcm.exe
  2⤵
  PID:7580
- C:\Windows\System\ohAmgAY.exe
  C:\Windows\System\ohAmgAY.exe
  2⤵
  PID:7448
- C:\Windows\System\BjIhVdG.exe
  C:\Windows\System\BjIhVdG.exe
  2⤵
  PID:7336
- C:\Windows\System\xsRcGyl.exe
  C:\Windows\System\xsRcGyl.exe
  2⤵
  PID:7792
- C:\Windows\System\QuqQTvI.exe
  C:\Windows\System\QuqQTvI.exe
  2⤵
  PID:8128
- C:\Windows\System\bRehlWk.exe
  C:\Windows\System\bRehlWk.exe
  2⤵
  PID:7184
- C:\Windows\System\dCQphqr.exe
  C:\Windows\System\dCQphqr.exe
  2⤵
  PID:8064
- C:\Windows\System\pimTWoy.exe
  C:\Windows\System\pimTWoy.exe
  2⤵
  PID:7060
- C:\Windows\System\JwENQvc.exe
  C:\Windows\System\JwENQvc.exe
  2⤵
  PID:8156
- C:\Windows\System\qIACcYL.exe
  C:\Windows\System\qIACcYL.exe
  2⤵
  PID:7676
- C:\Windows\System\rSfZpkC.exe
  C:\Windows\System\rSfZpkC.exe
  2⤵
  PID:7396
- C:\Windows\System\QjGbWjw.exe
  C:\Windows\System\QjGbWjw.exe
  2⤵
  PID:7576
- C:\Windows\System\PEMcDRd.exe
  C:\Windows\System\PEMcDRd.exe
  2⤵
  PID:7672
- C:\Windows\System\zHjmedD.exe
  C:\Windows\System\zHjmedD.exe
  2⤵
  PID:8112
- C:\Windows\System\ndPILJh.exe
  C:\Windows\System\ndPILJh.exe
  2⤵
  PID:7812
- C:\Windows\System\eHyQkNq.exe
  C:\Windows\System\eHyQkNq.exe
  2⤵
  PID:8020
- C:\Windows\System\EqUulGX.exe
  C:\Windows\System\EqUulGX.exe
  2⤵
  PID:7076
- C:\Windows\System\YAbKCYM.exe
  C:\Windows\System\YAbKCYM.exe
  2⤵
  PID:8204
- C:\Windows\System\iDwVWWQ.exe
  C:\Windows\System\iDwVWWQ.exe
  2⤵
  PID:8220
- C:\Windows\System\ESBhoLH.exe
  C:\Windows\System\ESBhoLH.exe
  2⤵
  PID:8236
- C:\Windows\System\wlUrlaI.exe
  C:\Windows\System\wlUrlaI.exe
  2⤵
  PID:8252
- C:\Windows\System\takKymt.exe
  C:\Windows\System\takKymt.exe
  2⤵
  PID:8268
- C:\Windows\System\sSUrdNd.exe
  C:\Windows\System\sSUrdNd.exe
  2⤵
  PID:8284
- C:\Windows\System\GptqPwH.exe
  C:\Windows\System\GptqPwH.exe
  2⤵
  PID:8300
- C:\Windows\System\IPXPMXw.exe
  C:\Windows\System\IPXPMXw.exe
  2⤵
  PID:8316
- C:\Windows\System\JnnwdpN.exe
  C:\Windows\System\JnnwdpN.exe
  2⤵
  PID:8332
- C:\Windows\System\PtRzPkY.exe
  C:\Windows\System\PtRzPkY.exe
  2⤵
  PID:8408
- C:\Windows\System\ePDWQzp.exe
  C:\Windows\System\ePDWQzp.exe
  2⤵
  PID:8424
- C:\Windows\System\QpIQDWo.exe
  C:\Windows\System\QpIQDWo.exe
  2⤵
  PID:8440
- C:\Windows\System\jkSJUUT.exe
  C:\Windows\System\jkSJUUT.exe
  2⤵
  PID:8456
- C:\Windows\System\HyQYeLk.exe
  C:\Windows\System\HyQYeLk.exe
  2⤵
  PID:8472
- C:\Windows\System\TJqVAOr.exe
  C:\Windows\System\TJqVAOr.exe
  2⤵
  PID:8488
- C:\Windows\System\YBhQynp.exe
  C:\Windows\System\YBhQynp.exe
  2⤵
  PID:8504
- C:\Windows\System\QdheUvO.exe
  C:\Windows\System\QdheUvO.exe
  2⤵
  PID:8520
- C:\Windows\System\nxcBUds.exe
  C:\Windows\System\nxcBUds.exe
  2⤵
  PID:8536
- C:\Windows\System\MQcoyXH.exe
  C:\Windows\System\MQcoyXH.exe
  2⤵
  PID:8552
- C:\Windows\System\MZrjIyL.exe
  C:\Windows\System\MZrjIyL.exe
  2⤵
  PID:8568
- C:\Windows\System\eHQmFxo.exe
  C:\Windows\System\eHQmFxo.exe
  2⤵
  PID:8584
- C:\Windows\System\MXLVlmo.exe
  C:\Windows\System\MXLVlmo.exe
  2⤵
  PID:8600
- C:\Windows\System\ctkYGKs.exe
  C:\Windows\System\ctkYGKs.exe
  2⤵
  PID:8616
- C:\Windows\System\OHYSNYY.exe
  C:\Windows\System\OHYSNYY.exe
  2⤵
  PID:8632
- C:\Windows\System\kYFsLqW.exe
  C:\Windows\System\kYFsLqW.exe
  2⤵
  PID:8648
- C:\Windows\System\ucrJwUR.exe
  C:\Windows\System\ucrJwUR.exe
  2⤵
  PID:8664
- C:\Windows\System\fxUHvuX.exe
  C:\Windows\System\fxUHvuX.exe
  2⤵
  PID:8684
- C:\Windows\System\xIiVQio.exe
  C:\Windows\System\xIiVQio.exe
  2⤵
  PID:8700
- C:\Windows\System\rdYydqF.exe
  C:\Windows\System\rdYydqF.exe
  2⤵
  PID:8716
- C:\Windows\System\ASHGIZq.exe
  C:\Windows\System\ASHGIZq.exe
  2⤵
  PID:8732
- C:\Windows\System\iaqCKbt.exe
  C:\Windows\System\iaqCKbt.exe
  2⤵
  PID:8748
- C:\Windows\System\ulpTECA.exe
  C:\Windows\System\ulpTECA.exe
  2⤵
  PID:8764
- C:\Windows\System\gRNQTjN.exe
  C:\Windows\System\gRNQTjN.exe
  2⤵
  PID:8780
- C:\Windows\System\jRXIcxp.exe
  C:\Windows\System\jRXIcxp.exe
  2⤵
  PID:8796
- C:\Windows\System\fPEqxVQ.exe
  C:\Windows\System\fPEqxVQ.exe
  2⤵
  PID:8812
- C:\Windows\System\asEqoQk.exe
  C:\Windows\System\asEqoQk.exe
  2⤵
  PID:8828
- C:\Windows\System\HvbtljU.exe
  C:\Windows\System\HvbtljU.exe
  2⤵
  PID:8844
- C:\Windows\System\HStfMrz.exe
  C:\Windows\System\HStfMrz.exe
  2⤵
  PID:8860
- C:\Windows\System\VCaAjje.exe
  C:\Windows\System\VCaAjje.exe
  2⤵
  PID:8876
- C:\Windows\System\DBHABDp.exe
  C:\Windows\System\DBHABDp.exe
  2⤵
  PID:8892
- C:\Windows\System\mwqXyAI.exe
  C:\Windows\System\mwqXyAI.exe
  2⤵
  PID:8908
- C:\Windows\System\bBXqeLr.exe
  C:\Windows\System\bBXqeLr.exe
  2⤵
  PID:8924
- C:\Windows\System\jpejahT.exe
  C:\Windows\System\jpejahT.exe
  2⤵
  PID:8940
- C:\Windows\System\rwtgpWR.exe
  C:\Windows\System\rwtgpWR.exe
  2⤵
  PID:8956
- C:\Windows\System\eWgYOgQ.exe
  C:\Windows\System\eWgYOgQ.exe
  2⤵
  PID:8976
- C:\Windows\System\WJWvCvB.exe
  C:\Windows\System\WJWvCvB.exe
  2⤵
  PID:8992
- C:\Windows\System\ytnJJCV.exe
  C:\Windows\System\ytnJJCV.exe
  2⤵
  PID:9012
- C:\Windows\System\XAvRDWi.exe
  C:\Windows\System\XAvRDWi.exe
  2⤵
  PID:9028
- C:\Windows\System\AuXlJRQ.exe
  C:\Windows\System\AuXlJRQ.exe
  2⤵
  PID:9044
- C:\Windows\System\JhKivpH.exe
  C:\Windows\System\JhKivpH.exe
  2⤵
  PID:9060
- C:\Windows\System\tDQMtfp.exe
  C:\Windows\System\tDQMtfp.exe
  2⤵
  PID:9076
- C:\Windows\System\FKLTJxl.exe
  C:\Windows\System\FKLTJxl.exe
  2⤵
  PID:9092
- C:\Windows\System\CJDtPrl.exe
  C:\Windows\System\CJDtPrl.exe
  2⤵
  PID:9112
- C:\Windows\System\RRpEWiG.exe
  C:\Windows\System\RRpEWiG.exe
  2⤵
  PID:9128
- C:\Windows\System\yljUIbp.exe
  C:\Windows\System\yljUIbp.exe
  2⤵
  PID:9144
- C:\Windows\System\VqfwObC.exe
  C:\Windows\System\VqfwObC.exe
  2⤵
  PID:9160
- C:\Windows\System\SUNcGLA.exe
  C:\Windows\System\SUNcGLA.exe
  2⤵
  PID:9176
- C:\Windows\System\pbjuqVD.exe
  C:\Windows\System\pbjuqVD.exe
  2⤵
  PID:9192
- C:\Windows\System\rzhewkq.exe
  C:\Windows\System\rzhewkq.exe
  2⤵
  PID:9208
- C:\Windows\System\EboIhdr.exe
  C:\Windows\System\EboIhdr.exe
  2⤵
  PID:8212
- C:\Windows\System\nrOTxZT.exe
  C:\Windows\System\nrOTxZT.exe
  2⤵
  PID:6996
- C:\Windows\System\AISGiQW.exe
  C:\Windows\System\AISGiQW.exe
  2⤵
  PID:8560
- C:\Windows\System\cGBRHuz.exe
  C:\Windows\System\cGBRHuz.exe
  2⤵
  PID:8656
- C:\Windows\System\YIFyvOZ.exe
  C:\Windows\System\YIFyvOZ.exe
  2⤵
  PID:8724
- C:\Windows\System\LFysYbc.exe
  C:\Windows\System\LFysYbc.exe
  2⤵
  PID:8680
- C:\Windows\System\uXVSBvE.exe
  C:\Windows\System\uXVSBvE.exe
  2⤵
  PID:8820
- C:\Windows\System\UezDrXO.exe
  C:\Windows\System\UezDrXO.exe
  2⤵
  PID:8452
- C:\Windows\System\ekhcgsV.exe
  C:\Windows\System\ekhcgsV.exe
  2⤵
  PID:8516
- C:\Windows\System\QtNHYsy.exe
  C:\Windows\System\QtNHYsy.exe
  2⤵
  PID:8612
- C:\Windows\System\oxccjnE.exe
  C:\Windows\System\oxccjnE.exe
  2⤵
  PID:8676
- C:\Windows\System\axJmAXt.exe
  C:\Windows\System\axJmAXt.exe
  2⤵
  PID:8916
- C:\Windows\System\EdjtbeK.exe
  C:\Windows\System\EdjtbeK.exe
  2⤵
  PID:8952
- C:\Windows\System\gLCzuGk.exe
  C:\Windows\System\gLCzuGk.exe
  2⤵
  PID:9052
- C:\Windows\System\UyOSrdX.exe
  C:\Windows\System\UyOSrdX.exe
  2⤵
  PID:9120
- C:\Windows\System\ugHQOTb.exe
  C:\Windows\System\ugHQOTb.exe
  2⤵
  PID:9184
- C:\Windows\System\lUsamMQ.exe
  C:\Windows\System\lUsamMQ.exe
  2⤵
  PID:8808
- C:\Windows\System\TynvDAL.exe
  C:\Windows\System\TynvDAL.exe
  2⤵
  PID:8836
- C:\Windows\System\rFeXIsL.exe
  C:\Windows\System\rFeXIsL.exe
  2⤵
  PID:8872
- C:\Windows\System\muovAVk.exe
  C:\Windows\System\muovAVk.exe
  2⤵
  PID:8972
- C:\Windows\System\pNqTOLE.exe
  C:\Windows\System\pNqTOLE.exe
  2⤵
  PID:9072
- C:\Windows\System\FUZowfD.exe
  C:\Windows\System\FUZowfD.exe
  2⤵
  PID:9140
- C:\Windows\System\QtBokrB.exe
  C:\Windows\System\QtBokrB.exe
  2⤵
  PID:8964
- C:\Windows\System\KmbjXEQ.exe
  C:\Windows\System\KmbjXEQ.exe
  2⤵
  PID:7720
- C:\Windows\System\EBiTyID.exe
  C:\Windows\System\EBiTyID.exe
  2⤵
  PID:8340
- C:\Windows\System\TjvzCbv.exe
  C:\Windows\System\TjvzCbv.exe
  2⤵
  PID:8364
- C:\Windows\System\yBTyVlN.exe
  C:\Windows\System\yBTyVlN.exe
  2⤵
  PID:8392
- C:\Windows\System\FmYGFDH.exe
  C:\Windows\System\FmYGFDH.exe
  2⤵
  PID:8432
- C:\Windows\System\UAhsDXk.exe
  C:\Windows\System\UAhsDXk.exe
  2⤵
  PID:8500
- C:\Windows\System\oBkqRjF.exe
  C:\Windows\System\oBkqRjF.exe
  2⤵
  PID:9156
- C:\Windows\System\DYcSQWo.exe
  C:\Windows\System\DYcSQWo.exe
  2⤵
  PID:8920
- C:\Windows\System\uNNzlEp.exe
  C:\Windows\System\uNNzlEp.exe
  2⤵
  PID:8448
- C:\Windows\System\OxJPvVS.exe
  C:\Windows\System\OxJPvVS.exe
  2⤵
  PID:8624
- C:\Windows\System\cfiqiot.exe
  C:\Windows\System\cfiqiot.exe
  2⤵
  PID:8788
- C:\Windows\System\ZuwZkGR.exe
  C:\Windows\System\ZuwZkGR.exe
  2⤵
  PID:8296
- C:\Windows\System\qgCfZlt.exe
  C:\Windows\System\qgCfZlt.exe
  2⤵
  PID:8644
- C:\Windows\System\SgUMnUN.exe
  C:\Windows\System\SgUMnUN.exe
  2⤵
  PID:9088
- C:\Windows\System\SFIBMKG.exe
  C:\Windows\System\SFIBMKG.exe
  2⤵
  PID:8868
- C:\Windows\System\XzfrMEt.exe
  C:\Windows\System\XzfrMEt.exe
  2⤵
  PID:9200
- C:\Windows\System\dGiQzpB.exe
  C:\Windows\System\dGiQzpB.exe
  2⤵
  PID:8228
- C:\Windows\System\fDqnfTc.exe
  C:\Windows\System\fDqnfTc.exe
  2⤵
  PID:8264
- C:\Windows\System\tOimDCf.exe
  C:\Windows\System\tOimDCf.exe
  2⤵
  PID:8232
- C:\Windows\System\tURDFpz.exe
  C:\Windows\System\tURDFpz.exe
  2⤵
  PID:8308
- C:\Windows\System\yEhqHYA.exe
  C:\Windows\System\yEhqHYA.exe
  2⤵
  PID:8388
- C:\Windows\System\SeKhHFY.exe
  C:\Windows\System\SeKhHFY.exe
  2⤵
  PID:8988
- C:\Windows\System\AILnAKK.exe
  C:\Windows\System\AILnAKK.exe
  2⤵
  PID:8760
- C:\Windows\System\WOCllgw.exe
  C:\Windows\System\WOCllgw.exe
  2⤵
  PID:8352
- C:\Windows\System\GisqBKZ.exe
  C:\Windows\System\GisqBKZ.exe
  2⤵
  PID:8356
- C:\Windows\System\tgRgyao.exe
  C:\Windows\System\tgRgyao.exe
  2⤵
  PID:8532
- C:\Windows\System\GmgkPnH.exe
  C:\Windows\System\GmgkPnH.exe
  2⤵
  PID:8200
- C:\Windows\System\GUaMRBf.exe
  C:\Windows\System\GUaMRBf.exe
  2⤵
  PID:9104
- C:\Windows\System\vSmIGGB.exe
  C:\Windows\System\vSmIGGB.exe
  2⤵
  PID:8744
- C:\Windows\System\QIbSvYj.exe
  C:\Windows\System\QIbSvYj.exe
  2⤵
  PID:8740
- C:\Windows\System\McPvghn.exe
  C:\Windows\System\McPvghn.exe
  2⤵
  PID:9036
- C:\Windows\System\TznDFTY.exe
  C:\Windows\System\TznDFTY.exe
  2⤵
  PID:8276
- C:\Windows\System\BovnhXL.exe
  C:\Windows\System\BovnhXL.exe
  2⤵
  PID:8580
- C:\Windows\System\YdXDabH.exe
  C:\Windows\System\YdXDabH.exe
  2⤵
  PID:8328
- C:\Windows\System\itHGExH.exe
  C:\Windows\System\itHGExH.exe
  2⤵
  PID:8692
- C:\Windows\System\BpWJRJM.exe
  C:\Windows\System\BpWJRJM.exe
  2⤵
  PID:8372
- C:\Windows\System\svrYFGL.exe
  C:\Windows\System\svrYFGL.exe
  2⤵
  PID:8628
- C:\Windows\System\FxUafxD.exe
  C:\Windows\System\FxUafxD.exe
  2⤵
  PID:9084
- C:\Windows\System\tGGbFmX.exe
  C:\Windows\System\tGGbFmX.exe
  2⤵
  PID:8608
- C:\Windows\System\FnBGicg.exe
  C:\Windows\System\FnBGicg.exe
  2⤵
  PID:9228
- C:\Windows\System\NAZbTDz.exe
  C:\Windows\System\NAZbTDz.exe
  2⤵
  PID:9244
- C:\Windows\System\RCqwSql.exe
  C:\Windows\System\RCqwSql.exe
  2⤵
  PID:9260
- C:\Windows\System\FKjBoZD.exe
  C:\Windows\System\FKjBoZD.exe
  2⤵
  PID:9276
- C:\Windows\System\FhhLuOB.exe
  C:\Windows\System\FhhLuOB.exe
  2⤵
  PID:9292
- C:\Windows\System\AkWKrBm.exe
  C:\Windows\System\AkWKrBm.exe
  2⤵
  PID:9316
- C:\Windows\System\osfgnpJ.exe
  C:\Windows\System\osfgnpJ.exe
  2⤵
  PID:9332
- C:\Windows\System\TQcDzmv.exe
  C:\Windows\System\TQcDzmv.exe
  2⤵
  PID:9352
- C:\Windows\System\zTUfHwV.exe
  C:\Windows\System\zTUfHwV.exe
  2⤵
  PID:9368
- C:\Windows\System\MbZgMKU.exe
  C:\Windows\System\MbZgMKU.exe
  2⤵
  PID:9384
- C:\Windows\System\BWspjgz.exe
  C:\Windows\System\BWspjgz.exe
  2⤵
  PID:9400
- C:\Windows\System\doddGbD.exe
  C:\Windows\System\doddGbD.exe
  2⤵
  PID:9416
- C:\Windows\System\gmsjqgZ.exe
  C:\Windows\System\gmsjqgZ.exe
  2⤵
  PID:9432
- C:\Windows\System\fVQvKLn.exe
  C:\Windows\System\fVQvKLn.exe
  2⤵
  PID:9448
- C:\Windows\System\wYOBEEK.exe
  C:\Windows\System\wYOBEEK.exe
  2⤵
  PID:9464
- C:\Windows\System\TQGMBrO.exe
  C:\Windows\System\TQGMBrO.exe
  2⤵
  PID:9480
- C:\Windows\System\mqOGKHL.exe
  C:\Windows\System\mqOGKHL.exe
  2⤵
  PID:9496
- C:\Windows\System\pzrJjmd.exe
  C:\Windows\System\pzrJjmd.exe
  2⤵
  PID:9512
- C:\Windows\System\YCvIhsb.exe
  C:\Windows\System\YCvIhsb.exe
  2⤵
  PID:9528
- C:\Windows\System\omnQStG.exe
  C:\Windows\System\omnQStG.exe
  2⤵
  PID:9556
- C:\Windows\System\LpMlIUA.exe
  C:\Windows\System\LpMlIUA.exe
  2⤵
  PID:9572
- C:\Windows\System\aLpadRn.exe
  C:\Windows\System\aLpadRn.exe
  2⤵
  PID:9588
- C:\Windows\System\uycpjBd.exe
  C:\Windows\System\uycpjBd.exe
  2⤵
  PID:9604
- C:\Windows\System\bNtsCKA.exe
  C:\Windows\System\bNtsCKA.exe
  2⤵
  PID:9620
- C:\Windows\System\nkxHwHb.exe
  C:\Windows\System\nkxHwHb.exe
  2⤵
  PID:9636
- C:\Windows\System\bimImHM.exe
  C:\Windows\System\bimImHM.exe
  2⤵
  PID:9652
- C:\Windows\System\qoDvjHv.exe
  C:\Windows\System\qoDvjHv.exe
  2⤵
  PID:9668
- C:\Windows\System\GeATrtr.exe
  C:\Windows\System\GeATrtr.exe
  2⤵
  PID:9684
- C:\Windows\System\wfcmGjc.exe
  C:\Windows\System\wfcmGjc.exe
  2⤵
  PID:9700
- C:\Windows\System\sRwlRZC.exe
  C:\Windows\System\sRwlRZC.exe
  2⤵
  PID:9716
- C:\Windows\System\KpuFKmm.exe
  C:\Windows\System\KpuFKmm.exe
  2⤵
  PID:9732
- C:\Windows\System\njcfRzI.exe
  C:\Windows\System\njcfRzI.exe
  2⤵
  PID:9748
- C:\Windows\System\ynUWwWs.exe
  C:\Windows\System\ynUWwWs.exe
  2⤵
  PID:9764
- C:\Windows\System\MfYFphx.exe
  C:\Windows\System\MfYFphx.exe
  2⤵
  PID:9780
- C:\Windows\System\ltLmdIF.exe
  C:\Windows\System\ltLmdIF.exe
  2⤵
  PID:9796
- C:\Windows\System\qjfFLwm.exe
  C:\Windows\System\qjfFLwm.exe
  2⤵
  PID:9812
- C:\Windows\System\aQSvBJr.exe
  C:\Windows\System\aQSvBJr.exe
  2⤵
  PID:9828
- C:\Windows\System\xVAxwVt.exe
  C:\Windows\System\xVAxwVt.exe
  2⤵
  PID:9844
- C:\Windows\System\OZYzUwV.exe
  C:\Windows\System\OZYzUwV.exe
  2⤵
  PID:9860
- C:\Windows\System\HiXbCkO.exe
  C:\Windows\System\HiXbCkO.exe
  2⤵
  PID:9876
- C:\Windows\System\pvmTogC.exe
  C:\Windows\System\pvmTogC.exe
  2⤵
  PID:9892
- C:\Windows\System\LmRfans.exe
  C:\Windows\System\LmRfans.exe
  2⤵
  PID:9908
- C:\Windows\System\hgvQNDU.exe
  C:\Windows\System\hgvQNDU.exe
  2⤵
  PID:9924
- C:\Windows\System\AwHstNj.exe
  C:\Windows\System\AwHstNj.exe
  2⤵
  PID:9940
- C:\Windows\System\mfpBTKm.exe
  C:\Windows\System\mfpBTKm.exe
  2⤵
  PID:9956
- C:\Windows\System\IdjouXC.exe
  C:\Windows\System\IdjouXC.exe
  2⤵
  PID:9972
- C:\Windows\System\XQKJqia.exe
  C:\Windows\System\XQKJqia.exe
  2⤵
  PID:9988
- C:\Windows\System\HixmsQY.exe
  C:\Windows\System\HixmsQY.exe
  2⤵
  PID:10004
- C:\Windows\System\jKrpgHC.exe
  C:\Windows\System\jKrpgHC.exe
  2⤵
  PID:10020
- C:\Windows\System\mlSATDe.exe
  C:\Windows\System\mlSATDe.exe
  2⤵
  PID:10036
- C:\Windows\System\tALUCgR.exe
  C:\Windows\System\tALUCgR.exe
  2⤵
  PID:10052
- C:\Windows\System\sMjXISM.exe
  C:\Windows\System\sMjXISM.exe
  2⤵
  PID:10068
- C:\Windows\System\GEqjqzw.exe
  C:\Windows\System\GEqjqzw.exe
  2⤵
  PID:10176
- C:\Windows\System\KfoyiHC.exe
  C:\Windows\System\KfoyiHC.exe
  2⤵
  PID:10212
- C:\Windows\System\hiTkOoM.exe
  C:\Windows\System\hiTkOoM.exe
  2⤵
  PID:10228
- C:\Windows\System\DbTqcQN.exe
  C:\Windows\System\DbTqcQN.exe
  2⤵
  PID:7364
- C:\Windows\System\rzbcTdG.exe
  C:\Windows\System\rzbcTdG.exe
  2⤵
  PID:8936
- C:\Windows\System\YTEjPur.exe
  C:\Windows\System\YTEjPur.exe
  2⤵
  PID:8248
- C:\Windows\System\AcuzcfO.exe
  C:\Windows\System\AcuzcfO.exe
  2⤵
  PID:9360
- C:\Windows\System\QXueEvR.exe
  C:\Windows\System\QXueEvR.exe
  2⤵
  PID:9424
- C:\Windows\System\MPjQdyB.exe
  C:\Windows\System\MPjQdyB.exe
  2⤵
  PID:9488
- C:\Windows\System\jQaAPrn.exe
  C:\Windows\System\jQaAPrn.exe
  2⤵
  PID:9568
- C:\Windows\System\JZVCorf.exe
  C:\Windows\System\JZVCorf.exe
  2⤵
  PID:9632
- C:\Windows\System\JpxJuzN.exe
  C:\Windows\System\JpxJuzN.exe
  2⤵
  PID:9692
- C:\Windows\System\iRWDykS.exe
  C:\Windows\System\iRWDykS.exe
  2⤵
  PID:9788
- C:\Windows\System\DGVuTVq.exe
  C:\Windows\System\DGVuTVq.exe
  2⤵
  PID:9856
- C:\Windows\System\FXrMaAh.exe
  C:\Windows\System\FXrMaAh.exe
  2⤵
  PID:9948
- C:\Windows\System\QsuKaHl.exe
  C:\Windows\System\QsuKaHl.exe
  2⤵
  PID:10012
- C:\Windows\System\CvuJwLS.exe
  C:\Windows\System\CvuJwLS.exe
  2⤵
  PID:9152
- C:\Windows\System\BtKHFBc.exe
  C:\Windows\System\BtKHFBc.exe
  2⤵
  PID:9220
- C:\Windows\System\zBlAZzY.exe
  C:\Windows\System\zBlAZzY.exe
  2⤵
  PID:10076
- C:\Windows\System\mvElIoo.exe
  C:\Windows\System\mvElIoo.exe
  2⤵
  PID:8196
- C:\Windows\System\ixKNknO.exe
  C:\Windows\System\ixKNknO.exe
  2⤵
  PID:10104
- C:\Windows\System\nplziYo.exe
  C:\Windows\System\nplziYo.exe
  2⤵
  PID:10120
- C:\Windows\System\qfCqRxO.exe
  C:\Windows\System\qfCqRxO.exe
  2⤵
  PID:8696
- C:\Windows\System\HprPDXG.exe
  C:\Windows\System\HprPDXG.exe
  2⤵
  PID:9272
- C:\Windows\System\XvAxvFN.exe
  C:\Windows\System\XvAxvFN.exe
  2⤵
  PID:9312
- C:\Windows\System\iIJTfdt.exe
  C:\Windows\System\iIJTfdt.exe
  2⤵
  PID:9376
- C:\Windows\System\EwnceQx.exe
  C:\Windows\System\EwnceQx.exe
  2⤵
  PID:9440
- C:\Windows\System\RGmUJKb.exe
  C:\Windows\System\RGmUJKb.exe
  2⤵
  PID:9504
- C:\Windows\System\uChpBCX.exe
  C:\Windows\System\uChpBCX.exe
  2⤵
  PID:9544
- C:\Windows\System\gaTkJMM.exe
  C:\Windows\System\gaTkJMM.exe
  2⤵
  PID:9584
- C:\Windows\System\hvdnjIA.exe
  C:\Windows\System\hvdnjIA.exe
  2⤵
  PID:9772
- C:\Windows\System\jDppEfD.exe
  C:\Windows\System\jDppEfD.exe
  2⤵
  PID:9836
- C:\Windows\System\vuiFmDU.exe
  C:\Windows\System\vuiFmDU.exe
  2⤵
  PID:9936
- C:\Windows\System\nSksMKS.exe
  C:\Windows\System\nSksMKS.exe
  2⤵
  PID:10028
- C:\Windows\System\yADQbnw.exe
  C:\Windows\System\yADQbnw.exe
  2⤵
  PID:9900
- C:\Windows\System\LfeHpVL.exe
  C:\Windows\System\LfeHpVL.exe
  2⤵
  PID:10136
- C:\Windows\System\TuAqXIm.exe
  C:\Windows\System\TuAqXIm.exe
  2⤵
  PID:10148
- C:\Windows\System\JbTXzCC.exe
  C:\Windows\System\JbTXzCC.exe
  2⤵
  PID:10168
- C:\Windows\System\hCHDsLU.exe
  C:\Windows\System\hCHDsLU.exe
  2⤵
  PID:10184
- C:\Windows\System\TUkIrQj.exe
  C:\Windows\System\TUkIrQj.exe
  2⤵
  PID:10224
- C:\Windows\System\djWMmNq.exe
  C:\Windows\System\djWMmNq.exe
  2⤵
  PID:8420
- C:\Windows\System\FYqXgFW.exe
  C:\Windows\System\FYqXgFW.exe
  2⤵
  PID:9600
- C:\Windows\System\UwboOvq.exe
  C:\Windows\System\UwboOvq.exe
  2⤵
  PID:9524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BNXxmkz.exe

Filesize
2.2MB

MD5
13fdf4b378ae3d236c29b1e4082a36a4

SHA1
4ce230ca339c0dff5df55b7c8267639ad582c0d9

SHA256
92ff6f991d9a34f89350e8f15e8cefc654eef98e746e5fc9f0e94210f0264948

SHA512
fc4d1c415ca52fbfda003ddcee771d227305c2ea1a805267d4f9eb2c21ba0b2f439ccc204a1cfcdb5c916b00d3bb125da8153ede623f301cd22b34bde895fe5d

Download Submit
C:\Windows\system\BZceLtV.exe

Filesize
2.2MB

MD5
183eed0eadcaed9bd4c07d09ac25bbb4

SHA1
5b9b6abb2bc9adff4ca413b3cdb70b11c8868d04

SHA256
eab5f50650b27bb2b134f196b779829094142096407870e25b53c07a16ac1f29

SHA512
53f776012d2921d807f0ea38abdd6f05cfad8390133f3b9eacfd4741ccb0ff97a27b21126049deec5514d82e265219b5da0774ed8ce1e3bf03046b09ba8ba795

Download Submit
C:\Windows\system\BxsbhGR.exe

Filesize
2.2MB

MD5
25213f2baf8d5f8c19508d191d7e7366

SHA1
56f9fe6268ba1f60625669b8641ee3212f44e6a8

SHA256
f3ac53f9395307a84d7904cdd185d2dd08b6702ebd4b0cb64679e3c85517195f

SHA512
0ef523922a638d5fd7f47a40124c452de575a42448e57e956e0570f1fdf3e4d2129fa3427fbc94a25f6188cfaf1fc8897ecfae2a624a8ce89e99cfce32ccaa31

Download Submit
C:\Windows\system\CUctpUF.exe

Filesize
2.2MB

MD5
c7c87c4171d7d1017a560614430e4c8b

SHA1
e72bfa4d6d078177c00728d3721488a56d81afb7

SHA256
aa70cc2fb67a4865cab38922cb996d2c146d6fe3a2f54752f89484e5e107dcc9

SHA512
a282c0e0153c24354d0e1a47f03fa9dcc38bea9b3889d50f0c9ec621d378245146347b41a0190ae6ac5c1dc3646afde836832d6e73dfd686cb8eb8ee24f008d4

Download Submit
C:\Windows\system\EzwNyIC.exe

Filesize
2.2MB

MD5
bb83192bcb58783e521fb02d6211cca8

SHA1
8528bb68df614219212f7e35b2db4525c1329f3b

SHA256
15e371dbc0cf93d3a4e8afd92699c712c308d62a83d4024d8d2a4440f9e6ce7d

SHA512
7792a42281b1074f051e0e91a04ffc0ccaeb9b80f29695140e6901bef946d2e8d8ff03b51debe00cd0dc4c89ed8ab77ff23a5571b886a02e74c1d47a8e472ca3

Download Submit
C:\Windows\system\FUWykPY.exe

Filesize
2.2MB

MD5
dba2ff914b7d7ce30b8234ae956086ec

SHA1
b4e6a8715cc74940d1b400e0662ca0a9d6ddbc99

SHA256
d0756c2a24c58017a703030c3bf6058d8ef75a0285c59bb76355594abefd941f

SHA512
922f4ce20b8578a6863f33555c8e91b68c8521841652ff2af1315e5a9c52e55b96cd367f708f97639c0597b6c0ac4d88802c2ef6875a46c7803e01088fda9598

Download Submit
C:\Windows\system\GIYhEuW.exe

Filesize
2.2MB

MD5
a0245c4811c8972e8b0e5890527f0219

SHA1
38fea74f637cc9d504bda5640e25b6319d44f6c9

SHA256
e3d5e229e9405a054ae3ab217462e9ab0f00f771380dd7d6395ffbe609442d07

SHA512
ba9f334d7c99214a980dc4d8f6fc69341397583fef8206ab9ac07bd085007835b18eb1f50aef43777505abd56130899acd506c1494c6e70aa8a61719fc08365e

Download Submit
C:\Windows\system\IezzPqK.exe

Filesize
2.2MB

MD5
fd37992bbbcc9457e533f54ef4640b28

SHA1
94e14bc5603b2bfbe833edb73e4b8bb7eab9ac92

SHA256
5e83164486b1b03d269c0cc33976e14b4b15b93b30ce56c31d6d4907bbdbdd62

SHA512
903d6d9de0f9495bb1a20e3935c16ef0b60b9ca4aed6388b645d3ed6b96257e58b4aa925a922a1acfa348ba2372d9eb22fdf2410e281755561a1fa86fa25b862

Download Submit
C:\Windows\system\JrtWTha.exe

Filesize
2.2MB

MD5
7d8fac549c67071988532307ad3c6676

SHA1
2a8da304b8ebfe2cc3faa07e5ae9d6bb2f93bac3

SHA256
9cdd78d3d7fc669e092130c8b239c68e1e76ffe227c5216925ef2e7de2d92b78

SHA512
92c1eb7841cd88696b947adbc046075c51cb6e9dcb939c3b065470d2803bcbb320ad384814a8f210c28bc4a7906499f9f8a85fe7557fd117dddec6dbbe346900

Download Submit
C:\Windows\system\KlGWqco.exe

Filesize
2.2MB

MD5
10f38940b9ce515db7fa472f11650ba1

SHA1
0bd39cda51a4bd4fe9fb5b2888dc9761e12970ed

SHA256
7b3fd2505afc5ead440fbfde4833691eb52347f2aa22cdc5a01d9d6cae83de91

SHA512
6b1e0c80cdaabd785982f9a2e6ce55e73e17a50bda19fb1e60dc735b71d2ad2d8f0b216f9fbd31bf2dd7ba79b79c6c0131f581c306f2319ae330814c868d557d

Download Submit
C:\Windows\system\MafNxLX.exe

Filesize
2.2MB

MD5
f9f3e75b77101182025795f5c9cd6bd4

SHA1
f0bbb1f0e74b0d4800981485dae1c9a51cc9d5c1

SHA256
440f8ce189325a6b6d93de8a3eba0f155de2c56288b12424e120ca17ab69564e

SHA512
7cf8813dc0a5a2b68b32bb2b3cb494aacdff032918a195b8ef46c4a66e58901bfdb6544d1c94c5b3edbfc054d7336bbf2ca5044d4f066659c9121148cb0e99c5

Download Submit
C:\Windows\system\Muguxtn.exe

Filesize
2.2MB

MD5
d56e8c46b9a4f3909c5cd1856a02d045

SHA1
87583b4ddc92294eeedfb445ba4252c15b43adc1

SHA256
6c8e6053f0c9377925829c93324c7c5739422783255e2c498e841ca5c7d2c954

SHA512
2cd80bcc99789594d2e855f9d3ff560e5cf29f5738316d55c0e0c3f77b2cac1272a1c97bdb8acaa5901e0dc6ee18621ae2b09f4c18b4795e04d8f4dc92865228

Download Submit
C:\Windows\system\OPefVEd.exe

Filesize
2.2MB

MD5
2630b4fee55efee54ed47e94d74069e1

SHA1
1c3eb151e5e80745fa32c463eb5d41907d3a788d

SHA256
d41c9aea83a9b757971314f1b3e93657dadea4abf4573dec33ced61899e0cf31

SHA512
b6230e378806727bba3c3b137b478cb002a5dae0d86cb13aa50a9cb18ad371c8f56ee33a11ffee976b6e249ace8b294e9aede15ecb8f074f9bc794f5cfed67ca

Download Submit
C:\Windows\system\VGftAjo.exe

Filesize
2.2MB

MD5
7ab3ebb8bc8d807e7fd7dd17d5f1d0e3

SHA1
318f468eea0929330289a27f2433015aded71705

SHA256
4e49013bb554f52dce2ee49f65d2babcb6bdae05047cdaa2f9537f360427d938

SHA512
4ddee05b47259696da3775fb273a7c3f9144f183336d0ed6de1d10fd37a5d1da5c6e3c99c426081f6302eb0be3e9eedc94c30f985cfb52cb626fac1721f6d579

Download Submit
C:\Windows\system\XIFtBZi.exe

Filesize
2.2MB

MD5
31b207578abce36dfa2edd7d0cc79008

SHA1
5a690704063d286d7a127fad6a9c4404a2e8fdda

SHA256
398d4fea4b29ba61014f76d8e8abded1074c180d00306a93d68adbfc3f0b9ecc

SHA512
84d0c12e17811ab2d3e572aabb03bdc9d0a1c68d21964f8f0a5f9d9207bf33c095b5a769ba5f0d920db5ec742478d91d0eb5fad7ac9dc7ef1913f9c2bfcce3a8

Download Submit
C:\Windows\system\XwLzYLK.exe

Filesize
2.2MB

MD5
226902ef5fbb6ed4aca673762518d38d

SHA1
a57294c18095901068775ab89574ed87ad3d6c9e

SHA256
989ddf56d618472d9d0cdc7a03d0ef973d8452bf6be4aab17c44dab8b6c6d955

SHA512
3d1489c53f00d998f20439307d0bcccd1cb518cbde7efd952708d825270ab16948a0080dbe20a69730f337fd50ded3d58b3ec5b02a1f829d8582cc9176d8ac62

Download Submit
C:\Windows\system\ahQuzHP.exe

Filesize
2.2MB

MD5
343e8244018c0bdf16af33cd99a15a52

SHA1
85d4cfed1dd98b3a8a318e746badfb89e707b117

SHA256
88ff32438ae212d11aecb065aab7020b54db20ad21e51addd4862cd77f16147f

SHA512
826411bfaaf0fbad0d3aeb4248fb6b8b69d1b20032bca10d94c219ae757bb2107e2434c8fe843ad3a28a65b5979d3b7da7925c0509a2ac399e711888bbda4d8b

Download Submit
C:\Windows\system\dmuJqaY.exe

Filesize
2.2MB

MD5
f19510deb77833998f46892f1e276262

SHA1
4bd9a6ed9818dd71b0bd8e093c128654f948f1a4

SHA256
31317fe4209e65d7d061992aa39a0e4ef8e793681db7f4f17f290e45e02aba38

SHA512
f83bcd2f31ec8cd735ee990c90cf2e818c2e574b6f1c25e1a421a54072e3c35e62e8062a5fc02e135e4445251bb87f4bc84a12cf7bf50263ad92f28dcab757e9

Download Submit
C:\Windows\system\iLPLDkz.exe

Filesize
2.2MB

MD5
bbefc00c522ebb74fb52a3f8da0dc403

SHA1
8e025e7af0e35a2fdbb34a73853ffbb5dc54ef21

SHA256
02e06093e569568ed3744aac6abd376dfb80ec8de8a4a4aa2b2caca54d21e301

SHA512
c3b3260aece0467b381870e6a956593ea9960ecbddeb8cf3bec6ef29d9e5538e9582390df2e84223e9e8d15b3f8ebb763ec798fb08d6442ca4b80cd704675756

Download Submit
C:\Windows\system\iZlraGx.exe

Filesize
2.2MB

MD5
f0fd36ce893f2af7dfb2de7bad26af3d

SHA1
87c75605925a4497b5ecbf80c786d9c0bda5c1ec

SHA256
65517b6e02b9a6b9b84697318992b7afa6ecbc2527915ee352056a0f6d47bfb1

SHA512
6f29871fa9bc8e8d5df0d2375e65ffd128547423cecb617b2c1baa7e7c55efb1ee29720aed0c60f07beb21541a6bf3f19a322f4a7ff2497452e6759dac53f3ea

Download Submit
C:\Windows\system\kmJEHtt.exe

Filesize
2.3MB

MD5
37494edc2ef6237dae840ab0b91c665d

SHA1
d0040b0bdcddb78b8f1bbf0061c44cd05e357ad9

SHA256
5d74754ecf0635cc873ef3cbadacd143a43a29050ce1911ccfb9d903d815742f

SHA512
46780bf6ba273559509a2aa121ff806bb4c40b7dfecaba99246f50c7307747723d1182a65d0381fbf7bbcd2aa7b04b354b2aa9d06592ec03cc1659cd13fc650c

Download Submit
C:\Windows\system\oRjZHRB.exe

Filesize
2.2MB

MD5
5d72b21b212737f5c7f0c1e77a5e1736

SHA1
353de08492f881cb7fe8f48e52acab8e2cb55a0b

SHA256
43fa42ef5044c586b7ec65182cb58acf4e7bd78fe65cafecb3e280b1d44473bb

SHA512
506bd7bd9ef32e59534ac5b9a8b1bd9d7e6533110a86e8c4fb70c7c8e29bf45b5fc0cf1fdc3e40788dcfb85bdee6c8e2c85fbfdd18bcf131d4acfefaeaf3f4ef

Download Submit
C:\Windows\system\pXPjzrp.exe

Filesize
8B

MD5
35e5aaaf64cfd996c128b5184afab2be

SHA1
d7f20e4be6b4dde2825158ba2dd315b1bd72d28d

SHA256
6844456d90722603693b3ccb4dc7bec92d10cefdd8ff55f8d3991fa66251cfa0

SHA512
8de872792634ad54586844c3ca75a8d446eafd9e8cd0e2be7e71c9b414ecc129d0165f96a35cf512cc4cf012f7eb348d16fa3bd899e37b2671c810982406d8b2

Download Submit
C:\Windows\system\ydMwMKM.exe

Filesize
2.2MB

MD5
9f3e08ef121529c3cc09866bcb386890

SHA1
0571b566342d8d3852f7374cb876e8904fe9900a

SHA256
a4f3976f0ef5d9d83f59e13df7db09618ac8d7a650e37de92a077195b149f1a0

SHA512
5305fb1a158286ac51d189b79691d6b9aaf3d8dedbfcc6e69d04cd9c70612d7df88e6592775b819874e04f7f3785dd049e4eae306954f2f5d7e34305089259f7

Download Submit
\Windows\system\AHzUdOG.exe

Filesize
2.2MB

MD5
bf751b5bd969925fae4425753aee77d5

SHA1
7dc3b26878a08e2bf38e8cde62a99701e6f4008b

SHA256
94fd908d412f7768c6277e08982234d10d89a67fc5db7c64c09a5e263e0926f6

SHA512
c94b114d495e91ccd788407ddf5ca3aefa04bfe7b495060af63b3cfe4b8a73c9a13d428012ea339b2b054c38932bdcac989ff85aee8bdb9bd698be87c7b03418

Download Submit
\Windows\system\BCprkxj.exe

Filesize
2.2MB

MD5
c6f1074aba5fb8abef73d3dfaf6292be

SHA1
4c8a4eeeca75baed8424d05d7aabc90f0831b7c9

SHA256
7edbb0b896fc8e501cac38d34b7de42f2b77265dc1ced5a0a4477cdbd1925211

SHA512
b542b1fb6af06734479570cadfbe57452a49b8cfa829967ceebbe69d1bbce3cdbc78db5ce0b091008894fe0b5ad3d6781b24268ec3d992d3f563e890b4f1ef22

Download Submit
\Windows\system\CHHgUge.exe

Filesize
2.3MB

MD5
551f5ccbfff6e8deb950c58f16e84464

SHA1
69ed54b90bd7208070bcf20e18826cba85b1e7f6

SHA256
021c8fd61de83af5c0266a2b6c5863d5fcf328732c7f9e8006b6524e58ced83e

SHA512
a4572faf52076304d1ffc9f0faae520c0c22c19d9f5287e1161808b5fe9637b07c72462597559f453d24c06d5cb68be6cbb6f5bbd7705ef0203b7b94584b57ba

Download Submit
\Windows\system\HIpKnYT.exe

Filesize
2.2MB

MD5
b456ab026a5f55009e9009175381a989

SHA1
794c62b24b14901698e44c8d27c707d88c25002d

SHA256
6d401f44ea5af858ea8b15525c44c431cd9a3c998ea92d5132ee275805af0573

SHA512
85bde7d8ebd1af2f5919744fac46221c63a8f0340f1f90fa671b0224018bb4a5787f1b50fac9838d5c554accc72fd5a1179f3a3e990177edf76c27a7e3215c63

Download Submit
\Windows\system\JWQxqml.exe

Filesize
2.2MB

MD5
435021a4e4f5529258da30d10233ae3c

SHA1
3a72d0d21a8a74b6a9f6200c41a4de83af903918

SHA256
0dfc3901b4131f3bfc06dcc3fcc9bd895911e5d81e1a07cf60b1ba7f30c3e98c

SHA512
d29246316eb05147e4d00eaa9f3c87da6efb08e2552f861fce0c3efdc98a7c65af28d86af5422f273fbd22b949d38e48a48dcaf0c8b366508347ec03c7f2c73c

Download Submit
\Windows\system\LCxnMEl.exe

Filesize
2.2MB

MD5
468eb5a5f799e0913e216065da1ed283

SHA1
bf28cf760931d1837f433090f5044f96b2482f6c

SHA256
dadf26a4d7baa6d54471151e50da03de41c809e01c9a1f37c36c7ba67b83a7ac

SHA512
b1c86e6225d180612d4f8acc51f3139c967ea5fb2acd866d50b57cba0a5b46ba579c22c50a6a01ecb01768b4c3992b6c7ab76cb2b4aa1c72b14cff08c42f5a40

Download Submit
\Windows\system\OhGWXhK.exe

Filesize
2.2MB

MD5
9e350f81b7a629030b24303c6a1e33f4

SHA1
5f1e3ec239276d3c5095ef9e5ffe73727a7ef714

SHA256
dfa25b9da0d5215887081eaaf107e0315fa0140b950fe9612dff150f473af029

SHA512
d9f5245311be4b4e7c39db737fb6985648b19d7767b5b6f708adac3a92a7f87f0182722cfded6fe897cf5cd8a5f3238e6a8a21a7dfb0af21c8093a6e274633df

Download Submit
\Windows\system\UrBYFwE.exe

Filesize
2.2MB

MD5
a2d1dd86dafec262340566ac4817951c

SHA1
251e2a0c9e951f7e62e6fcca5fff07619a090030

SHA256
d4e1359e923ba6859b8e1b3834876b7e21dff0ec19a183bf99b2e42ab768f80a

SHA512
679fb0bdde12140e1f34b88c5a68d60ff0fa834095a0cf0ee1ae1d5509ad06f355755a629a14edb89abe78cfa68b0bb764fccc799cb1a2684a27d9b06c739ef9

Download Submit
\Windows\system\pdVBCQm.exe

Filesize
2.2MB

MD5
8c6e9bcae7557f3dc271fda60d22aeca

SHA1
133396273f29517ef0c8ec9d3ca69a5a7aabda7e

SHA256
c6a40b40ab4a6437dab3105af6ca38cdab56551487ea72a24bd1a7b84eb2543b

SHA512
da1f060663af834a9957177fddd99d296055a6a6e32c3dd687f0cf4535f0989e9eeb5c3a0bf26dc3059beb62f83b1057b6712416632ea9bf4bc3a5d36fe82cc0

Download Submit
\Windows\system\vFzWifz.exe

Filesize
2.2MB

MD5
9786fba18bdc369295edcd97d07714a6

SHA1
306548b0ee5b5063fafdab39a35aa09dab7ecb46

SHA256
9b409eb2412ebc590e8e2275d9b4625184d25096bd2d2e344c22b435073512ac

SHA512
353681f36c1c4354dcacce543f7c8701c042399747589e34b8aaed082627bc3f9bbbd3b443bccc34be37b6f2ed22836fae1e409b225e60e21210ca88d9dceb25

Download Submit
memory/2008-5274-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2008-102-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2052-779-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2052-50-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2052-21-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

Filesize
4KB

Download
memory/2052-20-0x0000000002D80000-0x0000000002E00000-memory.dmp

Filesize
512KB

Download
memory/2052-51-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2052-47-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2052-66-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2112-5349-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-10-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2136-141-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2136-3983-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2360-65-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2360-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2360-67-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2360-57-0x0000000002E50000-0x0000000003242000-memory.dmp

Filesize
3.9MB

Download
memory/2360-121-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2360-8858-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-97-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2360-153-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-171-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2360-139-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2360-0-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-1659-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-59-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2360-17-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2360-8-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2360-63-0x0000000002E50000-0x0000000003242000-memory.dmp

Filesize
3.9MB

Download
memory/2360-53-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2700-55-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2700-3982-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2748-3981-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2748-68-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2832-19-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2832-5344-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2836-52-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2836-5350-0x000000013FD50000-0x0000000140142000-memory.dmp

Filesize
3.9MB

Download
memory/2848-61-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2848-5342-0x000000013F420000-0x000000013F812000-memory.dmp

Filesize
3.9MB

Download
memory/2864-5276-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2864-58-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2920-5278-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2920-64-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/3040-3987-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/3040-146-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download