xmrig | 5e11b619c6ec7683fe55f0e61dbebeda414d2a2917d5873c7567fb0341d1a5a0

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
Size

1.8MB
MD5

06d0ab6a3e82d72a9fa32a8a126093ed
SHA1

d36d641b92a9710e03828afa17c098bf5050c3ec
SHA256

5e11b619c6ec7683fe55f0e61dbebeda414d2a2917d5873c7567fb0341d1a5a0
SHA512

db55e407cc2754e737b0bfe0d61c6170df1cfb1e1743792bc8ab1379564de9a657ee0691a8f6d9320dc6edc335c4d72bdba2c0f52a94a68eefb7d72d01926921
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl7:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/2576-8-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2848-166-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2588-153-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2576	hPhCLSn.exe
2588	rlGIUJA.exe
2616	tkVTnRt.exe
2848	ODnHsTk.exe
2724	nNaIMuj.exe
2304	MGaOQec.exe
2376	VOOpnGl.exe
2496	SVWVjCT.exe
2556	TZUBGUK.exe
2044	dMUIVNQ.exe
2656	hXJRXgu.exe
2372	tGKpgfI.exe
1508	EizWOiQ.exe
1636	QSiIbZv.exe
1520	rEeontM.exe
2728	fLJRUci.exe
2156	fRSeJDW.exe
1740	chMmRTh.exe
620	LTbiIMe.exe
1776	NTSzFOJ.exe
1800	bMsIOXt.exe
2136	rEaxnXb.exe
316	WXWJdXt.exe
1572	ZTrxvtr.exe
268	UQzFEkL.exe
2088	TCJylxO.exe
2952	ywXIwDl.exe
2200	lAqrFBQ.exe
2248	CRRkWNs.exe
2212	aZfsSlN.exe
592	sYJEnIN.exe
704	zsQLhsU.exe
596	ldYrAKt.exe
2864	ZqdOtOt.exe
808	JgkvhPd.exe
328	ifECpjO.exe
1168	wXrZsnX.exe
2776	SaQdRYK.exe
2104	JWCYGjl.exe
1480	HWTycxc.exe
556	ftyZlAu.exe
1752	ZitiSHh.exe
868	ssAdehn.exe
2568	kFYTOUH.exe
1672	EcQqtxx.exe
648	ZPKUxNY.exe
3052	NHLtOxx.exe
988	dOuJSfZ.exe
2276	ccTbFJv.exe
948	qtxQcZe.exe
2028	wBgCyzV.exe
1004	eytGMuO.exe
668	iUDtvYY.exe
1908	BxzuUOj.exe
784	ZLyEdUW.exe
2188	tQBPBFK.exe
1836	lCkSwPw.exe
2004	DkmVDeb.exe
2224	cIgKXXm.exe
1432	OzgWjNU.exe
1436	mpFnvNU.exe
2272	EnVbupW.exe
1904	akiUtbL.exe
1972	iJalWkC.exe

Loads dropped DLL 64 IoCs

pid	Process
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000122ee-5.dat	upx
behavioral1/memory/1992-7-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2576-8-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x003700000001448b-18.dat	upx
behavioral1/files/0x00090000000145d4-27.dat	upx
behavioral1/files/0x000700000001475f-39.dat	upx
behavioral1/files/0x0006000000015cca-50.dat	upx
behavioral1/files/0x0006000000015d89-86.dat	upx
behavioral1/files/0x00060000000167e8-126.dat	upx
behavioral1/memory/2304-181-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2496-194-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2616-163-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0006000000016c57-139.dat	upx
behavioral1/files/0x0006000000016a3a-130.dat	upx
behavioral1/memory/2556-199-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2724-177-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/memory/2848-166-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2588-153-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0006000000016c3a-134.dat	upx
behavioral1/files/0x0006000000016591-122.dat	upx
behavioral1/files/0x000600000001640f-112.dat	upx
behavioral1/files/0x000600000001650f-117.dat	upx
behavioral1/files/0x0006000000016228-110.dat	upx
behavioral1/files/0x0006000000016126-106.dat	upx
behavioral1/files/0x0006000000015fbb-98.dat	upx
behavioral1/files/0x0006000000016020-102.dat	upx
behavioral1/files/0x0006000000015f40-94.dat	upx
behavioral1/files/0x0006000000015d99-90.dat	upx
behavioral1/files/0x0006000000015d28-82.dat	upx
behavioral1/files/0x0006000000015d1e-78.dat	upx
behavioral1/files/0x0006000000015d13-74.dat	upx
behavioral1/files/0x0006000000015d02-70.dat	upx
behavioral1/files/0x0006000000015cf5-66.dat	upx
behavioral1/files/0x0006000000015ced-62.dat	upx
behavioral1/files/0x0006000000015ce1-58.dat	upx
behavioral1/files/0x0006000000015cd8-54.dat	upx
behavioral1/files/0x0009000000014c0b-46.dat	upx
behavioral1/files/0x00070000000148af-43.dat	upx
behavioral1/files/0x000700000001474b-34.dat	upx
behavioral1/files/0x00080000000146a7-33.dat	upx
behavioral1/files/0x00130000000054a8-25.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bksXndO.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\mllBEnx.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\rEaxnXb.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\YFxEAdb.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\ttqvDmo.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\HHYbewH.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\FWzWbpq.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\nFVwsZN.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\lOIWNZx.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\UYafreL.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\JBeBSNr.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\fRSeJDW.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\MPcbglW.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\SjboKNw.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\YQImmDu.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\ZqdOtOt.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\kFYTOUH.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\VwnhYNs.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\HBlHEHs.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\tkVTnRt.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\uVMeCPT.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\IIeAhHu.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\pHuZhSN.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\ZWHjjqx.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\Rmkrbxa.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\PkIeYHm.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\ORkQvTQ.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\asuKvZl.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\GCOmGtb.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\jRBjJcc.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\HZQzvMa.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\faYKigR.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\QWDxNfu.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\PqvMQHx.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\ISvdSno.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\SVWVjCT.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\MkQVByF.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\lQgRMvL.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\hXJRXgu.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\UwNVpIU.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\qxbmcnK.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\qGmmFtJ.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\JylxILu.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\oBUzghl.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\MSBDFGk.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\bwToGhS.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\OicabWP.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\vZTyhUX.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\NxaxDuj.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\glxwLSZ.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\qtxQcZe.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\sEHpYOl.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\nmCsepx.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\sQsulpW.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\fbZtKHk.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\PsyqMDX.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\rpuBCqc.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\dgISAKO.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\yGTErpm.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\osmxnIy.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\hhOTIhd.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\TaZSgLk.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\vajivTJ.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
File created	C:\Windows\System\KNyEuKh.exe	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeLockMemoryPrivilege	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1676	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	29
PID 1992 wrote to memory of 1676	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	29
PID 1992 wrote to memory of 1676	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	29
PID 1992 wrote to memory of 2576	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2576	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2576	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2588	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2588	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2588	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2616	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	32
PID 1992 wrote to memory of 2616	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	32
PID 1992 wrote to memory of 2616	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	32
PID 1992 wrote to memory of 2848	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	33
PID 1992 wrote to memory of 2848	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	33
PID 1992 wrote to memory of 2848	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	33
PID 1992 wrote to memory of 2724	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	34
PID 1992 wrote to memory of 2724	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	34
PID 1992 wrote to memory of 2724	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	34
PID 1992 wrote to memory of 2304	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	35
PID 1992 wrote to memory of 2304	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	35
PID 1992 wrote to memory of 2304	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	35
PID 1992 wrote to memory of 2376	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	36
PID 1992 wrote to memory of 2376	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	36
PID 1992 wrote to memory of 2376	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	36
PID 1992 wrote to memory of 2496	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	37
PID 1992 wrote to memory of 2496	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	37
PID 1992 wrote to memory of 2496	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	37
PID 1992 wrote to memory of 2556	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	38
PID 1992 wrote to memory of 2556	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	38
PID 1992 wrote to memory of 2556	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	38
PID 1992 wrote to memory of 2044	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	39
PID 1992 wrote to memory of 2044	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	39
PID 1992 wrote to memory of 2044	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	39
PID 1992 wrote to memory of 2656	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	40
PID 1992 wrote to memory of 2656	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	40
PID 1992 wrote to memory of 2656	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	40
PID 1992 wrote to memory of 2372	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	41
PID 1992 wrote to memory of 2372	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	41
PID 1992 wrote to memory of 2372	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	41
PID 1992 wrote to memory of 1508	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	42
PID 1992 wrote to memory of 1508	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	42
PID 1992 wrote to memory of 1508	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	42
PID 1992 wrote to memory of 1636	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	43
PID 1992 wrote to memory of 1636	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	43
PID 1992 wrote to memory of 1636	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	43
PID 1992 wrote to memory of 1520	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	44
PID 1992 wrote to memory of 1520	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	44
PID 1992 wrote to memory of 1520	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	44
PID 1992 wrote to memory of 2728	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	45
PID 1992 wrote to memory of 2728	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	45
PID 1992 wrote to memory of 2728	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	45
PID 1992 wrote to memory of 2156	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	46
PID 1992 wrote to memory of 2156	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	46
PID 1992 wrote to memory of 2156	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	46
PID 1992 wrote to memory of 1740	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	47
PID 1992 wrote to memory of 1740	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	47
PID 1992 wrote to memory of 1740	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	47
PID 1992 wrote to memory of 620	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	48
PID 1992 wrote to memory of 620	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	48
PID 1992 wrote to memory of 620	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	48
PID 1992 wrote to memory of 1776	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	49
PID 1992 wrote to memory of 1776	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	49
PID 1992 wrote to memory of 1776	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	49
PID 1992 wrote to memory of 1800	1992	06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06d0ab6a3e82d72a9fa32a8a126093ed_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\System\hPhCLSn.exe
  C:\Windows\System\hPhCLSn.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\rlGIUJA.exe
  C:\Windows\System\rlGIUJA.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\tkVTnRt.exe
  C:\Windows\System\tkVTnRt.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ODnHsTk.exe
  C:\Windows\System\ODnHsTk.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\nNaIMuj.exe
  C:\Windows\System\nNaIMuj.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\MGaOQec.exe
  C:\Windows\System\MGaOQec.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\VOOpnGl.exe
  C:\Windows\System\VOOpnGl.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\SVWVjCT.exe
  C:\Windows\System\SVWVjCT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\TZUBGUK.exe
  C:\Windows\System\TZUBGUK.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\dMUIVNQ.exe
  C:\Windows\System\dMUIVNQ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\hXJRXgu.exe
  C:\Windows\System\hXJRXgu.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\tGKpgfI.exe
  C:\Windows\System\tGKpgfI.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\EizWOiQ.exe
  C:\Windows\System\EizWOiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\QSiIbZv.exe
  C:\Windows\System\QSiIbZv.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\rEeontM.exe
  C:\Windows\System\rEeontM.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\fLJRUci.exe
  C:\Windows\System\fLJRUci.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\fRSeJDW.exe
  C:\Windows\System\fRSeJDW.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\chMmRTh.exe
  C:\Windows\System\chMmRTh.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\LTbiIMe.exe
  C:\Windows\System\LTbiIMe.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\NTSzFOJ.exe
  C:\Windows\System\NTSzFOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\bMsIOXt.exe
  C:\Windows\System\bMsIOXt.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\rEaxnXb.exe
  C:\Windows\System\rEaxnXb.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\WXWJdXt.exe
  C:\Windows\System\WXWJdXt.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\ZTrxvtr.exe
  C:\Windows\System\ZTrxvtr.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\UQzFEkL.exe
  C:\Windows\System\UQzFEkL.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\ywXIwDl.exe
  C:\Windows\System\ywXIwDl.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\TCJylxO.exe
  C:\Windows\System\TCJylxO.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\lAqrFBQ.exe
  C:\Windows\System\lAqrFBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\CRRkWNs.exe
  C:\Windows\System\CRRkWNs.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\aZfsSlN.exe
  C:\Windows\System\aZfsSlN.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\sYJEnIN.exe
  C:\Windows\System\sYJEnIN.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\zsQLhsU.exe
  C:\Windows\System\zsQLhsU.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\ldYrAKt.exe
  C:\Windows\System\ldYrAKt.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\ZqdOtOt.exe
  C:\Windows\System\ZqdOtOt.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\JgkvhPd.exe
  C:\Windows\System\JgkvhPd.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\EcQqtxx.exe
  C:\Windows\System\EcQqtxx.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\ifECpjO.exe
  C:\Windows\System\ifECpjO.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\ZPKUxNY.exe
  C:\Windows\System\ZPKUxNY.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\wXrZsnX.exe
  C:\Windows\System\wXrZsnX.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\NHLtOxx.exe
  C:\Windows\System\NHLtOxx.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\SaQdRYK.exe
  C:\Windows\System\SaQdRYK.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\dOuJSfZ.exe
  C:\Windows\System\dOuJSfZ.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\JWCYGjl.exe
  C:\Windows\System\JWCYGjl.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ccTbFJv.exe
  C:\Windows\System\ccTbFJv.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\HWTycxc.exe
  C:\Windows\System\HWTycxc.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\qtxQcZe.exe
  C:\Windows\System\qtxQcZe.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\ftyZlAu.exe
  C:\Windows\System\ftyZlAu.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\wBgCyzV.exe
  C:\Windows\System\wBgCyzV.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ZitiSHh.exe
  C:\Windows\System\ZitiSHh.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\eytGMuO.exe
  C:\Windows\System\eytGMuO.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ssAdehn.exe
  C:\Windows\System\ssAdehn.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\iUDtvYY.exe
  C:\Windows\System\iUDtvYY.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\kFYTOUH.exe
  C:\Windows\System\kFYTOUH.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\BxzuUOj.exe
  C:\Windows\System\BxzuUOj.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\ZLyEdUW.exe
  C:\Windows\System\ZLyEdUW.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\tQBPBFK.exe
  C:\Windows\System\tQBPBFK.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\lCkSwPw.exe
  C:\Windows\System\lCkSwPw.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\DkmVDeb.exe
  C:\Windows\System\DkmVDeb.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\cIgKXXm.exe
  C:\Windows\System\cIgKXXm.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\OzgWjNU.exe
  C:\Windows\System\OzgWjNU.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\mpFnvNU.exe
  C:\Windows\System\mpFnvNU.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\EnVbupW.exe
  C:\Windows\System\EnVbupW.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\akiUtbL.exe
  C:\Windows\System\akiUtbL.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\iJalWkC.exe
  C:\Windows\System\iJalWkC.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\VNUOWSe.exe
  C:\Windows\System\VNUOWSe.exe
  2⤵
  PID:1504
- C:\Windows\System\BwotbfQ.exe
  C:\Windows\System\BwotbfQ.exe
  2⤵
  PID:2960
- C:\Windows\System\mEWkkFz.exe
  C:\Windows\System\mEWkkFz.exe
  2⤵
  PID:2592
- C:\Windows\System\WfyfMjh.exe
  C:\Windows\System\WfyfMjh.exe
  2⤵
  PID:2708
- C:\Windows\System\JhcVmhz.exe
  C:\Windows\System\JhcVmhz.exe
  2⤵
  PID:2668
- C:\Windows\System\SXsIAhl.exe
  C:\Windows\System\SXsIAhl.exe
  2⤵
  PID:2968
- C:\Windows\System\utwuenL.exe
  C:\Windows\System\utwuenL.exe
  2⤵
  PID:2528
- C:\Windows\System\xQpAOZB.exe
  C:\Windows\System\xQpAOZB.exe
  2⤵
  PID:2512
- C:\Windows\System\TBfQDiu.exe
  C:\Windows\System\TBfQDiu.exe
  2⤵
  PID:2308
- C:\Windows\System\ICzQZyB.exe
  C:\Windows\System\ICzQZyB.exe
  2⤵
  PID:1780
- C:\Windows\System\BRkvWTC.exe
  C:\Windows\System\BRkvWTC.exe
  2⤵
  PID:1604
- C:\Windows\System\yySbzOf.exe
  C:\Windows\System\yySbzOf.exe
  2⤵
  PID:2720
- C:\Windows\System\jzBosXi.exe
  C:\Windows\System\jzBosXi.exe
  2⤵
  PID:2584
- C:\Windows\System\NgrYESD.exe
  C:\Windows\System\NgrYESD.exe
  2⤵
  PID:352
- C:\Windows\System\hSDzGiM.exe
  C:\Windows\System\hSDzGiM.exe
  2⤵
  PID:2400
- C:\Windows\System\HFHUCjU.exe
  C:\Windows\System\HFHUCjU.exe
  2⤵
  PID:2396
- C:\Windows\System\BPQiSpN.exe
  C:\Windows\System\BPQiSpN.exe
  2⤵
  PID:1512
- C:\Windows\System\nmCsepx.exe
  C:\Windows\System\nmCsepx.exe
  2⤵
  PID:1900
- C:\Windows\System\xXKyrWa.exe
  C:\Windows\System\xXKyrWa.exe
  2⤵
  PID:944
- C:\Windows\System\RsZjppv.exe
  C:\Windows\System\RsZjppv.exe
  2⤵
  PID:1728
- C:\Windows\System\SMgNJNw.exe
  C:\Windows\System\SMgNJNw.exe
  2⤵
  PID:3028
- C:\Windows\System\vZTyhUX.exe
  C:\Windows\System\vZTyhUX.exe
  2⤵
  PID:1736
- C:\Windows\System\WyVuvmX.exe
  C:\Windows\System\WyVuvmX.exe
  2⤵
  PID:928
- C:\Windows\System\TaZSgLk.exe
  C:\Windows\System\TaZSgLk.exe
  2⤵
  PID:2828
- C:\Windows\System\nUakAFS.exe
  C:\Windows\System\nUakAFS.exe
  2⤵
  PID:2216
- C:\Windows\System\kkKCvCK.exe
  C:\Windows\System\kkKCvCK.exe
  2⤵
  PID:536
- C:\Windows\System\zPtDsKb.exe
  C:\Windows\System\zPtDsKb.exe
  2⤵
  PID:580
- C:\Windows\System\NxaxDuj.exe
  C:\Windows\System\NxaxDuj.exe
  2⤵
  PID:2008
- C:\Windows\System\oAKUTfG.exe
  C:\Windows\System\oAKUTfG.exe
  2⤵
  PID:2348
- C:\Windows\System\hWcMqMR.exe
  C:\Windows\System\hWcMqMR.exe
  2⤵
  PID:1544
- C:\Windows\System\cNdWMfA.exe
  C:\Windows\System\cNdWMfA.exe
  2⤵
  PID:896
- C:\Windows\System\wuBsFfB.exe
  C:\Windows\System\wuBsFfB.exe
  2⤵
  PID:1692
- C:\Windows\System\XfiAVvB.exe
  C:\Windows\System\XfiAVvB.exe
  2⤵
  PID:1912
- C:\Windows\System\JzJQbqT.exe
  C:\Windows\System\JzJQbqT.exe
  2⤵
  PID:2320
- C:\Windows\System\ldmlKNA.exe
  C:\Windows\System\ldmlKNA.exe
  2⤵
  PID:2180
- C:\Windows\System\xXymsKK.exe
  C:\Windows\System\xXymsKK.exe
  2⤵
  PID:1920
- C:\Windows\System\kOFWMaS.exe
  C:\Windows\System\kOFWMaS.exe
  2⤵
  PID:1860
- C:\Windows\System\oBUzghl.exe
  C:\Windows\System\oBUzghl.exe
  2⤵
  PID:1720
- C:\Windows\System\oIbxnaI.exe
  C:\Windows\System\oIbxnaI.exe
  2⤵
  PID:2704
- C:\Windows\System\HyKSdCh.exe
  C:\Windows\System\HyKSdCh.exe
  2⤵
  PID:2504
- C:\Windows\System\WwtzKlR.exe
  C:\Windows\System\WwtzKlR.exe
  2⤵
  PID:2476
- C:\Windows\System\VQTIexB.exe
  C:\Windows\System\VQTIexB.exe
  2⤵
  PID:1088
- C:\Windows\System\iEYeiet.exe
  C:\Windows\System\iEYeiet.exe
  2⤵
  PID:2468
- C:\Windows\System\ImeUtyE.exe
  C:\Windows\System\ImeUtyE.exe
  2⤵
  PID:1552
- C:\Windows\System\ppataNz.exe
  C:\Windows\System\ppataNz.exe
  2⤵
  PID:1928
- C:\Windows\System\eNMPeAF.exe
  C:\Windows\System\eNMPeAF.exe
  2⤵
  PID:2228
- C:\Windows\System\yPTgSaL.exe
  C:\Windows\System\yPTgSaL.exe
  2⤵
  PID:2804
- C:\Windows\System\VvaphDi.exe
  C:\Windows\System\VvaphDi.exe
  2⤵
  PID:1160
- C:\Windows\System\MwKKpZY.exe
  C:\Windows\System\MwKKpZY.exe
  2⤵
  PID:3084
- C:\Windows\System\Isruteg.exe
  C:\Windows\System\Isruteg.exe
  2⤵
  PID:3100
- C:\Windows\System\klkjrFd.exe
  C:\Windows\System\klkjrFd.exe
  2⤵
  PID:3116
- C:\Windows\System\zMvitZz.exe
  C:\Windows\System\zMvitZz.exe
  2⤵
  PID:3132
- C:\Windows\System\WNvkPmW.exe
  C:\Windows\System\WNvkPmW.exe
  2⤵
  PID:3148
- C:\Windows\System\HpznZgA.exe
  C:\Windows\System\HpznZgA.exe
  2⤵
  PID:3164
- C:\Windows\System\kkmMLxs.exe
  C:\Windows\System\kkmMLxs.exe
  2⤵
  PID:3180
- C:\Windows\System\dJsWixK.exe
  C:\Windows\System\dJsWixK.exe
  2⤵
  PID:3196
- C:\Windows\System\MYpogHe.exe
  C:\Windows\System\MYpogHe.exe
  2⤵
  PID:3212
- C:\Windows\System\VUUzAco.exe
  C:\Windows\System\VUUzAco.exe
  2⤵
  PID:3228
- C:\Windows\System\sbuTXEz.exe
  C:\Windows\System\sbuTXEz.exe
  2⤵
  PID:3244
- C:\Windows\System\ZZOrVJx.exe
  C:\Windows\System\ZZOrVJx.exe
  2⤵
  PID:3260
- C:\Windows\System\CZwfnVE.exe
  C:\Windows\System\CZwfnVE.exe
  2⤵
  PID:3276
- C:\Windows\System\SyUeHrS.exe
  C:\Windows\System\SyUeHrS.exe
  2⤵
  PID:3292
- C:\Windows\System\HpBjYao.exe
  C:\Windows\System\HpBjYao.exe
  2⤵
  PID:3308
- C:\Windows\System\vXWtATf.exe
  C:\Windows\System\vXWtATf.exe
  2⤵
  PID:3324
- C:\Windows\System\tsWbmUS.exe
  C:\Windows\System\tsWbmUS.exe
  2⤵
  PID:3340
- C:\Windows\System\CKcNFxk.exe
  C:\Windows\System\CKcNFxk.exe
  2⤵
  PID:3356
- C:\Windows\System\oPRLoBx.exe
  C:\Windows\System\oPRLoBx.exe
  2⤵
  PID:3372
- C:\Windows\System\tyQTwKP.exe
  C:\Windows\System\tyQTwKP.exe
  2⤵
  PID:3388
- C:\Windows\System\PnPkjZD.exe
  C:\Windows\System\PnPkjZD.exe
  2⤵
  PID:3404
- C:\Windows\System\rUenNmX.exe
  C:\Windows\System\rUenNmX.exe
  2⤵
  PID:3420
- C:\Windows\System\tQuZBtq.exe
  C:\Windows\System\tQuZBtq.exe
  2⤵
  PID:3436
- C:\Windows\System\cAJvbEG.exe
  C:\Windows\System\cAJvbEG.exe
  2⤵
  PID:3452
- C:\Windows\System\yBZggGf.exe
  C:\Windows\System\yBZggGf.exe
  2⤵
  PID:3468
- C:\Windows\System\wfjmGot.exe
  C:\Windows\System\wfjmGot.exe
  2⤵
  PID:3484
- C:\Windows\System\TqVtnLi.exe
  C:\Windows\System\TqVtnLi.exe
  2⤵
  PID:3500
- C:\Windows\System\Cvmqzmj.exe
  C:\Windows\System\Cvmqzmj.exe
  2⤵
  PID:3516
- C:\Windows\System\ALNIxps.exe
  C:\Windows\System\ALNIxps.exe
  2⤵
  PID:3532
- C:\Windows\System\YpwpVop.exe
  C:\Windows\System\YpwpVop.exe
  2⤵
  PID:3548
- C:\Windows\System\eYnbxJm.exe
  C:\Windows\System\eYnbxJm.exe
  2⤵
  PID:3564
- C:\Windows\System\QGQPPjR.exe
  C:\Windows\System\QGQPPjR.exe
  2⤵
  PID:3580
- C:\Windows\System\qIBeMUE.exe
  C:\Windows\System\qIBeMUE.exe
  2⤵
  PID:3596
- C:\Windows\System\btJyDvM.exe
  C:\Windows\System\btJyDvM.exe
  2⤵
  PID:3612
- C:\Windows\System\PlKWHJV.exe
  C:\Windows\System\PlKWHJV.exe
  2⤵
  PID:3628
- C:\Windows\System\rNRVpHX.exe
  C:\Windows\System\rNRVpHX.exe
  2⤵
  PID:3644
- C:\Windows\System\FrFZbIj.exe
  C:\Windows\System\FrFZbIj.exe
  2⤵
  PID:3660
- C:\Windows\System\JVwZIKp.exe
  C:\Windows\System\JVwZIKp.exe
  2⤵
  PID:3676
- C:\Windows\System\YljlhHD.exe
  C:\Windows\System\YljlhHD.exe
  2⤵
  PID:3692
- C:\Windows\System\QsZOdSy.exe
  C:\Windows\System\QsZOdSy.exe
  2⤵
  PID:3708
- C:\Windows\System\UwNVpIU.exe
  C:\Windows\System\UwNVpIU.exe
  2⤵
  PID:3724
- C:\Windows\System\TfvTVdH.exe
  C:\Windows\System\TfvTVdH.exe
  2⤵
  PID:3740
- C:\Windows\System\rGLYtCv.exe
  C:\Windows\System\rGLYtCv.exe
  2⤵
  PID:3756
- C:\Windows\System\LNSxyFo.exe
  C:\Windows\System\LNSxyFo.exe
  2⤵
  PID:3772
- C:\Windows\System\rpeeTAr.exe
  C:\Windows\System\rpeeTAr.exe
  2⤵
  PID:3788
- C:\Windows\System\zMZevGT.exe
  C:\Windows\System\zMZevGT.exe
  2⤵
  PID:3804
- C:\Windows\System\XrcFBry.exe
  C:\Windows\System\XrcFBry.exe
  2⤵
  PID:3820
- C:\Windows\System\brgLYSe.exe
  C:\Windows\System\brgLYSe.exe
  2⤵
  PID:3836
- C:\Windows\System\fiJNTSy.exe
  C:\Windows\System\fiJNTSy.exe
  2⤵
  PID:3852
- C:\Windows\System\VSBiliE.exe
  C:\Windows\System\VSBiliE.exe
  2⤵
  PID:3868
- C:\Windows\System\thOOlUQ.exe
  C:\Windows\System\thOOlUQ.exe
  2⤵
  PID:3884
- C:\Windows\System\FnVDOWi.exe
  C:\Windows\System\FnVDOWi.exe
  2⤵
  PID:3900
- C:\Windows\System\WgGVWSa.exe
  C:\Windows\System\WgGVWSa.exe
  2⤵
  PID:3916
- C:\Windows\System\KiRmvHU.exe
  C:\Windows\System\KiRmvHU.exe
  2⤵
  PID:3932
- C:\Windows\System\SFvyzDm.exe
  C:\Windows\System\SFvyzDm.exe
  2⤵
  PID:3948
- C:\Windows\System\VcwqNSM.exe
  C:\Windows\System\VcwqNSM.exe
  2⤵
  PID:3964
- C:\Windows\System\wWpGIBA.exe
  C:\Windows\System\wWpGIBA.exe
  2⤵
  PID:3980
- C:\Windows\System\FDeSprd.exe
  C:\Windows\System\FDeSprd.exe
  2⤵
  PID:3996
- C:\Windows\System\EPYzdao.exe
  C:\Windows\System\EPYzdao.exe
  2⤵
  PID:4012
- C:\Windows\System\DFLqFmk.exe
  C:\Windows\System\DFLqFmk.exe
  2⤵
  PID:4028
- C:\Windows\System\IhXfOJj.exe
  C:\Windows\System\IhXfOJj.exe
  2⤵
  PID:4044
- C:\Windows\System\MxXLcOp.exe
  C:\Windows\System\MxXLcOp.exe
  2⤵
  PID:4060
- C:\Windows\System\YRDhQGy.exe
  C:\Windows\System\YRDhQGy.exe
  2⤵
  PID:4076
- C:\Windows\System\iSZzQnQ.exe
  C:\Windows\System\iSZzQnQ.exe
  2⤵
  PID:4092
- C:\Windows\System\TVcKBOF.exe
  C:\Windows\System\TVcKBOF.exe
  2⤵
  PID:2460
- C:\Windows\System\ORPpBet.exe
  C:\Windows\System\ORPpBet.exe
  2⤵
  PID:1408
- C:\Windows\System\Ngpnfyu.exe
  C:\Windows\System\Ngpnfyu.exe
  2⤵
  PID:444
- C:\Windows\System\CtGYgQc.exe
  C:\Windows\System\CtGYgQc.exe
  2⤵
  PID:2360
- C:\Windows\System\CHrMaFt.exe
  C:\Windows\System\CHrMaFt.exe
  2⤵
  PID:1844
- C:\Windows\System\ehEGWfS.exe
  C:\Windows\System\ehEGWfS.exe
  2⤵
  PID:880
- C:\Windows\System\tBiJGdW.exe
  C:\Windows\System\tBiJGdW.exe
  2⤵
  PID:1540
- C:\Windows\System\RAIQVGl.exe
  C:\Windows\System\RAIQVGl.exe
  2⤵
  PID:1528
- C:\Windows\System\oaJPxxf.exe
  C:\Windows\System\oaJPxxf.exe
  2⤵
  PID:3004
- C:\Windows\System\sivALjV.exe
  C:\Windows\System\sivALjV.exe
  2⤵
  PID:2940
- C:\Windows\System\VqSrmVn.exe
  C:\Windows\System\VqSrmVn.exe
  2⤵
  PID:1268
- C:\Windows\System\TgMNFvF.exe
  C:\Windows\System\TgMNFvF.exe
  2⤵
  PID:1244
- C:\Windows\System\XnAvGpP.exe
  C:\Windows\System\XnAvGpP.exe
  2⤵
  PID:1208
- C:\Windows\System\siyigzT.exe
  C:\Windows\System\siyigzT.exe
  2⤵
  PID:3096
- C:\Windows\System\rmMSMca.exe
  C:\Windows\System\rmMSMca.exe
  2⤵
  PID:3128
- C:\Windows\System\mXnZQGT.exe
  C:\Windows\System\mXnZQGT.exe
  2⤵
  PID:3160
- C:\Windows\System\bjxdGYY.exe
  C:\Windows\System\bjxdGYY.exe
  2⤵
  PID:3176
- C:\Windows\System\xuJUevn.exe
  C:\Windows\System\xuJUevn.exe
  2⤵
  PID:3224
- C:\Windows\System\brymnuC.exe
  C:\Windows\System\brymnuC.exe
  2⤵
  PID:3256
- C:\Windows\System\yaKdJaX.exe
  C:\Windows\System\yaKdJaX.exe
  2⤵
  PID:3288
- C:\Windows\System\ZQrqOgv.exe
  C:\Windows\System\ZQrqOgv.exe
  2⤵
  PID:3320
- C:\Windows\System\OKbLOtD.exe
  C:\Windows\System\OKbLOtD.exe
  2⤵
  PID:3352
- C:\Windows\System\fvcIpBD.exe
  C:\Windows\System\fvcIpBD.exe
  2⤵
  PID:3384
- C:\Windows\System\pGvZLaf.exe
  C:\Windows\System\pGvZLaf.exe
  2⤵
  PID:3416
- C:\Windows\System\URgqKhh.exe
  C:\Windows\System\URgqKhh.exe
  2⤵
  PID:3448
- C:\Windows\System\glxwLSZ.exe
  C:\Windows\System\glxwLSZ.exe
  2⤵
  PID:3508
- C:\Windows\System\hIMeYHB.exe
  C:\Windows\System\hIMeYHB.exe
  2⤵
  PID:3512
- C:\Windows\System\AvevbNN.exe
  C:\Windows\System\AvevbNN.exe
  2⤵
  PID:3544
- C:\Windows\System\pEncJDt.exe
  C:\Windows\System\pEncJDt.exe
  2⤵
  PID:3576
- C:\Windows\System\evgscdU.exe
  C:\Windows\System\evgscdU.exe
  2⤵
  PID:3608
- C:\Windows\System\NTrnhGG.exe
  C:\Windows\System\NTrnhGG.exe
  2⤵
  PID:3640
- C:\Windows\System\mcWtnjW.exe
  C:\Windows\System\mcWtnjW.exe
  2⤵
  PID:3672
- C:\Windows\System\eKifOaW.exe
  C:\Windows\System\eKifOaW.exe
  2⤵
  PID:3704
- C:\Windows\System\cPaXeqf.exe
  C:\Windows\System\cPaXeqf.exe
  2⤵
  PID:3736
- C:\Windows\System\ORkQvTQ.exe
  C:\Windows\System\ORkQvTQ.exe
  2⤵
  PID:3768
- C:\Windows\System\sWPQCrB.exe
  C:\Windows\System\sWPQCrB.exe
  2⤵
  PID:3800
- C:\Windows\System\FFwIcWa.exe
  C:\Windows\System\FFwIcWa.exe
  2⤵
  PID:3832
- C:\Windows\System\OKUIwLY.exe
  C:\Windows\System\OKUIwLY.exe
  2⤵
  PID:3864
- C:\Windows\System\MkQVByF.exe
  C:\Windows\System\MkQVByF.exe
  2⤵
  PID:3896
- C:\Windows\System\PoaWrVz.exe
  C:\Windows\System\PoaWrVz.exe
  2⤵
  PID:3928
- C:\Windows\System\QwHnidb.exe
  C:\Windows\System\QwHnidb.exe
  2⤵
  PID:3960
- C:\Windows\System\eYlUxAE.exe
  C:\Windows\System\eYlUxAE.exe
  2⤵
  PID:3992
- C:\Windows\System\ozyfRLH.exe
  C:\Windows\System\ozyfRLH.exe
  2⤵
  PID:4024
- C:\Windows\System\YmhllCa.exe
  C:\Windows\System\YmhllCa.exe
  2⤵
  PID:4072
- C:\Windows\System\eMXPVag.exe
  C:\Windows\System\eMXPVag.exe
  2⤵
  PID:2796
- C:\Windows\System\YFxEAdb.exe
  C:\Windows\System\YFxEAdb.exe
  2⤵
  PID:1312
- C:\Windows\System\AIraflV.exe
  C:\Windows\System\AIraflV.exe
  2⤵
  PID:1852
- C:\Windows\System\xisOJRC.exe
  C:\Windows\System\xisOJRC.exe
  2⤵
  PID:1976
- C:\Windows\System\fFCEJLh.exe
  C:\Windows\System\fFCEJLh.exe
  2⤵
  PID:1952
- C:\Windows\System\unYCECp.exe
  C:\Windows\System\unYCECp.exe
  2⤵
  PID:3192
- C:\Windows\System\uaLSbOS.exe
  C:\Windows\System\uaLSbOS.exe
  2⤵
  PID:3316
- C:\Windows\System\rvCddnu.exe
  C:\Windows\System\rvCddnu.exe
  2⤵
  PID:3432
- C:\Windows\System\BAefqRG.exe
  C:\Windows\System\BAefqRG.exe
  2⤵
  PID:3592
- C:\Windows\System\rbuPvYd.exe
  C:\Windows\System\rbuPvYd.exe
  2⤵
  PID:3720
- C:\Windows\System\YGGUbXu.exe
  C:\Windows\System\YGGUbXu.exe
  2⤵
  PID:3956
- C:\Windows\System\MUuipPj.exe
  C:\Windows\System\MUuipPj.exe
  2⤵
  PID:4020
- C:\Windows\System\toRWaru.exe
  C:\Windows\System\toRWaru.exe
  2⤵
  PID:3056
- C:\Windows\System\BxfXHFF.exe
  C:\Windows\System\BxfXHFF.exe
  2⤵
  PID:2852
- C:\Windows\System\CRVsjeH.exe
  C:\Windows\System\CRVsjeH.exe
  2⤵
  PID:1644
- C:\Windows\System\pXxhZzQ.exe
  C:\Windows\System\pXxhZzQ.exe
  2⤵
  PID:2524
- C:\Windows\System\rIhBZUd.exe
  C:\Windows\System\rIhBZUd.exe
  2⤵
  PID:4040
- C:\Windows\System\ZwJsCaH.exe
  C:\Windows\System\ZwJsCaH.exe
  2⤵
  PID:2208
- C:\Windows\System\RMTKaUm.exe
  C:\Windows\System\RMTKaUm.exe
  2⤵
  PID:2572
- C:\Windows\System\wAaBNQZ.exe
  C:\Windows\System\wAaBNQZ.exe
  2⤵
  PID:380
- C:\Windows\System\AHMgiYz.exe
  C:\Windows\System\AHMgiYz.exe
  2⤵
  PID:2680
- C:\Windows\System\RvhDrKm.exe
  C:\Windows\System\RvhDrKm.exe
  2⤵
  PID:4056
- C:\Windows\System\KJsjWav.exe
  C:\Windows\System\KJsjWav.exe
  2⤵
  PID:952
- C:\Windows\System\JWpnwtC.exe
  C:\Windows\System\JWpnwtC.exe
  2⤵
  PID:2036
- C:\Windows\System\WrJKkkv.exe
  C:\Windows\System\WrJKkkv.exe
  2⤵
  PID:840
- C:\Windows\System\ZWwacVu.exe
  C:\Windows\System\ZWwacVu.exe
  2⤵
  PID:2788
- C:\Windows\System\xWlnFPP.exe
  C:\Windows\System\xWlnFPP.exe
  2⤵
  PID:1816
- C:\Windows\System\idXFjnP.exe
  C:\Windows\System\idXFjnP.exe
  2⤵
  PID:2492
- C:\Windows\System\AMJTTtg.exe
  C:\Windows\System\AMJTTtg.exe
  2⤵
  PID:2944
- C:\Windows\System\wuFoMah.exe
  C:\Windows\System\wuFoMah.exe
  2⤵
  PID:264
- C:\Windows\System\OicabWP.exe
  C:\Windows\System\OicabWP.exe
  2⤵
  PID:2580
- C:\Windows\System\LvatAPS.exe
  C:\Windows\System\LvatAPS.exe
  2⤵
  PID:2456
- C:\Windows\System\sjeGYFy.exe
  C:\Windows\System\sjeGYFy.exe
  2⤵
  PID:2596
- C:\Windows\System\rKQsJeJ.exe
  C:\Windows\System\rKQsJeJ.exe
  2⤵
  PID:1808
- C:\Windows\System\lMHzYrq.exe
  C:\Windows\System\lMHzYrq.exe
  2⤵
  PID:3064
- C:\Windows\System\NRqjzxX.exe
  C:\Windows\System\NRqjzxX.exe
  2⤵
  PID:3112
- C:\Windows\System\rpuBCqc.exe
  C:\Windows\System\rpuBCqc.exe
  2⤵
  PID:3092
- C:\Windows\System\sQsulpW.exe
  C:\Windows\System\sQsulpW.exe
  2⤵
  PID:2736
- C:\Windows\System\SmgzUai.exe
  C:\Windows\System\SmgzUai.exe
  2⤵
  PID:3284
- C:\Windows\System\WyAvblU.exe
  C:\Windows\System\WyAvblU.exe
  2⤵
  PID:1988
- C:\Windows\System\drWErIP.exe
  C:\Windows\System\drWErIP.exe
  2⤵
  PID:3348
- C:\Windows\System\cfUIMOV.exe
  C:\Windows\System\cfUIMOV.exe
  2⤵
  PID:3444
- C:\Windows\System\EaZJCIa.exe
  C:\Windows\System\EaZJCIa.exe
  2⤵
  PID:1716
- C:\Windows\System\SreNaZc.exe
  C:\Windows\System\SreNaZc.exe
  2⤵
  PID:3464
- C:\Windows\System\YFeFZGO.exe
  C:\Windows\System\YFeFZGO.exe
  2⤵
  PID:3688
- C:\Windows\System\lmJJuIE.exe
  C:\Windows\System\lmJJuIE.exe
  2⤵
  PID:3764
- C:\Windows\System\bRApTPU.exe
  C:\Windows\System\bRApTPU.exe
  2⤵
  PID:3828
- C:\Windows\System\dUBksNd.exe
  C:\Windows\System\dUBksNd.exe
  2⤵
  PID:1108
- C:\Windows\System\asuKvZl.exe
  C:\Windows\System\asuKvZl.exe
  2⤵
  PID:2544
- C:\Windows\System\HZQzvMa.exe
  C:\Windows\System\HZQzvMa.exe
  2⤵
  PID:872
- C:\Windows\System\wBWdaNv.exe
  C:\Windows\System\wBWdaNv.exe
  2⤵
  PID:832
- C:\Windows\System\MtluOsL.exe
  C:\Windows\System\MtluOsL.exe
  2⤵
  PID:2604
- C:\Windows\System\AMDaNhV.exe
  C:\Windows\System\AMDaNhV.exe
  2⤵
  PID:2548
- C:\Windows\System\RaUvUcC.exe
  C:\Windows\System\RaUvUcC.exe
  2⤵
  PID:3988
- C:\Windows\System\dgISAKO.exe
  C:\Windows\System\dgISAKO.exe
  2⤵
  PID:1276
- C:\Windows\System\MzWkoaM.exe
  C:\Windows\System\MzWkoaM.exe
  2⤵
  PID:2264
- C:\Windows\System\twJbrNF.exe
  C:\Windows\System\twJbrNF.exe
  2⤵
  PID:2508
- C:\Windows\System\uSzQQOl.exe
  C:\Windows\System\uSzQQOl.exe
  2⤵
  PID:2284
- C:\Windows\System\vbVKADI.exe
  C:\Windows\System\vbVKADI.exe
  2⤵
  PID:1984
- C:\Windows\System\OjxdxUP.exe
  C:\Windows\System\OjxdxUP.exe
  2⤵
  PID:2148
- C:\Windows\System\HtJqPpo.exe
  C:\Windows\System\HtJqPpo.exe
  2⤵
  PID:3156
- C:\Windows\System\yglPEDx.exe
  C:\Windows\System\yglPEDx.exe
  2⤵
  PID:3368
- C:\Windows\System\SiienUb.exe
  C:\Windows\System\SiienUb.exe
  2⤵
  PID:560
- C:\Windows\System\IfFDldC.exe
  C:\Windows\System\IfFDldC.exe
  2⤵
  PID:2408
- C:\Windows\System\iZWgugF.exe
  C:\Windows\System\iZWgugF.exe
  2⤵
  PID:3400
- C:\Windows\System\fzJgWSZ.exe
  C:\Windows\System\fzJgWSZ.exe
  2⤵
  PID:2684
- C:\Windows\System\Hlxrqay.exe
  C:\Windows\System\Hlxrqay.exe
  2⤵
  PID:2172
- C:\Windows\System\BEKstou.exe
  C:\Windows\System\BEKstou.exe
  2⤵
  PID:3924
- C:\Windows\System\YYgEBqS.exe
  C:\Windows\System\YYgEBqS.exe
  2⤵
  PID:2648
- C:\Windows\System\vajivTJ.exe
  C:\Windows\System\vajivTJ.exe
  2⤵
  PID:2480
- C:\Windows\System\ACfxAVl.exe
  C:\Windows\System\ACfxAVl.exe
  2⤵
  PID:2752
- C:\Windows\System\MXQAVrp.exe
  C:\Windows\System\MXQAVrp.exe
  2⤵
  PID:2160
- C:\Windows\System\sNzNdZl.exe
  C:\Windows\System\sNzNdZl.exe
  2⤵
  PID:3412
- C:\Windows\System\GtnMzaP.exe
  C:\Windows\System\GtnMzaP.exe
  2⤵
  PID:4084
- C:\Windows\System\PntrIJs.exe
  C:\Windows\System\PntrIJs.exe
  2⤵
  PID:3912
- C:\Windows\System\HtPIDUR.exe
  C:\Windows\System\HtPIDUR.exe
  2⤵
  PID:2300
- C:\Windows\System\EyNLZLN.exe
  C:\Windows\System\EyNLZLN.exe
  2⤵
  PID:1760
- C:\Windows\System\DApoQLc.exe
  C:\Windows\System\DApoQLc.exe
  2⤵
  PID:4108
- C:\Windows\System\JZQjzOe.exe
  C:\Windows\System\JZQjzOe.exe
  2⤵
  PID:4124
- C:\Windows\System\BWutjbr.exe
  C:\Windows\System\BWutjbr.exe
  2⤵
  PID:4140
- C:\Windows\System\rBNdesQ.exe
  C:\Windows\System\rBNdesQ.exe
  2⤵
  PID:4156
- C:\Windows\System\lgvyBPf.exe
  C:\Windows\System\lgvyBPf.exe
  2⤵
  PID:4172
- C:\Windows\System\FuyZhYc.exe
  C:\Windows\System\FuyZhYc.exe
  2⤵
  PID:4188
- C:\Windows\System\rHgdBwp.exe
  C:\Windows\System\rHgdBwp.exe
  2⤵
  PID:4208
- C:\Windows\System\nNRbDlj.exe
  C:\Windows\System\nNRbDlj.exe
  2⤵
  PID:4224
- C:\Windows\System\lQgRMvL.exe
  C:\Windows\System\lQgRMvL.exe
  2⤵
  PID:4240
- C:\Windows\System\bltzPbP.exe
  C:\Windows\System\bltzPbP.exe
  2⤵
  PID:4256
- C:\Windows\System\dHbkYAi.exe
  C:\Windows\System\dHbkYAi.exe
  2⤵
  PID:4272
- C:\Windows\System\DGscZeS.exe
  C:\Windows\System\DGscZeS.exe
  2⤵
  PID:4288
- C:\Windows\System\xWXrfFg.exe
  C:\Windows\System\xWXrfFg.exe
  2⤵
  PID:4304
- C:\Windows\System\froXiXB.exe
  C:\Windows\System\froXiXB.exe
  2⤵
  PID:4320
- C:\Windows\System\bBeBEsq.exe
  C:\Windows\System\bBeBEsq.exe
  2⤵
  PID:4336
- C:\Windows\System\SqxJNkY.exe
  C:\Windows\System\SqxJNkY.exe
  2⤵
  PID:4352
- C:\Windows\System\BQzbQJi.exe
  C:\Windows\System\BQzbQJi.exe
  2⤵
  PID:4368
- C:\Windows\System\wMAcbHH.exe
  C:\Windows\System\wMAcbHH.exe
  2⤵
  PID:4384
- C:\Windows\System\KenJpZJ.exe
  C:\Windows\System\KenJpZJ.exe
  2⤵
  PID:4400
- C:\Windows\System\uCRgMtA.exe
  C:\Windows\System\uCRgMtA.exe
  2⤵
  PID:4416
- C:\Windows\System\euCmgyx.exe
  C:\Windows\System\euCmgyx.exe
  2⤵
  PID:4432
- C:\Windows\System\iFFpxZn.exe
  C:\Windows\System\iFFpxZn.exe
  2⤵
  PID:4448
- C:\Windows\System\tabIsJa.exe
  C:\Windows\System\tabIsJa.exe
  2⤵
  PID:4464
- C:\Windows\System\GkURsXV.exe
  C:\Windows\System\GkURsXV.exe
  2⤵
  PID:4484
- C:\Windows\System\gpBPyTs.exe
  C:\Windows\System\gpBPyTs.exe
  2⤵
  PID:4500
- C:\Windows\System\azkcYva.exe
  C:\Windows\System\azkcYva.exe
  2⤵
  PID:4516
- C:\Windows\System\MSBDFGk.exe
  C:\Windows\System\MSBDFGk.exe
  2⤵
  PID:4532
- C:\Windows\System\osmxnIy.exe
  C:\Windows\System\osmxnIy.exe
  2⤵
  PID:4548
- C:\Windows\System\NhAbTmQ.exe
  C:\Windows\System\NhAbTmQ.exe
  2⤵
  PID:4564
- C:\Windows\System\LBqTHdb.exe
  C:\Windows\System\LBqTHdb.exe
  2⤵
  PID:4580
- C:\Windows\System\XmHZwcg.exe
  C:\Windows\System\XmHZwcg.exe
  2⤵
  PID:4596
- C:\Windows\System\imzAoVT.exe
  C:\Windows\System\imzAoVT.exe
  2⤵
  PID:4612
- C:\Windows\System\jEadkaA.exe
  C:\Windows\System\jEadkaA.exe
  2⤵
  PID:4632
- C:\Windows\System\mMSUIXe.exe
  C:\Windows\System\mMSUIXe.exe
  2⤵
  PID:4648
- C:\Windows\System\lZwzZkS.exe
  C:\Windows\System\lZwzZkS.exe
  2⤵
  PID:4664
- C:\Windows\System\tGDMEXC.exe
  C:\Windows\System\tGDMEXC.exe
  2⤵
  PID:4680
- C:\Windows\System\efMkSJw.exe
  C:\Windows\System\efMkSJw.exe
  2⤵
  PID:4696
- C:\Windows\System\kTVNnKK.exe
  C:\Windows\System\kTVNnKK.exe
  2⤵
  PID:4712
- C:\Windows\System\DEemLYM.exe
  C:\Windows\System\DEemLYM.exe
  2⤵
  PID:4728
- C:\Windows\System\RiHRdrO.exe
  C:\Windows\System\RiHRdrO.exe
  2⤵
  PID:4744
- C:\Windows\System\zscqAGI.exe
  C:\Windows\System\zscqAGI.exe
  2⤵
  PID:4760
- C:\Windows\System\tQNmFRs.exe
  C:\Windows\System\tQNmFRs.exe
  2⤵
  PID:4780
- C:\Windows\System\GYEtLSw.exe
  C:\Windows\System\GYEtLSw.exe
  2⤵
  PID:4796
- C:\Windows\System\SdDUdoX.exe
  C:\Windows\System\SdDUdoX.exe
  2⤵
  PID:4812
- C:\Windows\System\IrrepHI.exe
  C:\Windows\System\IrrepHI.exe
  2⤵
  PID:4828
- C:\Windows\System\dymwlCJ.exe
  C:\Windows\System\dymwlCJ.exe
  2⤵
  PID:4844
- C:\Windows\System\yvWKxXT.exe
  C:\Windows\System\yvWKxXT.exe
  2⤵
  PID:4860
- C:\Windows\System\YFKOKSy.exe
  C:\Windows\System\YFKOKSy.exe
  2⤵
  PID:4876
- C:\Windows\System\zhfGlCx.exe
  C:\Windows\System\zhfGlCx.exe
  2⤵
  PID:4892
- C:\Windows\System\VcYoFtO.exe
  C:\Windows\System\VcYoFtO.exe
  2⤵
  PID:4908
- C:\Windows\System\uQwCiff.exe
  C:\Windows\System\uQwCiff.exe
  2⤵
  PID:4924
- C:\Windows\System\KNyEuKh.exe
  C:\Windows\System\KNyEuKh.exe
  2⤵
  PID:4940
- C:\Windows\System\JRkhlaE.exe
  C:\Windows\System\JRkhlaE.exe
  2⤵
  PID:4956
- C:\Windows\System\mrHxxpY.exe
  C:\Windows\System\mrHxxpY.exe
  2⤵
  PID:4972
- C:\Windows\System\BnttEvB.exe
  C:\Windows\System\BnttEvB.exe
  2⤵
  PID:4988
- C:\Windows\System\Nbtdwsg.exe
  C:\Windows\System\Nbtdwsg.exe
  2⤵
  PID:5004
- C:\Windows\System\BEBJsfe.exe
  C:\Windows\System\BEBJsfe.exe
  2⤵
  PID:5020
- C:\Windows\System\msPYrQr.exe
  C:\Windows\System\msPYrQr.exe
  2⤵
  PID:5036
- C:\Windows\System\cblIyJd.exe
  C:\Windows\System\cblIyJd.exe
  2⤵
  PID:5052
- C:\Windows\System\BZCZupg.exe
  C:\Windows\System\BZCZupg.exe
  2⤵
  PID:5068
- C:\Windows\System\AXfjweL.exe
  C:\Windows\System\AXfjweL.exe
  2⤵
  PID:5084
- C:\Windows\System\iYAneIz.exe
  C:\Windows\System\iYAneIz.exe
  2⤵
  PID:5104
- C:\Windows\System\DNxeERD.exe
  C:\Windows\System\DNxeERD.exe
  2⤵
  PID:1768
- C:\Windows\System\CgEFRYZ.exe
  C:\Windows\System\CgEFRYZ.exe
  2⤵
  PID:348
- C:\Windows\System\VONfHpf.exe
  C:\Windows\System\VONfHpf.exe
  2⤵
  PID:2232
- C:\Windows\System\EndyKSg.exe
  C:\Windows\System\EndyKSg.exe
  2⤵
  PID:3732
- C:\Windows\System\wdPCcJn.exe
  C:\Windows\System\wdPCcJn.exe
  2⤵
  PID:4116
- C:\Windows\System\bwToGhS.exe
  C:\Windows\System\bwToGhS.exe
  2⤵
  PID:4152
- C:\Windows\System\QYgxhbB.exe
  C:\Windows\System\QYgxhbB.exe
  2⤵
  PID:4248
- C:\Windows\System\bJBxQjs.exe
  C:\Windows\System\bJBxQjs.exe
  2⤵
  PID:3752
- C:\Windows\System\KpsBbkS.exe
  C:\Windows\System\KpsBbkS.exe
  2⤵
  PID:4280
- C:\Windows\System\FfhkZkN.exe
  C:\Windows\System\FfhkZkN.exe
  2⤵
  PID:4344
- C:\Windows\System\prZFUfj.exe
  C:\Windows\System\prZFUfj.exe
  2⤵
  PID:4408
- C:\Windows\System\iODVXkD.exe
  C:\Windows\System\iODVXkD.exe
  2⤵
  PID:4196
- C:\Windows\System\ZkRWpqD.exe
  C:\Windows\System\ZkRWpqD.exe
  2⤵
  PID:4168
- C:\Windows\System\YmeaMdb.exe
  C:\Windows\System\YmeaMdb.exe
  2⤵
  PID:4232
- C:\Windows\System\pLmVWfU.exe
  C:\Windows\System\pLmVWfU.exe
  2⤵
  PID:4472
- C:\Windows\System\gEbYGuk.exe
  C:\Windows\System\gEbYGuk.exe
  2⤵
  PID:4236
- C:\Windows\System\BaAEgVs.exe
  C:\Windows\System\BaAEgVs.exe
  2⤵
  PID:4300
- C:\Windows\System\nJcIbUd.exe
  C:\Windows\System\nJcIbUd.exe
  2⤵
  PID:4392
- C:\Windows\System\iFUZrsJ.exe
  C:\Windows\System\iFUZrsJ.exe
  2⤵
  PID:4576
- C:\Windows\System\zBhhZsC.exe
  C:\Windows\System\zBhhZsC.exe
  2⤵
  PID:4460
- C:\Windows\System\ERXDCuB.exe
  C:\Windows\System\ERXDCuB.exe
  2⤵
  PID:4644
- C:\Windows\System\FWzWbpq.exe
  C:\Windows\System\FWzWbpq.exe
  2⤵
  PID:4528
- C:\Windows\System\DuPKvpL.exe
  C:\Windows\System\DuPKvpL.exe
  2⤵
  PID:4588
- C:\Windows\System\yGTErpm.exe
  C:\Windows\System\yGTErpm.exe
  2⤵
  PID:4736
- C:\Windows\System\RoFpQgl.exe
  C:\Windows\System\RoFpQgl.exe
  2⤵
  PID:4776
- C:\Windows\System\YgBruFg.exe
  C:\Windows\System\YgBruFg.exe
  2⤵
  PID:4628
- C:\Windows\System\wvbQbWy.exe
  C:\Windows\System\wvbQbWy.exe
  2⤵
  PID:4872
- C:\Windows\System\LKhYPUy.exe
  C:\Windows\System\LKhYPUy.exe
  2⤵
  PID:4936
- C:\Windows\System\BOGYEgU.exe
  C:\Windows\System\BOGYEgU.exe
  2⤵
  PID:5000
- C:\Windows\System\dXvFWkh.exe
  C:\Windows\System\dXvFWkh.exe
  2⤵
  PID:5064
- C:\Windows\System\wzoqiLp.exe
  C:\Windows\System\wzoqiLp.exe
  2⤵
  PID:4824
- C:\Windows\System\IozNNgR.exe
  C:\Windows\System\IozNNgR.exe
  2⤵
  PID:4984
- C:\Windows\System\trWdUws.exe
  C:\Windows\System\trWdUws.exe
  2⤵
  PID:5096
- C:\Windows\System\YKEZMqH.exe
  C:\Windows\System\YKEZMqH.exe
  2⤵
  PID:3796
- C:\Windows\System\xBBAgYe.exe
  C:\Windows\System\xBBAgYe.exe
  2⤵
  PID:4720
- C:\Windows\System\qVhLsbk.exe
  C:\Windows\System\qVhLsbk.exe
  2⤵
  PID:4788
- C:\Windows\System\nGTTYlh.exe
  C:\Windows\System\nGTTYlh.exe
  2⤵
  PID:4888
- C:\Windows\System\vSdZzdB.exe
  C:\Windows\System\vSdZzdB.exe
  2⤵
  PID:4952
- C:\Windows\System\zVnOCIQ.exe
  C:\Windows\System\zVnOCIQ.exe
  2⤵
  PID:4316
- C:\Windows\System\sigVcJL.exe
  C:\Windows\System\sigVcJL.exe
  2⤵
  PID:5076
- C:\Windows\System\HQlBKUg.exe
  C:\Windows\System\HQlBKUg.exe
  2⤵
  PID:4200
- C:\Windows\System\sILutHE.exe
  C:\Windows\System\sILutHE.exe
  2⤵
  PID:3240
- C:\Windows\System\uYmkrdq.exe
  C:\Windows\System\uYmkrdq.exe
  2⤵
  PID:4184
- C:\Windows\System\KrYyoUq.exe
  C:\Windows\System\KrYyoUq.exe
  2⤵
  PID:4508
- C:\Windows\System\HRurika.exe
  C:\Windows\System\HRurika.exe
  2⤵
  PID:4920
- C:\Windows\System\QZPlGbI.exe
  C:\Windows\System\QZPlGbI.exe
  2⤵
  PID:5116
- C:\Windows\System\ZwGkWWs.exe
  C:\Windows\System\ZwGkWWs.exe
  2⤵
  PID:4968
- C:\Windows\System\Zlnfqrv.exe
  C:\Windows\System\Zlnfqrv.exe
  2⤵
  PID:4572
- C:\Windows\System\WdEjYOr.exe
  C:\Windows\System\WdEjYOr.exe
  2⤵
  PID:4592
- C:\Windows\System\kFrDhmK.exe
  C:\Windows\System\kFrDhmK.exe
  2⤵
  PID:4868
- C:\Windows\System\ooWUVVk.exe
  C:\Windows\System\ooWUVVk.exe
  2⤵
  PID:4656
- C:\Windows\System\IzoJkOd.exe
  C:\Windows\System\IzoJkOd.exe
  2⤵
  PID:4852
- C:\Windows\System\XpWyciP.exe
  C:\Windows\System\XpWyciP.exe
  2⤵
  PID:4312
- C:\Windows\System\nKYOMgx.exe
  C:\Windows\System\nKYOMgx.exe
  2⤵
  PID:4104
- C:\Windows\System\VbPfsjA.exe
  C:\Windows\System\VbPfsjA.exe
  2⤵
  PID:4100
- C:\Windows\System\jAxJVmM.exe
  C:\Windows\System\jAxJVmM.exe
  2⤵
  PID:4704
- C:\Windows\System\SMGtlTk.exe
  C:\Windows\System\SMGtlTk.exe
  2⤵
  PID:4904
- C:\Windows\System\oyCjBXs.exe
  C:\Windows\System\oyCjBXs.exe
  2⤵
  PID:4752
- C:\Windows\System\EbUTzoh.exe
  C:\Windows\System\EbUTzoh.exe
  2⤵
  PID:5112
- C:\Windows\System\tcCplTE.exe
  C:\Windows\System\tcCplTE.exe
  2⤵
  PID:4424
- C:\Windows\System\HUWSjFq.exe
  C:\Windows\System\HUWSjFq.exe
  2⤵
  PID:4840
- C:\Windows\System\hvScXNX.exe
  C:\Windows\System\hvScXNX.exe
  2⤵
  PID:4148
- C:\Windows\System\QVzPGdN.exe
  C:\Windows\System\QVzPGdN.exe
  2⤵
  PID:4456
- C:\Windows\System\fdKdUmU.exe
  C:\Windows\System\fdKdUmU.exe
  2⤵
  PID:1548
- C:\Windows\System\HnoKjLB.exe
  C:\Windows\System\HnoKjLB.exe
  2⤵
  PID:5016
- C:\Windows\System\jXbpdlU.exe
  C:\Windows\System\jXbpdlU.exe
  2⤵
  PID:4560
- C:\Windows\System\XuDaRLu.exe
  C:\Windows\System\XuDaRLu.exe
  2⤵
  PID:5136
- C:\Windows\System\MDrzrKe.exe
  C:\Windows\System\MDrzrKe.exe
  2⤵
  PID:5152
- C:\Windows\System\FQDtDxc.exe
  C:\Windows\System\FQDtDxc.exe
  2⤵
  PID:5168
- C:\Windows\System\sdCrRhU.exe
  C:\Windows\System\sdCrRhU.exe
  2⤵
  PID:5184
- C:\Windows\System\JYhhqWs.exe
  C:\Windows\System\JYhhqWs.exe
  2⤵
  PID:5200
- C:\Windows\System\zfvRUDR.exe
  C:\Windows\System\zfvRUDR.exe
  2⤵
  PID:5216
- C:\Windows\System\WpBMMVK.exe
  C:\Windows\System\WpBMMVK.exe
  2⤵
  PID:5232
- C:\Windows\System\mKVtoBQ.exe
  C:\Windows\System\mKVtoBQ.exe
  2⤵
  PID:5248
- C:\Windows\System\aEUxWcW.exe
  C:\Windows\System\aEUxWcW.exe
  2⤵
  PID:5264
- C:\Windows\System\VOGGlNW.exe
  C:\Windows\System\VOGGlNW.exe
  2⤵
  PID:5280
- C:\Windows\System\XanouhS.exe
  C:\Windows\System\XanouhS.exe
  2⤵
  PID:5296
- C:\Windows\System\upIaSkt.exe
  C:\Windows\System\upIaSkt.exe
  2⤵
  PID:5312
- C:\Windows\System\TstgiDl.exe
  C:\Windows\System\TstgiDl.exe
  2⤵
  PID:5328
- C:\Windows\System\Umhlsip.exe
  C:\Windows\System\Umhlsip.exe
  2⤵
  PID:5344
- C:\Windows\System\ERTLiGB.exe
  C:\Windows\System\ERTLiGB.exe
  2⤵
  PID:5360
- C:\Windows\System\uznPLng.exe
  C:\Windows\System\uznPLng.exe
  2⤵
  PID:5376
- C:\Windows\System\vLSqkQF.exe
  C:\Windows\System\vLSqkQF.exe
  2⤵
  PID:5392
- C:\Windows\System\mXPeiRt.exe
  C:\Windows\System\mXPeiRt.exe
  2⤵
  PID:5408
- C:\Windows\System\EgwBXYP.exe
  C:\Windows\System\EgwBXYP.exe
  2⤵
  PID:5424
- C:\Windows\System\sZxmcNE.exe
  C:\Windows\System\sZxmcNE.exe
  2⤵
  PID:5440
- C:\Windows\System\DWweaJT.exe
  C:\Windows\System\DWweaJT.exe
  2⤵
  PID:5456
- C:\Windows\System\kYIIdXT.exe
  C:\Windows\System\kYIIdXT.exe
  2⤵
  PID:5472
- C:\Windows\System\qcNEHAU.exe
  C:\Windows\System\qcNEHAU.exe
  2⤵
  PID:5488
- C:\Windows\System\MThZUiF.exe
  C:\Windows\System\MThZUiF.exe
  2⤵
  PID:5504
- C:\Windows\System\RMbDqhg.exe
  C:\Windows\System\RMbDqhg.exe
  2⤵
  PID:5520
- C:\Windows\System\MPcbglW.exe
  C:\Windows\System\MPcbglW.exe
  2⤵
  PID:5536
- C:\Windows\System\NXTmDNj.exe
  C:\Windows\System\NXTmDNj.exe
  2⤵
  PID:5552
- C:\Windows\System\GseQAEb.exe
  C:\Windows\System\GseQAEb.exe
  2⤵
  PID:5568
- C:\Windows\System\uVMeCPT.exe
  C:\Windows\System\uVMeCPT.exe
  2⤵
  PID:5584
- C:\Windows\System\VwnhYNs.exe
  C:\Windows\System\VwnhYNs.exe
  2⤵
  PID:5600
- C:\Windows\System\gGrTDrT.exe
  C:\Windows\System\gGrTDrT.exe
  2⤵
  PID:5616
- C:\Windows\System\ofFfotM.exe
  C:\Windows\System\ofFfotM.exe
  2⤵
  PID:5632
- C:\Windows\System\kodiDPl.exe
  C:\Windows\System\kodiDPl.exe
  2⤵
  PID:5648
- C:\Windows\System\zsSkjDe.exe
  C:\Windows\System\zsSkjDe.exe
  2⤵
  PID:5664
- C:\Windows\System\gzpQKwp.exe
  C:\Windows\System\gzpQKwp.exe
  2⤵
  PID:5680
- C:\Windows\System\PYdeZEx.exe
  C:\Windows\System\PYdeZEx.exe
  2⤵
  PID:5696
- C:\Windows\System\cXagjBK.exe
  C:\Windows\System\cXagjBK.exe
  2⤵
  PID:5716
- C:\Windows\System\JlfGzXd.exe
  C:\Windows\System\JlfGzXd.exe
  2⤵
  PID:5732
- C:\Windows\System\HYlsVRH.exe
  C:\Windows\System\HYlsVRH.exe
  2⤵
  PID:5748
- C:\Windows\System\CbOoCdd.exe
  C:\Windows\System\CbOoCdd.exe
  2⤵
  PID:5764
- C:\Windows\System\xOyRFPY.exe
  C:\Windows\System\xOyRFPY.exe
  2⤵
  PID:5780
- C:\Windows\System\fbZtKHk.exe
  C:\Windows\System\fbZtKHk.exe
  2⤵
  PID:5796
- C:\Windows\System\CyjWFZm.exe
  C:\Windows\System\CyjWFZm.exe
  2⤵
  PID:5812
- C:\Windows\System\OOJZxSl.exe
  C:\Windows\System\OOJZxSl.exe
  2⤵
  PID:5828
- C:\Windows\System\sZgEMzy.exe
  C:\Windows\System\sZgEMzy.exe
  2⤵
  PID:5844
- C:\Windows\System\YtDbUzj.exe
  C:\Windows\System\YtDbUzj.exe
  2⤵
  PID:5860
- C:\Windows\System\rmATxeW.exe
  C:\Windows\System\rmATxeW.exe
  2⤵
  PID:5876
- C:\Windows\System\TGkNsrn.exe
  C:\Windows\System\TGkNsrn.exe
  2⤵
  PID:5892
- C:\Windows\System\iWnZEFP.exe
  C:\Windows\System\iWnZEFP.exe
  2⤵
  PID:5908
- C:\Windows\System\PJehjcY.exe
  C:\Windows\System\PJehjcY.exe
  2⤵
  PID:5924
- C:\Windows\System\SaYfyUL.exe
  C:\Windows\System\SaYfyUL.exe
  2⤵
  PID:5940
- C:\Windows\System\FmXogHk.exe
  C:\Windows\System\FmXogHk.exe
  2⤵
  PID:5956
- C:\Windows\System\wiSWwjj.exe
  C:\Windows\System\wiSWwjj.exe
  2⤵
  PID:5972
- C:\Windows\System\aKWFSVF.exe
  C:\Windows\System\aKWFSVF.exe
  2⤵
  PID:5988
- C:\Windows\System\noxYVDP.exe
  C:\Windows\System\noxYVDP.exe
  2⤵
  PID:6004
- C:\Windows\System\qGmmFtJ.exe
  C:\Windows\System\qGmmFtJ.exe
  2⤵
  PID:6020
- C:\Windows\System\XNhcegV.exe
  C:\Windows\System\XNhcegV.exe
  2⤵
  PID:6036
- C:\Windows\System\YKWOlWq.exe
  C:\Windows\System\YKWOlWq.exe
  2⤵
  PID:6052
- C:\Windows\System\IIeAhHu.exe
  C:\Windows\System\IIeAhHu.exe
  2⤵
  PID:6072
- C:\Windows\System\PwUXhNx.exe
  C:\Windows\System\PwUXhNx.exe
  2⤵
  PID:6088
- C:\Windows\System\AXGwkiA.exe
  C:\Windows\System\AXGwkiA.exe
  2⤵
  PID:6104
- C:\Windows\System\OfsnzWy.exe
  C:\Windows\System\OfsnzWy.exe
  2⤵
  PID:6120
- C:\Windows\System\UPdGhMi.exe
  C:\Windows\System\UPdGhMi.exe
  2⤵
  PID:6136
- C:\Windows\System\CmCVKfc.exe
  C:\Windows\System\CmCVKfc.exe
  2⤵
  PID:5128
- C:\Windows\System\GQyMNuw.exe
  C:\Windows\System\GQyMNuw.exe
  2⤵
  PID:4692
- C:\Windows\System\xZDQXKk.exe
  C:\Windows\System\xZDQXKk.exe
  2⤵
  PID:4820
- C:\Windows\System\anbACbT.exe
  C:\Windows\System\anbACbT.exe
  2⤵
  PID:5192
- C:\Windows\System\yYzNLpZ.exe
  C:\Windows\System\yYzNLpZ.exe
  2⤵
  PID:2552
- C:\Windows\System\ttqvDmo.exe
  C:\Windows\System\ttqvDmo.exe
  2⤵
  PID:5288
- C:\Windows\System\GyavBdA.exe
  C:\Windows\System\GyavBdA.exe
  2⤵
  PID:5148
- C:\Windows\System\WPZiAxJ.exe
  C:\Windows\System\WPZiAxJ.exe
  2⤵
  PID:5352
- C:\Windows\System\tUorLEV.exe
  C:\Windows\System\tUorLEV.exe
  2⤵
  PID:5208
- C:\Windows\System\DzcQjcG.exe
  C:\Windows\System\DzcQjcG.exe
  2⤵
  PID:5244
- C:\Windows\System\IbAjKSG.exe
  C:\Windows\System\IbAjKSG.exe
  2⤵
  PID:5336
- C:\Windows\System\ovEgcPj.exe
  C:\Windows\System\ovEgcPj.exe
  2⤵
  PID:5400
- C:\Windows\System\xWxhyXi.exe
  C:\Windows\System\xWxhyXi.exe
  2⤵
  PID:5448
- C:\Windows\System\YpntimP.exe
  C:\Windows\System\YpntimP.exe
  2⤵
  PID:5496
- C:\Windows\System\SjboKNw.exe
  C:\Windows\System\SjboKNw.exe
  2⤵
  PID:5532
- C:\Windows\System\bTrpyke.exe
  C:\Windows\System\bTrpyke.exe
  2⤵
  PID:5596
- C:\Windows\System\QCeYOXk.exe
  C:\Windows\System\QCeYOXk.exe
  2⤵
  PID:5660
- C:\Windows\System\KYCLsnI.exe
  C:\Windows\System\KYCLsnI.exe
  2⤵
  PID:5512
- C:\Windows\System\aEQxGyn.exe
  C:\Windows\System\aEQxGyn.exe
  2⤵
  PID:5480
- C:\Windows\System\fzchWZD.exe
  C:\Windows\System\fzchWZD.exe
  2⤵
  PID:5548
- C:\Windows\System\gZuVYZN.exe
  C:\Windows\System\gZuVYZN.exe
  2⤵
  PID:5644
- C:\Windows\System\VyFUrsw.exe
  C:\Windows\System\VyFUrsw.exe
  2⤵
  PID:5740
- C:\Windows\System\JylxILu.exe
  C:\Windows\System\JylxILu.exe
  2⤵
  PID:5760
- C:\Windows\System\ADHfQXP.exe
  C:\Windows\System\ADHfQXP.exe
  2⤵
  PID:5820
- C:\Windows\System\ACihMsr.exe
  C:\Windows\System\ACihMsr.exe
  2⤵
  PID:5808
- C:\Windows\System\LGdmjjV.exe
  C:\Windows\System\LGdmjjV.exe
  2⤵
  PID:5884
- C:\Windows\System\piVeYqp.exe
  C:\Windows\System\piVeYqp.exe
  2⤵
  PID:5840
- C:\Windows\System\PPTJYZT.exe
  C:\Windows\System\PPTJYZT.exe
  2⤵
  PID:5900
- C:\Windows\System\YPbiQUF.exe
  C:\Windows\System\YPbiQUF.exe
  2⤵
  PID:5968
- C:\Windows\System\SDnsvlX.exe
  C:\Windows\System\SDnsvlX.exe
  2⤵
  PID:5952
- C:\Windows\System\gLXrPEJ.exe
  C:\Windows\System\gLXrPEJ.exe
  2⤵
  PID:6016
- C:\Windows\System\onhAgSG.exe
  C:\Windows\System\onhAgSG.exe
  2⤵
  PID:3172
- C:\Windows\System\OnSWpCX.exe
  C:\Windows\System\OnSWpCX.exe
  2⤵
  PID:4268
- C:\Windows\System\DuLDdpP.exe
  C:\Windows\System\DuLDdpP.exe
  2⤵
  PID:6028
- C:\Windows\System\gllQIgj.exe
  C:\Windows\System\gllQIgj.exe
  2⤵
  PID:6068
- C:\Windows\System\DALWiZX.exe
  C:\Windows\System\DALWiZX.exe
  2⤵
  PID:6132
- C:\Windows\System\rgHRiWg.exe
  C:\Windows\System\rgHRiWg.exe
  2⤵
  PID:4164
- C:\Windows\System\HFkQMIu.exe
  C:\Windows\System\HFkQMIu.exe
  2⤵
  PID:5356
- C:\Windows\System\iDthuPQ.exe
  C:\Windows\System\iDthuPQ.exe
  2⤵
  PID:5212
- C:\Windows\System\gRvhCGX.exe
  C:\Windows\System\gRvhCGX.exe
  2⤵
  PID:5420
- C:\Windows\System\bNWXbuS.exe
  C:\Windows\System\bNWXbuS.exe
  2⤵
  PID:5372
- C:\Windows\System\VSbKdOZ.exe
  C:\Windows\System\VSbKdOZ.exe
  2⤵
  PID:5272
- C:\Windows\System\ZWHjjqx.exe
  C:\Windows\System\ZWHjjqx.exe
  2⤵
  PID:5788
- C:\Windows\System\EcASSrY.exe
  C:\Windows\System\EcASSrY.exe
  2⤵
  PID:5640
- C:\Windows\System\Rmkrbxa.exe
  C:\Windows\System\Rmkrbxa.exe
  2⤵
  PID:5708
- C:\Windows\System\KWOVPvV.exe
  C:\Windows\System\KWOVPvV.exe
  2⤵
  PID:5856
- C:\Windows\System\aszoikN.exe
  C:\Windows\System\aszoikN.exe
  2⤵
  PID:6000
- C:\Windows\System\tRNXhtV.exe
  C:\Windows\System\tRNXhtV.exe
  2⤵
  PID:4444
- C:\Windows\System\YPYoxzS.exe
  C:\Windows\System\YPYoxzS.exe
  2⤵
  PID:5936
- C:\Windows\System\pOJNRQC.exe
  C:\Windows\System\pOJNRQC.exe
  2⤵
  PID:5984
- C:\Windows\System\fNpEgJy.exe
  C:\Windows\System\fNpEgJy.exe
  2⤵
  PID:5452
- C:\Windows\System\IDGOkXG.exe
  C:\Windows\System\IDGOkXG.exe
  2⤵
  PID:5164
- C:\Windows\System\TMYBIFb.exe
  C:\Windows\System\TMYBIFb.exe
  2⤵
  PID:5368
- C:\Windows\System\iIZbxZP.exe
  C:\Windows\System\iIZbxZP.exe
  2⤵
  PID:5672
- C:\Windows\System\BATjzmg.exe
  C:\Windows\System\BATjzmg.exe
  2⤵
  PID:5656
- C:\Windows\System\luaCsmF.exe
  C:\Windows\System\luaCsmF.exe
  2⤵
  PID:5416
- C:\Windows\System\ORzmDNo.exe
  C:\Windows\System\ORzmDNo.exe
  2⤵
  PID:5872
- C:\Windows\System\jwjUbxw.exe
  C:\Windows\System\jwjUbxw.exe
  2⤵
  PID:5852
- C:\Windows\System\QTrWMpD.exe
  C:\Windows\System\QTrWMpD.exe
  2⤵
  PID:5916
- C:\Windows\System\vhWQvPr.exe
  C:\Windows\System\vhWQvPr.exe
  2⤵
  PID:5592
- C:\Windows\System\BGMpnhT.exe
  C:\Windows\System\BGMpnhT.exe
  2⤵
  PID:5544
- C:\Windows\System\lZWuvJh.exe
  C:\Windows\System\lZWuvJh.exe
  2⤵
  PID:5256
- C:\Windows\System\pQSDjYy.exe
  C:\Windows\System\pQSDjYy.exe
  2⤵
  PID:5432
- C:\Windows\System\WpsBOSv.exe
  C:\Windows\System\WpsBOSv.exe
  2⤵
  PID:6164
- C:\Windows\System\kkgrjDJ.exe
  C:\Windows\System\kkgrjDJ.exe
  2⤵
  PID:6180
- C:\Windows\System\qYDoQYt.exe
  C:\Windows\System\qYDoQYt.exe
  2⤵
  PID:6196
- C:\Windows\System\bFxkOLF.exe
  C:\Windows\System\bFxkOLF.exe
  2⤵
  PID:6216
- C:\Windows\System\ISvdSno.exe
  C:\Windows\System\ISvdSno.exe
  2⤵
  PID:6236
- C:\Windows\System\VlCmvmy.exe
  C:\Windows\System\VlCmvmy.exe
  2⤵
  PID:6256
- C:\Windows\System\rVGRQgj.exe
  C:\Windows\System\rVGRQgj.exe
  2⤵
  PID:6272
- C:\Windows\System\AVPCeCl.exe
  C:\Windows\System\AVPCeCl.exe
  2⤵
  PID:6288
- C:\Windows\System\DsNHmqQ.exe
  C:\Windows\System\DsNHmqQ.exe
  2⤵
  PID:6304
- C:\Windows\System\rCvvOCw.exe
  C:\Windows\System\rCvvOCw.exe
  2⤵
  PID:6320
- C:\Windows\System\NoGSrhl.exe
  C:\Windows\System\NoGSrhl.exe
  2⤵
  PID:6336
- C:\Windows\System\BnbGGPR.exe
  C:\Windows\System\BnbGGPR.exe
  2⤵
  PID:6352
- C:\Windows\System\vlppazt.exe
  C:\Windows\System\vlppazt.exe
  2⤵
  PID:6368
- C:\Windows\System\IUbExXL.exe
  C:\Windows\System\IUbExXL.exe
  2⤵
  PID:6384
- C:\Windows\System\QetGDiU.exe
  C:\Windows\System\QetGDiU.exe
  2⤵
  PID:6400
- C:\Windows\System\nFVwsZN.exe
  C:\Windows\System\nFVwsZN.exe
  2⤵
  PID:6416
- C:\Windows\System\nXutuZv.exe
  C:\Windows\System\nXutuZv.exe
  2⤵
  PID:6432
- C:\Windows\System\QlEibyW.exe
  C:\Windows\System\QlEibyW.exe
  2⤵
  PID:6448
- C:\Windows\System\NvLuTXD.exe
  C:\Windows\System\NvLuTXD.exe
  2⤵
  PID:6464
- C:\Windows\System\fHKQYQF.exe
  C:\Windows\System\fHKQYQF.exe
  2⤵
  PID:6480
- C:\Windows\System\guLyxog.exe
  C:\Windows\System\guLyxog.exe
  2⤵
  PID:6496
- C:\Windows\System\FwAMjei.exe
  C:\Windows\System\FwAMjei.exe
  2⤵
  PID:6512
- C:\Windows\System\mzhDXdP.exe
  C:\Windows\System\mzhDXdP.exe
  2⤵
  PID:6528
- C:\Windows\System\JciUvtt.exe
  C:\Windows\System\JciUvtt.exe
  2⤵
  PID:6544
- C:\Windows\System\icmdULh.exe
  C:\Windows\System\icmdULh.exe
  2⤵
  PID:6560
- C:\Windows\System\BKhGcpL.exe
  C:\Windows\System\BKhGcpL.exe
  2⤵
  PID:6576
- C:\Windows\System\NXokIeC.exe
  C:\Windows\System\NXokIeC.exe
  2⤵
  PID:6592
- C:\Windows\System\czPjGTo.exe
  C:\Windows\System\czPjGTo.exe
  2⤵
  PID:6608
- C:\Windows\System\sEHpYOl.exe
  C:\Windows\System\sEHpYOl.exe
  2⤵
  PID:6624
- C:\Windows\System\WUGnXwi.exe
  C:\Windows\System\WUGnXwi.exe
  2⤵
  PID:6640
- C:\Windows\System\hhOTIhd.exe
  C:\Windows\System\hhOTIhd.exe
  2⤵
  PID:6656
- C:\Windows\System\VnKJyhE.exe
  C:\Windows\System\VnKJyhE.exe
  2⤵
  PID:6672
- C:\Windows\System\MWgFAeB.exe
  C:\Windows\System\MWgFAeB.exe
  2⤵
  PID:6688
- C:\Windows\System\UYafreL.exe
  C:\Windows\System\UYafreL.exe
  2⤵
  PID:6704
- C:\Windows\System\nhbHRAQ.exe
  C:\Windows\System\nhbHRAQ.exe
  2⤵
  PID:6720
- C:\Windows\System\pZBQcgs.exe
  C:\Windows\System\pZBQcgs.exe
  2⤵
  PID:6736
- C:\Windows\System\pmkBecv.exe
  C:\Windows\System\pmkBecv.exe
  2⤵
  PID:6752
- C:\Windows\System\gHLLpVD.exe
  C:\Windows\System\gHLLpVD.exe
  2⤵
  PID:6768
- C:\Windows\System\pcHeqSn.exe
  C:\Windows\System\pcHeqSn.exe
  2⤵
  PID:6784
- C:\Windows\System\piyotcG.exe
  C:\Windows\System\piyotcG.exe
  2⤵
  PID:6800
- C:\Windows\System\ZgLSJXm.exe
  C:\Windows\System\ZgLSJXm.exe
  2⤵
  PID:6816
- C:\Windows\System\iswbFwW.exe
  C:\Windows\System\iswbFwW.exe
  2⤵
  PID:6832
- C:\Windows\System\lNpxQtK.exe
  C:\Windows\System\lNpxQtK.exe
  2⤵
  PID:6848
- C:\Windows\System\TjjAaFh.exe
  C:\Windows\System\TjjAaFh.exe
  2⤵
  PID:6864
- C:\Windows\System\FFhQXkL.exe
  C:\Windows\System\FFhQXkL.exe
  2⤵
  PID:6884
- C:\Windows\System\NANhLkD.exe
  C:\Windows\System\NANhLkD.exe
  2⤵
  PID:6900
- C:\Windows\System\bLUjWgS.exe
  C:\Windows\System\bLUjWgS.exe
  2⤵
  PID:6916
- C:\Windows\System\CsyHNgg.exe
  C:\Windows\System\CsyHNgg.exe
  2⤵
  PID:6932
- C:\Windows\System\fFsxQdg.exe
  C:\Windows\System\fFsxQdg.exe
  2⤵
  PID:6948
- C:\Windows\System\QcwNexT.exe
  C:\Windows\System\QcwNexT.exe
  2⤵
  PID:6964
- C:\Windows\System\snGsVot.exe
  C:\Windows\System\snGsVot.exe
  2⤵
  PID:6980
- C:\Windows\System\gHeyPnc.exe
  C:\Windows\System\gHeyPnc.exe
  2⤵
  PID:6996
- C:\Windows\System\JQPxzBu.exe
  C:\Windows\System\JQPxzBu.exe
  2⤵
  PID:7012
- C:\Windows\System\GvHyqYu.exe
  C:\Windows\System\GvHyqYu.exe
  2⤵
  PID:7028
- C:\Windows\System\mfXkixM.exe
  C:\Windows\System\mfXkixM.exe
  2⤵
  PID:7044
- C:\Windows\System\VqzOAtp.exe
  C:\Windows\System\VqzOAtp.exe
  2⤵
  PID:7060
- C:\Windows\System\fSUwFmP.exe
  C:\Windows\System\fSUwFmP.exe
  2⤵
  PID:7076
- C:\Windows\System\NxGcJTl.exe
  C:\Windows\System\NxGcJTl.exe
  2⤵
  PID:7092
- C:\Windows\System\AmMsmOT.exe
  C:\Windows\System\AmMsmOT.exe
  2⤵
  PID:7108
- C:\Windows\System\JBeBSNr.exe
  C:\Windows\System\JBeBSNr.exe
  2⤵
  PID:7124
- C:\Windows\System\KpNdSxl.exe
  C:\Windows\System\KpNdSxl.exe
  2⤵
  PID:7140
- C:\Windows\System\QeVVbpc.exe
  C:\Windows\System\QeVVbpc.exe
  2⤵
  PID:7156
- C:\Windows\System\GjoqmOo.exe
  C:\Windows\System\GjoqmOo.exe
  2⤵
  PID:5776
- C:\Windows\System\OCvwrJs.exe
  C:\Windows\System\OCvwrJs.exe
  2⤵
  PID:5964
- C:\Windows\System\AuRjNXI.exe
  C:\Windows\System\AuRjNXI.exe
  2⤵
  PID:5260
- C:\Windows\System\hrqmpxk.exe
  C:\Windows\System\hrqmpxk.exe
  2⤵
  PID:5724
- C:\Windows\System\ynSAlXH.exe
  C:\Windows\System\ynSAlXH.exe
  2⤵
  PID:5528
- C:\Windows\System\pEMXjzl.exe
  C:\Windows\System\pEMXjzl.exe
  2⤵
  PID:6188
- C:\Windows\System\GCOmGtb.exe
  C:\Windows\System\GCOmGtb.exe
  2⤵
  PID:6212
- C:\Windows\System\wlqaRCr.exe
  C:\Windows\System\wlqaRCr.exe
  2⤵
  PID:6248
- C:\Windows\System\IOylzRT.exe
  C:\Windows\System\IOylzRT.exe
  2⤵
  PID:6312
- C:\Windows\System\xQVvMBz.exe
  C:\Windows\System\xQVvMBz.exe
  2⤵
  PID:6376
- C:\Windows\System\lyYPDXD.exe
  C:\Windows\System\lyYPDXD.exe
  2⤵
  PID:6440
- C:\Windows\System\gNmUvFY.exe
  C:\Windows\System\gNmUvFY.exe
  2⤵
  PID:6504
- C:\Windows\System\sQdPJOz.exe
  C:\Windows\System\sQdPJOz.exe
  2⤵
  PID:6568
- C:\Windows\System\RtHhdAf.exe
  C:\Windows\System\RtHhdAf.exe
  2⤵
  PID:6668
- C:\Windows\System\ZONruAJ.exe
  C:\Windows\System\ZONruAJ.exe
  2⤵
  PID:6696
- C:\Windows\System\wtqljGz.exe
  C:\Windows\System\wtqljGz.exe
  2⤵
  PID:6764
- C:\Windows\System\SgzVpBR.exe
  C:\Windows\System\SgzVpBR.exe
  2⤵
  PID:6824
- C:\Windows\System\njqRDoD.exe
  C:\Windows\System\njqRDoD.exe
  2⤵
  PID:6296
- C:\Windows\System\cVNdwnk.exe
  C:\Windows\System\cVNdwnk.exe
  2⤵
  PID:6896
- C:\Windows\System\UfaVUji.exe
  C:\Windows\System\UfaVUji.exe
  2⤵
  PID:6960
- C:\Windows\System\AoCBsTF.exe
  C:\Windows\System\AoCBsTF.exe
  2⤵
  PID:6492
- C:\Windows\System\soFuZCD.exe
  C:\Windows\System\soFuZCD.exe
  2⤵
  PID:6552
- C:\Windows\System\IeWcgEb.exe
  C:\Windows\System\IeWcgEb.exe
  2⤵
  PID:6616
- C:\Windows\System\qxbmcnK.exe
  C:\Windows\System\qxbmcnK.exe
  2⤵
  PID:6652
- C:\Windows\System\mjFbZoT.exe
  C:\Windows\System\mjFbZoT.exe
  2⤵
  PID:6712
- C:\Windows\System\riKHTFr.exe
  C:\Windows\System\riKHTFr.exe
  2⤵
  PID:2912
- C:\Windows\System\NLHSGzG.exe
  C:\Windows\System\NLHSGzG.exe
  2⤵
  PID:6876
- C:\Windows\System\hmpowMZ.exe
  C:\Windows\System\hmpowMZ.exe
  2⤵
  PID:6972
- C:\Windows\System\UiNkKxq.exe
  C:\Windows\System\UiNkKxq.exe
  2⤵
  PID:6364
- C:\Windows\System\DPfnnFa.exe
  C:\Windows\System\DPfnnFa.exe
  2⤵
  PID:6776
- C:\Windows\System\YNCnyps.exe
  C:\Windows\System\YNCnyps.exe
  2⤵
  PID:6912
- C:\Windows\System\NMeTIJA.exe
  C:\Windows\System\NMeTIJA.exe
  2⤵
  PID:7052
- C:\Windows\System\jDBnKvE.exe
  C:\Windows\System\jDBnKvE.exe
  2⤵
  PID:7036
- C:\Windows\System\uvZwnIR.exe
  C:\Windows\System\uvZwnIR.exe
  2⤵
  PID:7120
- C:\Windows\System\AAWciGf.exe
  C:\Windows\System\AAWciGf.exe
  2⤵
  PID:7072
- C:\Windows\System\bViAlfN.exe
  C:\Windows\System\bViAlfN.exe
  2⤵
  PID:6204
- C:\Windows\System\waEDgTN.exe
  C:\Windows\System\waEDgTN.exe
  2⤵
  PID:6156
- C:\Windows\System\YSLCvVN.exe
  C:\Windows\System\YSLCvVN.exe
  2⤵
  PID:6344
- C:\Windows\System\aXtxjyk.exe
  C:\Windows\System\aXtxjyk.exe
  2⤵
  PID:7164
- C:\Windows\System\VHYZDPB.exe
  C:\Windows\System\VHYZDPB.exe
  2⤵
  PID:6152
- C:\Windows\System\NWUcVdq.exe
  C:\Windows\System\NWUcVdq.exe
  2⤵
  PID:6408
- C:\Windows\System\ThPdqQV.exe
  C:\Windows\System\ThPdqQV.exe
  2⤵
  PID:6600
- C:\Windows\System\ntIqrcs.exe
  C:\Windows\System\ntIqrcs.exe
  2⤵
  PID:6856
- C:\Windows\System\sqHRsJD.exe
  C:\Windows\System\sqHRsJD.exe
  2⤵
  PID:6636
- C:\Windows\System\ypOkFYi.exe
  C:\Windows\System\ypOkFYi.exe
  2⤵
  PID:6360
- C:\Windows\System\LCUsblO.exe
  C:\Windows\System\LCUsblO.exe
  2⤵
  PID:6428
- C:\Windows\System\wjtzofw.exe
  C:\Windows\System\wjtzofw.exe
  2⤵
  PID:2964
- C:\Windows\System\tcfLqAL.exe
  C:\Windows\System\tcfLqAL.exe
  2⤵
  PID:6396
- C:\Windows\System\XkmaGQF.exe
  C:\Windows\System\XkmaGQF.exe
  2⤵
  PID:6744
- C:\Windows\System\xwJXcmN.exe
  C:\Windows\System\xwJXcmN.exe
  2⤵
  PID:7116
- C:\Windows\System\ikhmdIC.exe
  C:\Windows\System\ikhmdIC.exe
  2⤵
  PID:6232
- C:\Windows\System\bksXndO.exe
  C:\Windows\System\bksXndO.exe
  2⤵
  PID:6472
- C:\Windows\System\sLjSgYf.exe
  C:\Windows\System\sLjSgYf.exe
  2⤵
  PID:6584
- C:\Windows\System\yfUIacB.exe
  C:\Windows\System\yfUIacB.exe
  2⤵
  PID:7068
- C:\Windows\System\UCkOTJA.exe
  C:\Windows\System\UCkOTJA.exe
  2⤵
  PID:6680
- C:\Windows\System\dBoBWXI.exe
  C:\Windows\System\dBoBWXI.exe
  2⤵
  PID:6808
- C:\Windows\System\NRAzozX.exe
  C:\Windows\System\NRAzozX.exe
  2⤵
  PID:6332
- C:\Windows\System\JsnWbKz.exe
  C:\Windows\System\JsnWbKz.exe
  2⤵
  PID:6992
- C:\Windows\System\bbTIhqg.exe
  C:\Windows\System\bbTIhqg.exe
  2⤵
  PID:7104
- C:\Windows\System\PsyqMDX.exe
  C:\Windows\System\PsyqMDX.exe
  2⤵
  PID:6348
- C:\Windows\System\ZGdaAPh.exe
  C:\Windows\System\ZGdaAPh.exe
  2⤵
  PID:7020
- C:\Windows\System\iSDjGkD.exe
  C:\Windows\System\iSDjGkD.exe
  2⤵
  PID:5564
- C:\Windows\System\Lydfqid.exe
  C:\Windows\System\Lydfqid.exe
  2⤵
  PID:6208
- C:\Windows\System\rFoxOyR.exe
  C:\Windows\System\rFoxOyR.exe
  2⤵
  PID:6224
- C:\Windows\System\VlXmHBc.exe
  C:\Windows\System\VlXmHBc.exe
  2⤵
  PID:6228
- C:\Windows\System\JYgyPTT.exe
  C:\Windows\System\JYgyPTT.exe
  2⤵
  PID:6588
- C:\Windows\System\rQHwrZo.exe
  C:\Windows\System\rQHwrZo.exe
  2⤵
  PID:6080
- C:\Windows\System\IuUqoeN.exe
  C:\Windows\System\IuUqoeN.exe
  2⤵
  PID:6684
- C:\Windows\System\rbKrmes.exe
  C:\Windows\System\rbKrmes.exe
  2⤵
  PID:7088
- C:\Windows\System\vcANnsW.exe
  C:\Windows\System\vcANnsW.exe
  2⤵
  PID:7204
- C:\Windows\System\CZFpPun.exe
  C:\Windows\System\CZFpPun.exe
  2⤵
  PID:7220
- C:\Windows\System\HaoNOLH.exe
  C:\Windows\System\HaoNOLH.exe
  2⤵
  PID:7236
- C:\Windows\System\QqSOavM.exe
  C:\Windows\System\QqSOavM.exe
  2⤵
  PID:7252
- C:\Windows\System\svKoCeT.exe
  C:\Windows\System\svKoCeT.exe
  2⤵
  PID:7268
- C:\Windows\System\faYKigR.exe
  C:\Windows\System\faYKigR.exe
  2⤵
  PID:7284
- C:\Windows\System\PkIeYHm.exe
  C:\Windows\System\PkIeYHm.exe
  2⤵
  PID:7300
- C:\Windows\System\XlCDyLS.exe
  C:\Windows\System\XlCDyLS.exe
  2⤵
  PID:7316
- C:\Windows\System\LZGvWWV.exe
  C:\Windows\System\LZGvWWV.exe
  2⤵
  PID:7332
- C:\Windows\System\tMNGagD.exe
  C:\Windows\System\tMNGagD.exe
  2⤵
  PID:7348
- C:\Windows\System\sIUOfqT.exe
  C:\Windows\System\sIUOfqT.exe
  2⤵
  PID:7364
- C:\Windows\System\qJcgHZd.exe
  C:\Windows\System\qJcgHZd.exe
  2⤵
  PID:7380
- C:\Windows\System\NQTnTlb.exe
  C:\Windows\System\NQTnTlb.exe
  2⤵
  PID:7400
- C:\Windows\System\thDYsJc.exe
  C:\Windows\System\thDYsJc.exe
  2⤵
  PID:7416
- C:\Windows\System\VzjdWmX.exe
  C:\Windows\System\VzjdWmX.exe
  2⤵
  PID:7432
- C:\Windows\System\UmGXoqb.exe
  C:\Windows\System\UmGXoqb.exe
  2⤵
  PID:7448
- C:\Windows\System\OzeHpnA.exe
  C:\Windows\System\OzeHpnA.exe
  2⤵
  PID:7464
- C:\Windows\System\HBlHEHs.exe
  C:\Windows\System\HBlHEHs.exe
  2⤵
  PID:7480
- C:\Windows\System\MkQjEnP.exe
  C:\Windows\System\MkQjEnP.exe
  2⤵
  PID:7496
- C:\Windows\System\ckIADtV.exe
  C:\Windows\System\ckIADtV.exe
  2⤵
  PID:7512
- C:\Windows\System\oAiMkAS.exe
  C:\Windows\System\oAiMkAS.exe
  2⤵
  PID:7528
- C:\Windows\System\YsVmsHQ.exe
  C:\Windows\System\YsVmsHQ.exe
  2⤵
  PID:7544
- C:\Windows\System\gtYXJFg.exe
  C:\Windows\System\gtYXJFg.exe
  2⤵
  PID:7560
- C:\Windows\System\zLAoMkH.exe
  C:\Windows\System\zLAoMkH.exe
  2⤵
  PID:7576
- C:\Windows\System\qBVjDWU.exe
  C:\Windows\System\qBVjDWU.exe
  2⤵
  PID:7592
- C:\Windows\System\mllBEnx.exe
  C:\Windows\System\mllBEnx.exe
  2⤵
  PID:7608
- C:\Windows\System\FNTrQVY.exe
  C:\Windows\System\FNTrQVY.exe
  2⤵
  PID:7624
- C:\Windows\System\PqvMQHx.exe
  C:\Windows\System\PqvMQHx.exe
  2⤵
  PID:7640
- C:\Windows\System\QbQxUyb.exe
  C:\Windows\System\QbQxUyb.exe
  2⤵
  PID:7656
- C:\Windows\System\qrdrYCl.exe
  C:\Windows\System\qrdrYCl.exe
  2⤵
  PID:7672
- C:\Windows\System\uuVzovZ.exe
  C:\Windows\System\uuVzovZ.exe
  2⤵
  PID:7688
- C:\Windows\System\NOPaSZi.exe
  C:\Windows\System\NOPaSZi.exe
  2⤵
  PID:7704
- C:\Windows\System\jmHUYBN.exe
  C:\Windows\System\jmHUYBN.exe
  2⤵
  PID:7720
- C:\Windows\System\hlmiwBn.exe
  C:\Windows\System\hlmiwBn.exe
  2⤵
  PID:7736
- C:\Windows\System\LqmlLuz.exe
  C:\Windows\System\LqmlLuz.exe
  2⤵
  PID:7752
- C:\Windows\System\wJyrobG.exe
  C:\Windows\System\wJyrobG.exe
  2⤵
  PID:7772
- C:\Windows\System\vdonyKx.exe
  C:\Windows\System\vdonyKx.exe
  2⤵
  PID:7788
- C:\Windows\System\qhXFkpq.exe
  C:\Windows\System\qhXFkpq.exe
  2⤵
  PID:7804
- C:\Windows\System\xJxrXHh.exe
  C:\Windows\System\xJxrXHh.exe
  2⤵
  PID:7820
- C:\Windows\System\YQImmDu.exe
  C:\Windows\System\YQImmDu.exe
  2⤵
  PID:7836
- C:\Windows\System\uXnooMd.exe
  C:\Windows\System\uXnooMd.exe
  2⤵
  PID:7852
- C:\Windows\System\CBxeKIe.exe
  C:\Windows\System\CBxeKIe.exe
  2⤵
  PID:7868
- C:\Windows\System\WSfnoLX.exe
  C:\Windows\System\WSfnoLX.exe
  2⤵
  PID:7884
- C:\Windows\System\ZOnbLth.exe
  C:\Windows\System\ZOnbLth.exe
  2⤵
  PID:7900
- C:\Windows\System\bsXbsOA.exe
  C:\Windows\System\bsXbsOA.exe
  2⤵
  PID:7916
- C:\Windows\System\dlvnZoI.exe
  C:\Windows\System\dlvnZoI.exe
  2⤵
  PID:7932
- C:\Windows\System\QWDxNfu.exe
  C:\Windows\System\QWDxNfu.exe
  2⤵
  PID:7948
- C:\Windows\System\RlPwlzJ.exe
  C:\Windows\System\RlPwlzJ.exe
  2⤵
  PID:7964
- C:\Windows\System\kZEcruC.exe
  C:\Windows\System\kZEcruC.exe
  2⤵
  PID:7980
- C:\Windows\System\CnlnATz.exe
  C:\Windows\System\CnlnATz.exe
  2⤵
  PID:7996
- C:\Windows\System\lamzFZm.exe
  C:\Windows\System\lamzFZm.exe
  2⤵
  PID:8012
- C:\Windows\System\DkizunI.exe
  C:\Windows\System\DkizunI.exe
  2⤵
  PID:8028
- C:\Windows\System\TWXXKif.exe
  C:\Windows\System\TWXXKif.exe
  2⤵
  PID:8044
- C:\Windows\System\uEBofyJ.exe
  C:\Windows\System\uEBofyJ.exe
  2⤵
  PID:8060
- C:\Windows\System\rMYGPxP.exe
  C:\Windows\System\rMYGPxP.exe
  2⤵
  PID:8076
- C:\Windows\System\bANEFsP.exe
  C:\Windows\System\bANEFsP.exe
  2⤵
  PID:8092
- C:\Windows\System\MEOwJcX.exe
  C:\Windows\System\MEOwJcX.exe
  2⤵
  PID:8108
- C:\Windows\System\KzLOegn.exe
  C:\Windows\System\KzLOegn.exe
  2⤵
  PID:8124
- C:\Windows\System\jFIwjTC.exe
  C:\Windows\System\jFIwjTC.exe
  2⤵
  PID:8140
- C:\Windows\System\LkBwDCx.exe
  C:\Windows\System\LkBwDCx.exe
  2⤵
  PID:8156
- C:\Windows\System\LadxJAI.exe
  C:\Windows\System\LadxJAI.exe
  2⤵
  PID:8172
- C:\Windows\System\zdnFQDE.exe
  C:\Windows\System\zdnFQDE.exe
  2⤵
  PID:8188
- C:\Windows\System\CBZfzRk.exe
  C:\Windows\System\CBZfzRk.exe
  2⤵
  PID:7176
- C:\Windows\System\lOIWNZx.exe
  C:\Windows\System\lOIWNZx.exe
  2⤵
  PID:7192
- C:\Windows\System\ervLOJG.exe
  C:\Windows\System\ervLOJG.exe
  2⤵
  PID:7228
- C:\Windows\System\cpohpcJ.exe
  C:\Windows\System\cpohpcJ.exe
  2⤵
  PID:7292
- C:\Windows\System\gKHnOUb.exe
  C:\Windows\System\gKHnOUb.exe
  2⤵
  PID:6520
- C:\Windows\System\CzhcFMr.exe
  C:\Windows\System\CzhcFMr.exe
  2⤵
  PID:7388
- C:\Windows\System\eSvGCdU.exe
  C:\Windows\System\eSvGCdU.exe
  2⤵
  PID:7424
- C:\Windows\System\eVOREJL.exe
  C:\Windows\System\eVOREJL.exe
  2⤵
  PID:6728
- C:\Windows\System\pHuZhSN.exe
  C:\Windows\System\pHuZhSN.exe
  2⤵
  PID:7520
- C:\Windows\System\jRBjJcc.exe
  C:\Windows\System\jRBjJcc.exe
  2⤵
  PID:7552
- C:\Windows\System\NzBIpMX.exe
  C:\Windows\System\NzBIpMX.exe
  2⤵
  PID:7376
- C:\Windows\System\hixDCrK.exe
  C:\Windows\System\hixDCrK.exe
  2⤵
  PID:7248
- C:\Windows\System\xOuSeZu.exe
  C:\Windows\System\xOuSeZu.exe
  2⤵
  PID:7444
- C:\Windows\System\WXldKsq.exe
  C:\Windows\System\WXldKsq.exe
  2⤵
  PID:7372
- C:\Windows\System\OKXPcIo.exe
  C:\Windows\System\OKXPcIo.exe
  2⤵
  PID:7476
- C:\Windows\System\frGqzTw.exe
  C:\Windows\System\frGqzTw.exe
  2⤵
  PID:7600
- C:\Windows\System\iqILIUe.exe
  C:\Windows\System\iqILIUe.exe
  2⤵
  PID:7620
- C:\Windows\System\lQAcnOo.exe
  C:\Windows\System\lQAcnOo.exe
  2⤵
  PID:7680
- C:\Windows\System\kcJnrxh.exe
  C:\Windows\System\kcJnrxh.exe
  2⤵
  PID:7712
- C:\Windows\System\YRArVNC.exe
  C:\Windows\System\YRArVNC.exe
  2⤵
  PID:7780
- C:\Windows\System\StrXHUW.exe
  C:\Windows\System\StrXHUW.exe
  2⤵
  PID:7844
- C:\Windows\System\dhMKOFJ.exe
  C:\Windows\System\dhMKOFJ.exe
  2⤵
  PID:7728
- C:\Windows\System\biyhFIn.exe
  C:\Windows\System\biyhFIn.exe
  2⤵
  PID:7760
- C:\Windows\System\NLFNDnp.exe
  C:\Windows\System\NLFNDnp.exe
  2⤵
  PID:7828
- C:\Windows\System\KNfTrlZ.exe
  C:\Windows\System\KNfTrlZ.exe
  2⤵
  PID:7880
- C:\Windows\System\kawYEEG.exe
  C:\Windows\System\kawYEEG.exe
  2⤵
  PID:7944
- C:\Windows\System\XEEqBkl.exe
  C:\Windows\System\XEEqBkl.exe
  2⤵
  PID:7892
- C:\Windows\System\PaAReOw.exe
  C:\Windows\System\PaAReOw.exe
  2⤵
  PID:7928
- C:\Windows\System\pFbCzih.exe
  C:\Windows\System\pFbCzih.exe
  2⤵
  PID:8008
- C:\Windows\System\OckSnhM.exe
  C:\Windows\System\OckSnhM.exe
  2⤵
  PID:8024
- C:\Windows\System\ynSiOtH.exe
  C:\Windows\System\ynSiOtH.exe
  2⤵
  PID:8056
- C:\Windows\System\MRddPhb.exe
  C:\Windows\System\MRddPhb.exe
  2⤵
  PID:8132
- C:\Windows\System\bfYGwYi.exe
  C:\Windows\System\bfYGwYi.exe
  2⤵
  PID:6460
- C:\Windows\System\HHYbewH.exe
  C:\Windows\System\HHYbewH.exe
  2⤵
  PID:7260
- C:\Windows\System\CIcZIeB.exe
  C:\Windows\System\CIcZIeB.exe
  2⤵
  PID:8184
- C:\Windows\System\biqlSrE.exe
  C:\Windows\System\biqlSrE.exe
  2⤵
  PID:8116
- C:\Windows\System\NrSlLBh.exe
  C:\Windows\System\NrSlLBh.exe
  2⤵
  PID:7492
- C:\Windows\System\dEPwoHc.exe
  C:\Windows\System\dEPwoHc.exe
  2⤵
  PID:7524
- C:\Windows\System\WgZyoCn.exe
  C:\Windows\System\WgZyoCn.exe
  2⤵
  PID:7280
- C:\Windows\System\lrLfbeo.exe
  C:\Windows\System\lrLfbeo.exe
  2⤵
  PID:7344
- C:\Windows\System\UQGCfQV.exe
  C:\Windows\System\UQGCfQV.exe
  2⤵
  PID:7540
- C:\Windows\System\iUPvgPy.exe
  C:\Windows\System\iUPvgPy.exe
  2⤵
  PID:7748
- C:\Windows\System\begKDId.exe
  C:\Windows\System\begKDId.exe
  2⤵
  PID:7632
- C:\Windows\System\KrxTBvu.exe
  C:\Windows\System\KrxTBvu.exe
  2⤵
  PID:7876
- C:\Windows\System\jXxOYHS.exe
  C:\Windows\System\jXxOYHS.exe
  2⤵
  PID:7732
- C:\Windows\System\NLfwAVz.exe
  C:\Windows\System\NLfwAVz.exe
  2⤵
  PID:7912
- C:\Windows\System\zgilFss.exe
  C:\Windows\System\zgilFss.exe
  2⤵
  PID:8040
- C:\Windows\System\thXifQm.exe
  C:\Windows\System\thXifQm.exe
  2⤵
  PID:7200
- C:\Windows\System\MTaxcgn.exe
  C:\Windows\System\MTaxcgn.exe
  2⤵
  PID:7992
- C:\Windows\System\yZwstAy.exe
  C:\Windows\System\yZwstAy.exe
  2⤵
  PID:8168
- C:\Windows\System\XRqEOsj.exe
  C:\Windows\System\XRqEOsj.exe
  2⤵
  PID:8120
- C:\Windows\System\DxFeBLE.exe
  C:\Windows\System\DxFeBLE.exe
  2⤵
  PID:7312
- C:\Windows\System\eEFtHcQ.exe
  C:\Windows\System\eEFtHcQ.exe
  2⤵
  PID:7652
- C:\Windows\System\njiPNFy.exe
  C:\Windows\System\njiPNFy.exe
  2⤵
  PID:7924
- C:\Windows\System\IdbqZUB.exe
  C:\Windows\System\IdbqZUB.exe
  2⤵
  PID:7460
- C:\Windows\System\XCrzEbS.exe
  C:\Windows\System\XCrzEbS.exe
  2⤵
  PID:7504
- C:\Windows\System\mkTPwtJ.exe
  C:\Windows\System\mkTPwtJ.exe
  2⤵
  PID:8052
- C:\Windows\System\dgVoQeF.exe
  C:\Windows\System\dgVoQeF.exe
  2⤵
  PID:8208
- C:\Windows\System\DBOsfnn.exe
  C:\Windows\System\DBOsfnn.exe
  2⤵
  PID:8224
- C:\Windows\System\IISWnNb.exe
  C:\Windows\System\IISWnNb.exe
  2⤵
  PID:8240
- C:\Windows\System\XMabjDm.exe
  C:\Windows\System\XMabjDm.exe
  2⤵
  PID:8256
- C:\Windows\System\fDWStZJ.exe
  C:\Windows\System\fDWStZJ.exe
  2⤵
  PID:8272
- C:\Windows\System\IYhdPqT.exe
  C:\Windows\System\IYhdPqT.exe
  2⤵
  PID:8288
- C:\Windows\System\DDwcbhT.exe
  C:\Windows\System\DDwcbhT.exe
  2⤵
  PID:8304
- C:\Windows\System\CAiZfaM.exe
  C:\Windows\System\CAiZfaM.exe
  2⤵
  PID:8320
- C:\Windows\System\LyHfKsN.exe
  C:\Windows\System\LyHfKsN.exe
  2⤵
  PID:8336
- C:\Windows\System\aIzXPKJ.exe
  C:\Windows\System\aIzXPKJ.exe
  2⤵
  PID:8352
- C:\Windows\System\VRaKHVk.exe
  C:\Windows\System\VRaKHVk.exe
  2⤵
  PID:8368
- C:\Windows\System\MUQcttq.exe
  C:\Windows\System\MUQcttq.exe
  2⤵
  PID:8384
- C:\Windows\System\bEvbpHU.exe
  C:\Windows\System\bEvbpHU.exe
  2⤵
  PID:8400
- C:\Windows\System\CSPKxiz.exe
  C:\Windows\System\CSPKxiz.exe
  2⤵
  PID:8416
- C:\Windows\System\SKJmpXN.exe
  C:\Windows\System\SKJmpXN.exe
  2⤵
  PID:8432
- C:\Windows\System\hOPNgQa.exe
  C:\Windows\System\hOPNgQa.exe
  2⤵
  PID:8448
- C:\Windows\System\kuBhDqp.exe
  C:\Windows\System\kuBhDqp.exe
  2⤵
  PID:8464
- C:\Windows\System\kozkANs.exe
  C:\Windows\System\kozkANs.exe
  2⤵
  PID:8480
- C:\Windows\System\mkIsPbH.exe
  C:\Windows\System\mkIsPbH.exe
  2⤵
  PID:8496
- C:\Windows\System\XJjpIRF.exe
  C:\Windows\System\XJjpIRF.exe
  2⤵
  PID:8512
- C:\Windows\System\UYynpdJ.exe
  C:\Windows\System\UYynpdJ.exe
  2⤵
  PID:8528
- C:\Windows\System\dRjfFhb.exe
  C:\Windows\System\dRjfFhb.exe
  2⤵
  PID:8544
- C:\Windows\System\JDXfJln.exe
  C:\Windows\System\JDXfJln.exe
  2⤵
  PID:8560
- C:\Windows\System\pRBBffu.exe
  C:\Windows\System\pRBBffu.exe
  2⤵
  PID:8576
- C:\Windows\System\mfIoEri.exe
  C:\Windows\System\mfIoEri.exe
  2⤵
  PID:8592
- C:\Windows\System\jcOOojl.exe
  C:\Windows\System\jcOOojl.exe
  2⤵
  PID:8608
- C:\Windows\System\cZecXEp.exe
  C:\Windows\System\cZecXEp.exe
  2⤵
  PID:8624
- C:\Windows\System\lZUKwVq.exe
  C:\Windows\System\lZUKwVq.exe
  2⤵
  PID:8640
- C:\Windows\System\FmaOpmW.exe
  C:\Windows\System\FmaOpmW.exe
  2⤵
  PID:8656
- C:\Windows\System\lNNQXfJ.exe
  C:\Windows\System\lNNQXfJ.exe
  2⤵
  PID:8672
- C:\Windows\System\BUvEmwJ.exe
  C:\Windows\System\BUvEmwJ.exe
  2⤵
  PID:8688
- C:\Windows\System\CFJFNGz.exe
  C:\Windows\System\CFJFNGz.exe
  2⤵
  PID:8704
- C:\Windows\System\kfeSHnu.exe
  C:\Windows\System\kfeSHnu.exe
  2⤵
  PID:8720
- C:\Windows\System\wexwKGX.exe
  C:\Windows\System\wexwKGX.exe
  2⤵
  PID:8736
- C:\Windows\System\CbmaWYc.exe
  C:\Windows\System\CbmaWYc.exe
  2⤵
  PID:8756
- C:\Windows\System\mLvjEvR.exe
  C:\Windows\System\mLvjEvR.exe
  2⤵
  PID:8772
- C:\Windows\System\QLCNbWs.exe
  C:\Windows\System\QLCNbWs.exe
  2⤵
  PID:8788
- C:\Windows\System\qLoVcPY.exe
  C:\Windows\System\qLoVcPY.exe
  2⤵
  PID:8804
- C:\Windows\System\mtfmyeg.exe
  C:\Windows\System\mtfmyeg.exe
  2⤵
  PID:8820
- C:\Windows\System\jdKfMwR.exe
  C:\Windows\System\jdKfMwR.exe
  2⤵
  PID:8836
- C:\Windows\System\OjyYFwn.exe
  C:\Windows\System\OjyYFwn.exe
  2⤵
  PID:8852
- C:\Windows\System\DoHFXno.exe
  C:\Windows\System\DoHFXno.exe
  2⤵
  PID:8868
- C:\Windows\System\UMeFlja.exe
  C:\Windows\System\UMeFlja.exe
  2⤵
  PID:8884
- C:\Windows\System\RKwgkAS.exe
  C:\Windows\System\RKwgkAS.exe
  2⤵
  PID:8900
- C:\Windows\System\WPrCtVA.exe
  C:\Windows\System\WPrCtVA.exe
  2⤵
  PID:8916
- C:\Windows\System\YzZeawP.exe
  C:\Windows\System\YzZeawP.exe
  2⤵
  PID:8932
- C:\Windows\System\pGqEqjq.exe
  C:\Windows\System\pGqEqjq.exe
  2⤵
  PID:8948
- C:\Windows\System\qDsznfb.exe
  C:\Windows\System\qDsznfb.exe
  2⤵
  PID:8964
- C:\Windows\System\BHwfGed.exe
  C:\Windows\System\BHwfGed.exe
  2⤵
  PID:8980
- C:\Windows\System\csuQwcI.exe
  C:\Windows\System\csuQwcI.exe
  2⤵
  PID:8996
- C:\Windows\System\ZlIdURo.exe
  C:\Windows\System\ZlIdURo.exe
  2⤵
  PID:9012
- C:\Windows\System\ZpMtHHt.exe
  C:\Windows\System\ZpMtHHt.exe
  2⤵
  PID:9028
- C:\Windows\System\BdQXmnH.exe
  C:\Windows\System\BdQXmnH.exe
  2⤵
  PID:9044
- C:\Windows\System\iongXgi.exe
  C:\Windows\System\iongXgi.exe
  2⤵
  PID:9060
- C:\Windows\System\uWhppsr.exe
  C:\Windows\System\uWhppsr.exe
  2⤵
  PID:9076
- C:\Windows\System\yAxuzCK.exe
  C:\Windows\System\yAxuzCK.exe
  2⤵
  PID:9092
- C:\Windows\System\HUSEjcn.exe
  C:\Windows\System\HUSEjcn.exe
  2⤵
  PID:9108
- C:\Windows\System\qgNPYab.exe
  C:\Windows\System\qgNPYab.exe
  2⤵
  PID:9124
- C:\Windows\System\OrlWLmm.exe
  C:\Windows\System\OrlWLmm.exe
  2⤵
  PID:9140
- C:\Windows\System\vsnNcMR.exe
  C:\Windows\System\vsnNcMR.exe
  2⤵
  PID:9156
- C:\Windows\System\uaTRROr.exe
  C:\Windows\System\uaTRROr.exe
  2⤵
  PID:9172
- C:\Windows\System\PPWNGDQ.exe
  C:\Windows\System\PPWNGDQ.exe
  2⤵
  PID:9188
- C:\Windows\System\EmAJkfO.exe
  C:\Windows\System\EmAJkfO.exe
  2⤵
  PID:9204
- C:\Windows\System\LEVVEsI.exe
  C:\Windows\System\LEVVEsI.exe
  2⤵
  PID:8268
- C:\Windows\System\sbYwHTe.exe
  C:\Windows\System\sbYwHTe.exe
  2⤵
  PID:8316
- C:\Windows\System\eknEjTS.exe
  C:\Windows\System\eknEjTS.exe
  2⤵
  PID:8328
- C:\Windows\System\VlEfNIs.exe
  C:\Windows\System\VlEfNIs.exe
  2⤵
  PID:8376
- C:\Windows\System\BhewdIK.exe
  C:\Windows\System\BhewdIK.exe
  2⤵
  PID:8412
- C:\Windows\System\ehHCLfm.exe
  C:\Windows\System\ehHCLfm.exe
  2⤵
  PID:8444
- C:\Windows\System\MKYaNrf.exe
  C:\Windows\System\MKYaNrf.exe
  2⤵
  PID:8456
- C:\Windows\System\wsDnljW.exe
  C:\Windows\System\wsDnljW.exe
  2⤵
  PID:8488
- C:\Windows\System\BcqcfZJ.exe
  C:\Windows\System\BcqcfZJ.exe
  2⤵
  PID:8536
- C:\Windows\System\ylsXKTd.exe
  C:\Windows\System\ylsXKTd.exe
  2⤵
  PID:8552
- C:\Windows\System\LfdrXnF.exe
  C:\Windows\System\LfdrXnF.exe
  2⤵
  PID:8600
- C:\Windows\System\ltfMCEh.exe
  C:\Windows\System\ltfMCEh.exe
  2⤵
  PID:8632
- C:\Windows\System\aAPFail.exe
  C:\Windows\System\aAPFail.exe
  2⤵
  PID:8664
- C:\Windows\System\aRmbycP.exe
  C:\Windows\System\aRmbycP.exe
  2⤵
  PID:8648
- C:\Windows\System\xpPbaxU.exe
  C:\Windows\System\xpPbaxU.exe
  2⤵
  PID:8684
- C:\Windows\System\qpyXpce.exe
  C:\Windows\System\qpyXpce.exe
  2⤵
  PID:8768
- C:\Windows\System\lFQmqop.exe
  C:\Windows\System\lFQmqop.exe
  2⤵
  PID:8744
- C:\Windows\System\FqTvIHG.exe
  C:\Windows\System\FqTvIHG.exe
  2⤵
  PID:8800
- C:\Windows\System\ryyLwjJ.exe
  C:\Windows\System\ryyLwjJ.exe
  2⤵
  PID:8816
- C:\Windows\System\TWjfddR.exe
  C:\Windows\System\TWjfddR.exe
  2⤵
  PID:8864
- C:\Windows\System\NeBvwJY.exe
  C:\Windows\System\NeBvwJY.exe
  2⤵
  PID:8896
- C:\Windows\System\UuGmegN.exe
  C:\Windows\System\UuGmegN.exe
  2⤵
  PID:8960
- C:\Windows\System\jnzNbxY.exe
  C:\Windows\System\jnzNbxY.exe
  2⤵
  PID:8940
- C:\Windows\System\MlBoKzW.exe
  C:\Windows\System\MlBoKzW.exe
  2⤵
  PID:8992
- C:\Windows\System\zMNxDQw.exe
  C:\Windows\System\zMNxDQw.exe
  2⤵
  PID:9040
- C:\Windows\System\okGrwjW.exe
  C:\Windows\System\okGrwjW.exe
  2⤵
  PID:9084
- C:\Windows\System\nRUBvZF.exe
  C:\Windows\System\nRUBvZF.exe
  2⤵
  PID:9068
- C:\Windows\System\uxfntpb.exe
  C:\Windows\System\uxfntpb.exe
  2⤵
  PID:9180
- C:\Windows\System\FCuQvHl.exe
  C:\Windows\System\FCuQvHl.exe
  2⤵
  PID:9072
- C:\Windows\System\vDVaViF.exe
  C:\Windows\System\vDVaViF.exe
  2⤵
  PID:9164
- C:\Windows\System\efAIycy.exe
  C:\Windows\System\efAIycy.exe
  2⤵
  PID:8164
- C:\Windows\System\jcOdHsV.exe
  C:\Windows\System\jcOdHsV.exe
  2⤵
  PID:6844
- C:\Windows\System\BVvHguf.exe
  C:\Windows\System\BVvHguf.exe
  2⤵
  PID:7356
- C:\Windows\System\ablDgeN.exe
  C:\Windows\System\ablDgeN.exe
  2⤵
  PID:7864
- C:\Windows\System\dKUZGnk.exe
  C:\Windows\System\dKUZGnk.exe
  2⤵
  PID:5712
- C:\Windows\System\cZUvhQq.exe
  C:\Windows\System\cZUvhQq.exe
  2⤵
  PID:7488
- C:\Windows\System\TviMYIt.exe
  C:\Windows\System\TviMYIt.exe
  2⤵
  PID:7860
- C:\Windows\System\kejOrUe.exe
  C:\Windows\System\kejOrUe.exe
  2⤵
  PID:8248
- C:\Windows\System\ZryNPrj.exe
  C:\Windows\System\ZryNPrj.exe
  2⤵
  PID:8264
- C:\Windows\System\drzyHyF.exe
  C:\Windows\System\drzyHyF.exe
  2⤵
  PID:8408
- C:\Windows\System\ByNlxyl.exe
  C:\Windows\System\ByNlxyl.exe
  2⤵
  PID:8492
- C:\Windows\System\tJqIafr.exe
  C:\Windows\System\tJqIafr.exe
  2⤵
  PID:8620
- C:\Windows\System\XKTsMlL.exe
  C:\Windows\System\XKTsMlL.exe
  2⤵
  PID:8752
- C:\Windows\System\PmSZwZG.exe
  C:\Windows\System\PmSZwZG.exe
  2⤵
  PID:8880
- C:\Windows\System\kXcSVrH.exe
  C:\Windows\System\kXcSVrH.exe
  2⤵
  PID:9024
- C:\Windows\System\guXkeBl.exe
  C:\Windows\System\guXkeBl.exe
  2⤵
  PID:9100
- C:\Windows\System\AbVHNpN.exe
  C:\Windows\System\AbVHNpN.exe
  2⤵
  PID:7408
- C:\Windows\System\lIFECRr.exe
  C:\Windows\System\lIFECRr.exe
  2⤵
  PID:8104
- C:\Windows\System\OTRZNIz.exe
  C:\Windows\System\OTRZNIz.exe
  2⤵
  PID:8428
- C:\Windows\System\lwfOiJQ.exe
  C:\Windows\System\lwfOiJQ.exe
  2⤵
  PID:9228
- C:\Windows\System\ljipown.exe
  C:\Windows\System\ljipown.exe
  2⤵
  PID:9244
- C:\Windows\System\XvPNkYb.exe
  C:\Windows\System\XvPNkYb.exe
  2⤵
  PID:9260
- C:\Windows\System\UxFbEjc.exe
  C:\Windows\System\UxFbEjc.exe
  2⤵
  PID:9276
- C:\Windows\System\KrIusPo.exe
  C:\Windows\System\KrIusPo.exe
  2⤵
  PID:9292
- C:\Windows\System\fpZQZzx.exe
  C:\Windows\System\fpZQZzx.exe
  2⤵
  PID:9308
- C:\Windows\System\fdkrAJQ.exe
  C:\Windows\System\fdkrAJQ.exe
  2⤵
  PID:9324
- C:\Windows\System\ruLxzGb.exe
  C:\Windows\System\ruLxzGb.exe
  2⤵
  PID:9340
- C:\Windows\System\GMeLsQw.exe
  C:\Windows\System\GMeLsQw.exe
  2⤵
  PID:9356
- C:\Windows\System\OgWkVkb.exe
  C:\Windows\System\OgWkVkb.exe
  2⤵
  PID:9372
- C:\Windows\System\MdUzhar.exe
  C:\Windows\System\MdUzhar.exe
  2⤵
  PID:9388
- C:\Windows\System\ZHplLzG.exe
  C:\Windows\System\ZHplLzG.exe
  2⤵
  PID:9404
- C:\Windows\System\DhvoRdI.exe
  C:\Windows\System\DhvoRdI.exe
  2⤵
  PID:9420
- C:\Windows\System\pWQCDhl.exe
  C:\Windows\System\pWQCDhl.exe
  2⤵
  PID:9440
- C:\Windows\System\mpyGevy.exe
  C:\Windows\System\mpyGevy.exe
  2⤵
  PID:9456
- C:\Windows\System\DBnsiUF.exe
  C:\Windows\System\DBnsiUF.exe
  2⤵
  PID:9472
- C:\Windows\System\krMjrZv.exe
  C:\Windows\System\krMjrZv.exe
  2⤵
  PID:9488
- C:\Windows\System\ixbWCrc.exe
  C:\Windows\System\ixbWCrc.exe
  2⤵
  PID:9552
- C:\Windows\System\UyiSfte.exe
  C:\Windows\System\UyiSfte.exe
  2⤵
  PID:9596
- C:\Windows\System\eofYLVN.exe
  C:\Windows\System\eofYLVN.exe
  2⤵
  PID:9628
- C:\Windows\System\DUondPY.exe
  C:\Windows\System\DUondPY.exe
  2⤵
  PID:9808
- C:\Windows\System\uxsxgyl.exe
  C:\Windows\System\uxsxgyl.exe
  2⤵
  PID:10120
- C:\Windows\System\yTkoZZR.exe
  C:\Windows\System\yTkoZZR.exe
  2⤵
  PID:10136
- C:\Windows\System\TLOtpGd.exe
  C:\Windows\System\TLOtpGd.exe
  2⤵
  PID:10156
- C:\Windows\System\yenfBDU.exe
  C:\Windows\System\yenfBDU.exe
  2⤵
  PID:10172
- C:\Windows\System\EAMdRQc.exe
  C:\Windows\System\EAMdRQc.exe
  2⤵
  PID:10188
- C:\Windows\System\IhFEiFk.exe
  C:\Windows\System\IhFEiFk.exe
  2⤵
  PID:10204
- C:\Windows\System\UaLoafM.exe
  C:\Windows\System\UaLoafM.exe
  2⤵
  PID:10220
- C:\Windows\System\kGAJIXP.exe
  C:\Windows\System\kGAJIXP.exe
  2⤵
  PID:8712
- C:\Windows\System\fRigPfq.exe
  C:\Windows\System\fRigPfq.exe
  2⤵
  PID:8236
- C:\Windows\System\XOUTPKT.exe
  C:\Windows\System\XOUTPKT.exe
  2⤵
  PID:9300
- C:\Windows\System\GQpYuGR.exe
  C:\Windows\System\GQpYuGR.exe
  2⤵
  PID:8944
- C:\Windows\System\vgPgblv.exe
  C:\Windows\System\vgPgblv.exe
  2⤵
  PID:6872
- C:\Windows\System\XvDFwNG.exe
  C:\Windows\System\XvDFwNG.exe
  2⤵
  PID:8220
- C:\Windows\System\WlqLLep.exe
  C:\Windows\System\WlqLLep.exe
  2⤵
  PID:8572
- C:\Windows\System\MStEnBn.exe
  C:\Windows\System\MStEnBn.exe
  2⤵
  PID:9120
- C:\Windows\System\DkRrShz.exe
  C:\Windows\System\DkRrShz.exe
  2⤵
  PID:9436
- C:\Windows\System\MpibBuO.exe
  C:\Windows\System\MpibBuO.exe
  2⤵
  PID:8360
- C:\Windows\System\QCxXhxp.exe
  C:\Windows\System\QCxXhxp.exe
  2⤵
  PID:8588
- C:\Windows\System\TglKXEI.exe
  C:\Windows\System\TglKXEI.exe
  2⤵
  PID:8716
- C:\Windows\System\rkBWWjf.exe
  C:\Windows\System\rkBWWjf.exe
  2⤵
  PID:8860
- C:\Windows\System\XhPyNDV.exe
  C:\Windows\System\XhPyNDV.exe
  2⤵
  PID:9500
- C:\Windows\System\zdtLzZi.exe
  C:\Windows\System\zdtLzZi.exe
  2⤵
  PID:7004
- C:\Windows\System\hWlhqID.exe
  C:\Windows\System\hWlhqID.exe
  2⤵
  PID:9316
- C:\Windows\System\sorsqvZ.exe
  C:\Windows\System\sorsqvZ.exe
  2⤵
  PID:9448
- C:\Windows\System\VGTdBfn.exe
  C:\Windows\System\VGTdBfn.exe
  2⤵
  PID:9520
- C:\Windows\System\NVrmGRB.exe
  C:\Windows\System\NVrmGRB.exe
  2⤵
  PID:9580
- C:\Windows\System\eWlfcDB.exe
  C:\Windows\System\eWlfcDB.exe
  2⤵
  PID:9608
- C:\Windows\System\sUmAoSH.exe
  C:\Windows\System\sUmAoSH.exe
  2⤵
  PID:9644
- C:\Windows\System\TokdQhE.exe
  C:\Windows\System\TokdQhE.exe
  2⤵
  PID:9664
- C:\Windows\System\ZGVGOmF.exe
  C:\Windows\System\ZGVGOmF.exe
  2⤵
  PID:9684
- C:\Windows\System\mROciFI.exe
  C:\Windows\System\mROciFI.exe
  2⤵
  PID:9704
- C:\Windows\System\HRozUBB.exe
  C:\Windows\System\HRozUBB.exe
  2⤵
  PID:9712
- C:\Windows\System\ysneiJw.exe
  C:\Windows\System\ysneiJw.exe
  2⤵
  PID:9728
- C:\Windows\System\FzgxDOK.exe
  C:\Windows\System\FzgxDOK.exe
  2⤵
  PID:9744
- C:\Windows\System\WsOYCCf.exe
  C:\Windows\System\WsOYCCf.exe
  2⤵
  PID:9760
- C:\Windows\System\JZnkeOW.exe
  C:\Windows\System\JZnkeOW.exe
  2⤵
  PID:9784
- C:\Windows\System\lSqWHmO.exe
  C:\Windows\System\lSqWHmO.exe
  2⤵
  PID:9804
- C:\Windows\System\NgZPcxD.exe
  C:\Windows\System\NgZPcxD.exe
  2⤵
  PID:9912
- C:\Windows\System\hGdfgTY.exe
  C:\Windows\System\hGdfgTY.exe
  2⤵
  PID:9908
- C:\Windows\System\eZXwMDg.exe
  C:\Windows\System\eZXwMDg.exe
  2⤵
  PID:9964
- C:\Windows\System\rPAqAfE.exe
  C:\Windows\System\rPAqAfE.exe
  2⤵
  PID:9876
- C:\Windows\System\OIbgRGM.exe
  C:\Windows\System\OIbgRGM.exe
  2⤵
  PID:9860
- C:\Windows\System\JuREWDk.exe
  C:\Windows\System\JuREWDk.exe
  2⤵
  PID:9944
- C:\Windows\System\lXDochn.exe
  C:\Windows\System\lXDochn.exe
  2⤵
  PID:9936
- C:\Windows\System\clkVHIF.exe
  C:\Windows\System\clkVHIF.exe
  2⤵
  PID:9836
- C:\Windows\System\vKNRtas.exe
  C:\Windows\System\vKNRtas.exe
  2⤵
  PID:9816
- C:\Windows\System\HwgrIrK.exe
  C:\Windows\System\HwgrIrK.exe
  2⤵
  PID:9988
- C:\Windows\System\fZzXIpf.exe
  C:\Windows\System\fZzXIpf.exe
  2⤵
  PID:7976
- C:\Windows\System\jxCSLrW.exe
  C:\Windows\System\jxCSLrW.exe
  2⤵
  PID:10008
- C:\Windows\System\VvpwTBs.exe
  C:\Windows\System\VvpwTBs.exe
  2⤵
  PID:10024
- C:\Windows\System\PrkwcJG.exe
  C:\Windows\System\PrkwcJG.exe
  2⤵
  PID:10040
- C:\Windows\System\NjEdsIY.exe
  C:\Windows\System\NjEdsIY.exe
  2⤵
  PID:10072
- C:\Windows\System\HfkywHj.exe
  C:\Windows\System\HfkywHj.exe
  2⤵
  PID:10096
- C:\Windows\System\lTgpsNc.exe
  C:\Windows\System\lTgpsNc.exe
  2⤵
  PID:10112
- C:\Windows\System\ATmsxGu.exe
  C:\Windows\System\ATmsxGu.exe
  2⤵
  PID:10200
- C:\Windows\System\TMHZGpX.exe
  C:\Windows\System\TMHZGpX.exe
  2⤵
  PID:10144
- C:\Windows\System\GoTrsVs.exe
  C:\Windows\System\GoTrsVs.exe
  2⤵
  PID:10184
- C:\Windows\System\ohaaHQK.exe
  C:\Windows\System\ohaaHQK.exe
  2⤵
  PID:9200
- C:\Windows\System\GlMkbrb.exe
  C:\Windows\System\GlMkbrb.exe
  2⤵
  PID:9272
- C:\Windows\System\smqNeGX.exe
  C:\Windows\System\smqNeGX.exe
  2⤵
  PID:8380
- C:\Windows\System\WoEsHTn.exe
  C:\Windows\System\WoEsHTn.exe
  2⤵
  PID:9224
- C:\Windows\System\KszBisi.exe
  C:\Windows\System\KszBisi.exe
  2⤵
  PID:8312
- C:\Windows\System\hpWwaOp.exe
  C:\Windows\System\hpWwaOp.exe
  2⤵
  PID:8216
- C:\Windows\System\DDpFRcF.exe
  C:\Windows\System\DDpFRcF.exe
  2⤵
  PID:8732
- C:\Windows\System\CzDIsHs.exe
  C:\Windows\System\CzDIsHs.exe
  2⤵
  PID:9348
- C:\Windows\System\oQyhkEf.exe
  C:\Windows\System\oQyhkEf.exe
  2⤵
  PID:9152
- C:\Windows\System\jPmiCJe.exe
  C:\Windows\System\jPmiCJe.exe
  2⤵
  PID:9508
- C:\Windows\System\aFDeGiT.exe
  C:\Windows\System\aFDeGiT.exe
  2⤵
  PID:9416
- C:\Windows\System\iTBzWSS.exe
  C:\Windows\System\iTBzWSS.exe
  2⤵
  PID:8696
- C:\Windows\System\VxuYmow.exe
  C:\Windows\System\VxuYmow.exe
  2⤵
  PID:9484
- C:\Windows\System\zSdfwtO.exe
  C:\Windows\System\zSdfwtO.exe
  2⤵
  PID:9464
- C:\Windows\System\VfqjOAg.exe
  C:\Windows\System\VfqjOAg.exe
  2⤵
  PID:9540
- C:\Windows\System\bhuzcWC.exe
  C:\Windows\System\bhuzcWC.exe
  2⤵
  PID:9576
- C:\Windows\System\wdJKLLU.exe
  C:\Windows\System\wdJKLLU.exe
  2⤵
  PID:9548
- C:\Windows\System\jENIKqD.exe
  C:\Windows\System\jENIKqD.exe
  2⤵
  PID:9592
- C:\Windows\System\xIwXVGz.exe
  C:\Windows\System\xIwXVGz.exe
  2⤵
  PID:9660
- C:\Windows\System\sSxjWvu.exe
  C:\Windows\System\sSxjWvu.exe
  2⤵
  PID:9708
- C:\Windows\System\sPcXiEv.exe
  C:\Windows\System\sPcXiEv.exe
  2⤵
  PID:9720
- C:\Windows\System\EAeQQNd.exe
  C:\Windows\System\EAeQQNd.exe
  2⤵
  PID:9800
- C:\Windows\System\FWRYYcr.exe
  C:\Windows\System\FWRYYcr.exe
  2⤵
  PID:9884
- C:\Windows\System\XQRToSa.exe
  C:\Windows\System\XQRToSa.exe
  2⤵
  PID:9840
- C:\Windows\System\QozGSEr.exe
  C:\Windows\System\QozGSEr.exe
  2⤵
  PID:10080
- C:\Windows\System\usRrkqt.exe
  C:\Windows\System\usRrkqt.exe
  2⤵
  PID:10168
- C:\Windows\System\adxzfsH.exe
  C:\Windows\System\adxzfsH.exe
  2⤵
  PID:9768
- C:\Windows\System\smVjqmB.exe
  C:\Windows\System\smVjqmB.exe
  2⤵
  PID:9892
- C:\Windows\System\zhxLfGC.exe
  C:\Windows\System\zhxLfGC.exe
  2⤵
  PID:10108
- C:\Windows\System\mknOHpy.exe
  C:\Windows\System\mknOHpy.exe
  2⤵
  PID:9872
- C:\Windows\System\zlkLfHD.exe
  C:\Windows\System\zlkLfHD.exe
  2⤵
  PID:9848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CRRkWNs.exe

Filesize
1.8MB

MD5
763a66111183cb1d118f75adeb1b2a5e

SHA1
d8ab1e274fdb5bd8fe80de5f54802c5078d56fc9

SHA256
07a34c3c8a1e738d7a80d13a2c74e0303a82cc8d73385e2ce5ca7dbe9d31e9ab

SHA512
66d276d73e0764dd4750008211c434346eb0ea0f41092d18f720eb1c4bb228e40d72ae8a0318ae4775291b347daf7bb2d0306ea5b4727bf079d3bc1d2e2a8b27

Download Submit
C:\Windows\system\EizWOiQ.exe

Filesize
1.8MB

MD5
7d5643a1f15c1c092bbf6378591784b7

SHA1
6a0bc8e56c6b916d27f7a15a2540085ccfac79da

SHA256
d9c3118d3b47de390deed3a285018462d4a4c4b7962726fdd3ad3de20b644c0d

SHA512
fa21cff2add219a38e27ce46a17483bd980cf9d18705427247462928e54b001d613228a88a8ce8c0e6013825c15fd42263ee9c53f14e72a6732753d28e194705

Download Submit
C:\Windows\system\LTbiIMe.exe

Filesize
1.8MB

MD5
0cd4989b2509d4cb84912621c10b2540

SHA1
13a697827ccecb378ece1a6ce4723fce33dd1e08

SHA256
faab3f284bad4204c6a273a663d392cb447e12dfc860ecd549bdcffd5d9410b8

SHA512
3c201908fdad08080458cf004b67c60ffbd034d301d142eec302c17ba5f0bba51afc9c682aa019f9dec3a63bf92bb510db06cd7c397f886e41f808ed12fb6778

Download Submit
C:\Windows\system\MGaOQec.exe

Filesize
1.8MB

MD5
3ef09d2ea606716249aab5ad4e78b8bb

SHA1
8faa4cd0e58cf62d44e605f1cb34f68d6313025e

SHA256
6d90a2ee4f4605289bc42df3d70e7610ccf2e644771e0c6e721f6b93b4f99660

SHA512
411434adb5293ced0fff1abbb6d726c1990946f594201fd6f95ca22babfbbda13ea0a8133a7221c2752b22290e93c634f39600e33e1a3feec8ada76bca69df18

Download Submit
C:\Windows\system\NTSzFOJ.exe

Filesize
1.8MB

MD5
73af5ede79d4236868f4687e7bcd736b

SHA1
e18b5147e47ebbf1eff7f93dccdb94fb052445bb

SHA256
1cedd84bc2cb7039b756461647955d939bdc5f0554a204ffeac421534d135950

SHA512
b25781f6fb3a9b633934bf29d0952711b7316556786e1675147e74b8b8bb9d5033ad9aa0e7af3fb8b1113fe48ce691f61cc3c1d143c3e2536637ec6d94807a35

Download Submit
C:\Windows\system\ODnHsTk.exe

Filesize
1.8MB

MD5
a3d635fdd4274a79d4f23c9950824f8f

SHA1
6b789da1ba1084cca386b400f82a0cd591cdc487

SHA256
f29d3fc045ec22eeff3e76b3639406d500fe09627f81aeed50586ea31c039066

SHA512
7b7993188eafa4cf3f1faaa4c17408fe23042290a33856412af8264c41b5f37e7d22c347a6b0847e612cff9b2b0e2eba11a4e1191a33948bfda34243ddce00c9

Download Submit
C:\Windows\system\QSiIbZv.exe

Filesize
1.8MB

MD5
ec5eeef8929d60ff0469b27ae2501821

SHA1
c6a221c07c180fc414750fbf9031604dec982c20

SHA256
0ccca0a42530d261285db266b1d898d201803646bed70791059176d32f7d6bae

SHA512
f2da2a4ad7df64a51fce22df2cad4b10d88f6df9fa611bf0754367d3d90b715c74f8c2aba01ba391b8331b66032be81956c7c4d8cbab859bacd193cfc6c2de51

Download Submit
C:\Windows\system\SVWVjCT.exe

Filesize
1.8MB

MD5
c43108f1039152fa62b342129a13fc7e

SHA1
34b7aa84d298ad1a6c5ea61f4abf4b9b317ca2b1

SHA256
0004c5b24bd126484d4fa9a64a308f57dc75ea91bc914b2bf60937fc550e8761

SHA512
c91a1df0fbd8a9601f2ffda0f3d604483fd9017bcc16120de3ff5daf996e8f806610c744899d18af5992c82553c494697ab28246daca3decdb3fe550dcc83faf

Download Submit
C:\Windows\system\TCJylxO.exe

Filesize
1.8MB

MD5
808af7c4ba040e715650b7cbdd67c728

SHA1
10dfdc5715ea84e51f1495ca5e677b3ce64c5386

SHA256
33d5982c7d6fb7a84893e31c6f80f81f6a61076ea1056efc9d110f054e16b9b8

SHA512
6217b9a21f3255e85339e6f1ec0411e8d1d857f9b5e83df41ee3206d8cb2f1aaae5a2b68562dee1c65c0ffd6efb1c762382274366513b8e78a7b68f29037973d

Download Submit
C:\Windows\system\TZUBGUK.exe

Filesize
1.8MB

MD5
654efcceef2fe208ac2aaddd0cf4bcdd

SHA1
de0ab3ff1ec4e4e7707a3c44ebf6cbec8bc4650a

SHA256
70b4d57a06e6b12ed64dc14013587af62ccc419a71fc56f2255ac6450c936e04

SHA512
695719834a77646d761022b00fecc2c3b3d04094bff8e812134115f23b36675099e67993e15735ec8e53125b533e28ff03a3c0588efebe6587eeb4ce0296cb4b

Download Submit
C:\Windows\system\UQzFEkL.exe

Filesize
1.8MB

MD5
35206111204ad78bb26f4ecb63daa5fa

SHA1
26fdc4aeba5767eba90aa87ff202d6212a255558

SHA256
fa1dc9b83e68d5f55ff7f01d6c88a662f259927957527e2d2a7eb74bf0730e83

SHA512
26f40393adb106a215e170aacc8fb961a44530fe3d40d995d099e6fdea586cdd7ab9f26e6644c06b9223f9d9ba50d0f7d824cefdf82c4ee1949349b5f25976c9

Download Submit
C:\Windows\system\VOOpnGl.exe

Filesize
1.8MB

MD5
e8cca1681489de4b6c01ee7a4fc2889a

SHA1
3b1fc2fff81d385627792ca33967a0a034b3e8e4

SHA256
d7934f7c9fc87707fa5ea8777e33666d3e13c39bda2a1f13ab7d000e31d4b670

SHA512
c5833c6485487dc9e9498b81c6f404b9ed41210feecc1099b416d07bcb0bdda748b4f062009974ef7b5b0cac86be63053dcc50b177d8113a668f99efc3a6ed24

Download Submit
C:\Windows\system\WXWJdXt.exe

Filesize
1.8MB

MD5
c413c47b3dc6c2797a2d1ceafc82c0df

SHA1
058d8f0b25552514dfd36fcbd9c6aed2200c53f9

SHA256
961fa4e2cfafc6cba8b8d8449e269536fd69f537210315c6776f4b272b7b3d7c

SHA512
938ad655a68d51858c4133ac0eb74433436435d002f2bfa174f53d3fd32f8ac20064017635f56dd921726f30637135d3f8c89cd7155b313aeaa507418d983c87

Download Submit
C:\Windows\system\ZTrxvtr.exe

Filesize
1.8MB

MD5
f9bc41066cc5edc8a0d9d76ba0e2c907

SHA1
1768e43808e19e1882fc231823a5eacd98819186

SHA256
604e7256b224c2bdf0f5e0703fb552966ff3e6d644fbb3e1cdc5da72709709f5

SHA512
5f84433c8658448ae7691de4f83af7ca2c8c0239d55473cd2a437fec84a34c0556b2067e41e94c4e6ccc8baadfb5cb92cd6977ff57b20b8532e4cc6e8c1beee5

Download Submit
C:\Windows\system\aZfsSlN.exe

Filesize
1.8MB

MD5
89558fff599561a2e9b667892c4ffc73

SHA1
819c598dca491444fc0aff814f894d352f9add8f

SHA256
b315332d9d12ea32f0aba94cafe7cd0ea31480481ffb41150830fb1d52bb1bb2

SHA512
dbe185a9c949e45a0f646038ab88d451f4a8c5abb71b2d089f62373fbe4067d78bf9b887320a29a012fe7aa2c5f338591661ef0ed08596a4d72e34621fc139cb

Download Submit
C:\Windows\system\bMsIOXt.exe

Filesize
1.8MB

MD5
3d1323907e415f2b66fb7081acc7e1bd

SHA1
50cc17e4a70abf6a39b26e9fdb31b688505749f8

SHA256
9b23071918fd9e00684567aa618c7d167a30947f4016fea830153e642720cd67

SHA512
5535ac28c3a3f531a6b4b4ae6390858c73b6a2ff924993b62135af4625cc6df5d856bb223079c6a3ec0c2c9b45e3bb53faed4a591c7db29eef551c2a277ab3b8

Download Submit
C:\Windows\system\chMmRTh.exe

Filesize
1.8MB

MD5
fe7102490593be7f0a1031246295142c

SHA1
7dfd18a457249243fffa3381f035d7e6801dfd92

SHA256
1dd5a3ede23a8fcccc796516db9c711ae29d7d1211d5774095051105cd60d91e

SHA512
e8a09293aded3c83be3a01139e3a4a411f9de7fee73bf68fca7d5efe9f677b268ed1b8bdcfde31aaddc61c4621d4e7d11c03e3b49880a01681e5e8a309a0371c

Download Submit
C:\Windows\system\dMUIVNQ.exe

Filesize
1.8MB

MD5
673b09f0b2bbd9f5589a1b08ab067c0f

SHA1
52c7c2b38ef0d0f064bc8fd68f7781648506f527

SHA256
4e272cdfad11a64fc86fe83a8b55a5c95fa809f98bbf34c68096e49a8079ed1b

SHA512
439c169077487b4ad496a84d44d1748029e066ad0dbcfec07167c0f242ad7581bf9b57cac82b88966e942c9c9322c2a78bff6d388b1e103fb78c12008cab9931

Download Submit
C:\Windows\system\fLJRUci.exe

Filesize
1.8MB

MD5
180e357305468e022f7425a673442629

SHA1
735262a52bcee0b661b46de7647410b563a0293f

SHA256
c87073085b131b4ab55a860d62ba1e573ab8651f8905a581bf8a012aece0cb99

SHA512
fd0b8b756958eef1902a83962dcc8f0dc48a437a7903a39e07755c9328ca89ff230ef2d1444a48bafdaf84fd36820e2e21cd0b3ada34db9f69cfe6bc6ce42ea8

Download Submit
C:\Windows\system\fRSeJDW.exe

Filesize
1.8MB

MD5
0e77d0cdca1904661a18005003f20db6

SHA1
e77ff4de6d17d71fdd78c9761ac438485be06f56

SHA256
bc933fd300eaefebd3855af7259e96ee16a3bf6bd073f884070f09f301417433

SHA512
987e5af3cf34a77244abc2647c90f68a39d27fc61d2804f0f62c1c50462a13fa2bf21c6aea497759f4edeb0dce043e0a439c3e79105b37eebe57d93ebc2a0a01

Download Submit
C:\Windows\system\hPhCLSn.exe

Filesize
1.8MB

MD5
736e2eac1c66ad65d70ac064fdb53831

SHA1
dc3c441d99a4864637b506e821ff98882ca1e1a9

SHA256
cf38b259a91e74d894d9595662627302d61e3ca776d7f270cbe19432935704c4

SHA512
2c6fcd5c3997ae9ca470c1712284ffa9712a0ed4e37ef2d45467817d68668065439a9f18ff4fd2a85e6016e0ef1971eb83ca901f3bb8403ab94c8a1fa2749d7e

Download Submit
C:\Windows\system\hXJRXgu.exe

Filesize
1.8MB

MD5
6c4665c23dfc94916b6aed7f7f7f0af8

SHA1
dafcc2eab9ae6ad4095e9536c95c0b73d985221e

SHA256
08bbbd757463a271548ca85469413ab0fc3aa1d6ba64d9549f95008681953a08

SHA512
f885db1337fd87bc33f31e168b3dece579a0e6c580e5c3e76d633b84ac24cbee70b3041d01d8feba2d52eb460acf78cd0f129417bc650267d4a93036a1b3e781

Download Submit
C:\Windows\system\lAqrFBQ.exe

Filesize
1.8MB

MD5
fc58cb5d92719b785b9439c20380ba85

SHA1
799cd75e4787b47cd4c3c33db86a68e32fb859ac

SHA256
0ed1674d4970bfd5c7c125d11a1d2a8e12338d97da97309ec732649afd6f55d9

SHA512
3c67d00b5ebfc4eb49f86e5ea7ead4570cff337edf1bc802361083a8b641cc958ca591d502d921ca20b0d90fb490ed3a9625d759b33dd3467b8e3742a5e190fc

Download Submit
C:\Windows\system\nNaIMuj.exe

Filesize
1.8MB

MD5
86031b5878a8ecf0b431afa19092dfb5

SHA1
14f483ccc3c0e2bb6a0787d258fa4573a0205e7a

SHA256
6e87044d823762420e5335c14f2055c4e904bdc89f7a5b68974cea7c21c24f54

SHA512
6bab00dcddbe774e88e2f0268e73e3dc2ea98d0d1c5b5f428be1bc2cc9500b205f7ec839d79ccad5c9386ac8883a046df90a658474633f8f5b45443fa6ec0e0a

Download Submit
C:\Windows\system\rEaxnXb.exe

Filesize
1.8MB

MD5
a1d07f542e4165350c5eb3c57ebe5f44

SHA1
b96cae46cf0a283582d235d13388a07197c60937

SHA256
1bdf444c6441dfd7609dc3e006a0ecff5a0691c2ff81158c78b2e1be2d3f0f67

SHA512
49c1fc573c3166e1135807a4553b99ea6340c53005ab168788c4ee24950dbd86ede0cc19aba87cf9b5f99c250ee532cdbcfa18096b340ef921bcc9d93ace4ee6

Download Submit
C:\Windows\system\rEeontM.exe

Filesize
1.8MB

MD5
1790cfb93364cdc1d7268883d2c4767d

SHA1
4b43c55568564f52a2f94588afeabe65d706ab25

SHA256
6accd28dedf9c7348064d455cf8c70b48b7fd98868f76a8e195da959dcf3710b

SHA512
706ff9472a3bb2655b301d80080b3d0f2d3aac711447dac5f071d8bc79a8c10dc3d2fee21ee88536896fe5f03a30c57dd0a3a20ebd2d8a2105abbf7c84eb2092

Download Submit
C:\Windows\system\rlGIUJA.exe

Filesize
1.8MB

MD5
8e0be5eb9480cc8e260cd5c0fe7ad249

SHA1
32162601b29b17ea5e527307960401b354a9e553

SHA256
6109117bd38237550d6878ba82c4c0d2c09aa00fed67b6db844670ff2cfce2ac

SHA512
54ddd49bae084159c97b4af5d5de83a8f27b656c9746d4aa4961974f09c5ac1528f57c6a6b044500196a81ca758863836d13b583cc09cbf5e5dcf23e30b296dd

Download Submit
C:\Windows\system\sYJEnIN.exe

Filesize
1.8MB

MD5
abcd01dfa9c1de8dba82e6f52318926f

SHA1
e8d2204455537a5f0b32cafd6463464c940d34f1

SHA256
37a6b2678f42ee13d50d87b648b17a10dd044f5ff2be416ae0ec0e71333b2ace

SHA512
765f040714b2ba7dde5be6178a3333804391208877cc6c84148f1291aa7cc805d04cdca7a4a4e70be228d779130c6bc278bf3ef73f7753765814e0936bf88c72

Download Submit
C:\Windows\system\tGKpgfI.exe

Filesize
1.8MB

MD5
6ecade112ae851932b49b741c1b57d07

SHA1
ea19a39f665b06e7a326d2bdc55b6ef081999175

SHA256
0cd8ec026b77701587103fb2749ee5955ff66ccc6135f8feb7ce1dfe8029e85b

SHA512
8a592bf16bbde1858bf25085d29ada1c277361040ca55ad564b0679d49ec7c44b01794b2265420d1d5f1a7c8ac106c1991b6d47eb8df2f0ef8f1426bb9b01e27

Download Submit
C:\Windows\system\tkVTnRt.exe

Filesize
1.8MB

MD5
9d8c175197bacda7f4dd53e3b43b2ad2

SHA1
9d1f51769ac156c130feef684121c9c3f7b91c38

SHA256
ccff1fcf0032a34f7f621e83081a7341192fcf8ff51a0ef5ed3ae83f1dd646cb

SHA512
f235823685add0e1d6608d71e02cbfe5beff988b945de9807e6f11c1ebaac91305cef7d932ba279b3878537100b911299f897f391725d13395ce4cd028eb158c

Download Submit
C:\Windows\system\zsQLhsU.exe

Filesize
1.8MB

MD5
087e635cd70eddb53fa5a87bed85af29

SHA1
e8492985e9bca4187fa3133ac4e8b49e4fb93ceb

SHA256
45bcec849357adc95ed05967d958e202c40e023536b00a675c944ccb52d9335c

SHA512
5ac6f38d42472d974e2d5b9476b18bc667e153ac875da5859e75c52c695066f23dd8634e660b7cb4eadc0e5a5adca5731455023b350d4c203b830bbafe3671c5

Download Submit
\Windows\system\ywXIwDl.exe

Filesize
1.8MB

MD5
6dfd4910ccc18da727389472318e76ba

SHA1
a31518ff02fe4f0fb03da2ded2563624cf91776c

SHA256
205f06eae308bd9d0c72ef75839589cde2e5c57a4c5de4967c423e07fe3bd50a

SHA512
76221fe16e04e4f5d4fb54e9eda270fa988ec23263607f69e115a9f1a16a117c9751309545b522f1e9f9755889bf97ccf0f0ae7bf8d75180e06c81a9e9a49426

Download Submit
memory/1676-545-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/1676-136-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1676-146-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/1676-201-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/1676-147-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/1676-14-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/1992-190-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-150-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-159-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-7-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-13-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1992-200-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-185-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-156-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-197-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/1992-169-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/1992-173-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-181-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2496-194-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-199-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2576-8-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-153-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-163-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-177-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2848-166-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download