xmrig | 0ad9c0f579a949af6813783ba1296e45914c543a20e7b3554aa52e0f6987eb79

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
Size

1.9MB
MD5

038fe4601734bbe5e88b1a1bcc0becb8
SHA1

147e42301949e03e435538ba59ff29c19321c308
SHA256

0ad9c0f579a949af6813783ba1296e45914c543a20e7b3554aa52e0f6987eb79
SHA512

8455fafde104834e970adffc48ba5d631ea15154bc506be11f34ca0dd17b90f832f401cd66f56cdc907b2c0f179c4dce74db1d006a48331cf7f9f39712aff1f4
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U18:NABl

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/1396-9-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2192-78-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2532-76-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2724-74-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2512-72-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2568-70-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2172-69-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2592-68-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2604-256-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/1068-255-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/840-254-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/752-253-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2292-252-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2832-251-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2192-250-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2540-244-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2172-242-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/1396-1538-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2832-1830-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2540-1829-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2568-1828-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2724-1885-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2512-1839-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2532-1838-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2592-1837-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2192-1836-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1396	mnWWMOn.exe
2540	NTifZYS.exe
2592	YwKjxGd.exe
2568	jkUxIKH.exe
2512	JUJTMdC.exe
2724	FZVAooL.exe
2532	DGamKOu.exe
2192	EhXBtZV.exe
2832	zDWPNrX.exe
2292	ofwbTTi.exe
752	cnxMaZx.exe
840	CwZwQDo.exe
1068	IggTDVI.exe
2604	lOWrpqH.exe
2188	ktPZHjs.exe
940	IjzMXnW.exe
1976	OZawVGO.exe
1920	ExBuhLB.exe
2228	aduCeJi.exe
2216	lcHvPhz.exe
1180	xOpejxG.exe
1904	IegsqLK.exe
2212	VJTsqyV.exe
1540	LhqXsMv.exe
2256	cUNgrvZ.exe
2728	bkyUAje.exe
2280	ULGTAKK.exe
476	IuDVhlO.exe
756	UCZGJsX.exe
1060	fsIyFSu.exe
2964	intOWeQ.exe
436	QPLekch.exe
1376	qSNEtHR.exe
2020	QsVZHET.exe
1784	ZqCeAvH.exe
1812	WGkqgPU.exe
1792	midcYbm.exe
1624	uGldVWG.exe
1560	iSshvua.exe
320	PsFMitb.exe
1664	lXVVbKb.exe
1668	UaYbfOj.exe
980	DKszkhV.exe
2264	SoawMCg.exe
1544	ubLTjFq.exe
2820	hULNIBU.exe
2080	CYOAiSb.exe
2492	pJoMhHj.exe
2012	ijIWxqd.exe
2304	KhtSiNK.exe
2888	DesYWtk.exe
1612	ZxzNHFS.exe
2932	eOQQIVP.exe
2616	YaDGmAG.exe
2500	ysCQkxc.exe
2404	ZndUJVo.exe
2128	FCDuFCG.exe
2640	SEvsUWD.exe
2364	yDarCHG.exe
2644	bnsNBtb.exe
2844	xnFcdeY.exe
2464	QqqpfUz.exe
928	bFvopQD.exe
2572	ZnnMeVf.exe

Loads dropped DLL 64 IoCs

pid	Process
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x000b0000000155e2-3.dat	upx
behavioral1/memory/1396-9-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/files/0x0024000000015c23-14.dat	upx
behavioral1/memory/2540-15-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x0008000000015c5d-12.dat	upx
behavioral1/files/0x000f0000000006fd-28.dat	upx
behavioral1/files/0x0008000000015c69-33.dat	upx
behavioral1/files/0x0007000000015c7c-38.dat	upx
behavioral1/files/0x0009000000015d88-49.dat	upx
behavioral1/files/0x0007000000015c87-43.dat	upx
behavioral1/files/0x0005000000018698-58.dat	upx
behavioral1/files/0x0006000000018ae2-91.dat	upx
behavioral1/files/0x0006000000018b6a-124.dat	upx
behavioral1/files/0x0006000000018b37-110.dat	upx
behavioral1/files/0x0006000000018b42-115.dat	upx
behavioral1/files/0x0006000000018b33-105.dat	upx
behavioral1/files/0x0006000000018b15-100.dat	upx
behavioral1/files/0x0006000000018ae8-94.dat	upx
behavioral1/memory/2832-81-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x0006000000018b4a-120.dat	upx
behavioral1/memory/2192-78-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2532-76-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2724-74-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2512-72-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2568-70-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2592-68-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-62.dat	upx
behavioral1/files/0x000500000001868c-54.dat	upx
behavioral1/memory/2604-256-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/1068-255-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/840-254-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/752-253-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/memory/2292-252-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2832-251-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2192-250-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2540-244-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2172-242-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x0005000000019410-191.dat	upx
behavioral1/files/0x000500000001939b-182.dat	upx
behavioral1/files/0x00050000000193b0-185.dat	upx
behavioral1/files/0x0005000000019368-172.dat	upx
behavioral1/files/0x0005000000019377-175.dat	upx
behavioral1/files/0x000500000001931b-162.dat	upx
behavioral1/files/0x0005000000019333-165.dat	upx
behavioral1/files/0x00050000000192c9-151.dat	upx
behavioral1/files/0x00050000000192f4-156.dat	upx
behavioral1/files/0x0006000000018ba2-142.dat	upx
behavioral1/files/0x0006000000018d06-145.dat	upx
behavioral1/files/0x0006000000018b73-131.dat	upx
behavioral1/files/0x0006000000018b96-135.dat	upx
behavioral1/memory/1396-1538-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2832-1830-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2540-1829-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2568-1828-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2724-1885-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2512-1839-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2532-1838-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2592-1837-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2192-1836-0x000000013FF90000-0x0000000140382000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JAtYaZL.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\dkneubp.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\EXayIZu.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\uFGEmOw.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\DHJufrD.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ZQrVBwV.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\DAiLtrA.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\awrJMlP.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\MgiehVC.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\vIDwCqa.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\FCtFDLe.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\WnZNWbd.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\OZawVGO.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\WlHgVxt.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\sQWGBLd.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\XuSrHwB.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\UHnNtqy.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\rYRvSgC.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\VmIRSuw.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\XzpAibj.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\vZFHlrW.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\fLjGJov.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\kFrznWS.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\XZivoCN.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\gHvnTho.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\iNJxAjq.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\aIDuSzt.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\FGNOpUR.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\eDYqJfP.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\FCXhOKr.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\dIcZuYL.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\evsSyeP.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\uuJgnqc.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\QqqpfUz.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\QDyCYFc.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\jLJIfGj.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\dljSkho.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\NtMjzah.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\KPvIphr.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\TCXyfoR.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\MShROGn.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\zqsDIKn.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\EniZoRw.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\xuiNxUe.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ZaFEqkc.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\sIfiozX.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ytMtsEv.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\JOPDZTe.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\CEZDNOp.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\JDXNyxN.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\RxpnBSL.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\bqpNFiH.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\yISmRHv.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\OMkdOYz.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ofwbTTi.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\pUZuwiR.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\VMcPcef.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\ezFCbyl.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\qwiPZAd.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\EDuKeMi.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\SyVniNP.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\KYPnPnt.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\OESwLwC.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
File created	C:\Windows\System\lhYWhCK.exe	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2276	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
Token: SeDebugPrivilege	2276	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2276	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2276	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2276	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	29
PID 2172 wrote to memory of 1396	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	30
PID 2172 wrote to memory of 1396	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	30
PID 2172 wrote to memory of 1396	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2540	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2540	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2540	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2592	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2592	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2592	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2568	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	33
PID 2172 wrote to memory of 2568	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	33
PID 2172 wrote to memory of 2568	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	33
PID 2172 wrote to memory of 2512	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	34
PID 2172 wrote to memory of 2512	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	34
PID 2172 wrote to memory of 2512	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	34
PID 2172 wrote to memory of 2724	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	35
PID 2172 wrote to memory of 2724	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	35
PID 2172 wrote to memory of 2724	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	35
PID 2172 wrote to memory of 2532	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	36
PID 2172 wrote to memory of 2532	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	36
PID 2172 wrote to memory of 2532	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	36
PID 2172 wrote to memory of 2192	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	37
PID 2172 wrote to memory of 2192	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	37
PID 2172 wrote to memory of 2192	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	37
PID 2172 wrote to memory of 2832	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	38
PID 2172 wrote to memory of 2832	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	38
PID 2172 wrote to memory of 2832	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	38
PID 2172 wrote to memory of 2292	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	39
PID 2172 wrote to memory of 2292	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	39
PID 2172 wrote to memory of 2292	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	39
PID 2172 wrote to memory of 752	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	40
PID 2172 wrote to memory of 752	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	40
PID 2172 wrote to memory of 752	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	40
PID 2172 wrote to memory of 840	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	41
PID 2172 wrote to memory of 840	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	41
PID 2172 wrote to memory of 840	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	41
PID 2172 wrote to memory of 1068	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	42
PID 2172 wrote to memory of 1068	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	42
PID 2172 wrote to memory of 1068	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	42
PID 2172 wrote to memory of 2604	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	43
PID 2172 wrote to memory of 2604	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	43
PID 2172 wrote to memory of 2604	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	43
PID 2172 wrote to memory of 2188	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	44
PID 2172 wrote to memory of 2188	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	44
PID 2172 wrote to memory of 2188	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	44
PID 2172 wrote to memory of 940	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	45
PID 2172 wrote to memory of 940	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	45
PID 2172 wrote to memory of 940	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	45
PID 2172 wrote to memory of 1976	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	46
PID 2172 wrote to memory of 1976	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	46
PID 2172 wrote to memory of 1976	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	46
PID 2172 wrote to memory of 1920	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	47
PID 2172 wrote to memory of 1920	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	47
PID 2172 wrote to memory of 1920	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	47
PID 2172 wrote to memory of 2228	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	48
PID 2172 wrote to memory of 2228	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	48
PID 2172 wrote to memory of 2228	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	48
PID 2172 wrote to memory of 2216	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	49
PID 2172 wrote to memory of 2216	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	49
PID 2172 wrote to memory of 2216	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	49
PID 2172 wrote to memory of 1180	2172	038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\038fe4601734bbe5e88b1a1bcc0becb8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System\mnWWMOn.exe
  C:\Windows\System\mnWWMOn.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\NTifZYS.exe
  C:\Windows\System\NTifZYS.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\YwKjxGd.exe
  C:\Windows\System\YwKjxGd.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\jkUxIKH.exe
  C:\Windows\System\jkUxIKH.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JUJTMdC.exe
  C:\Windows\System\JUJTMdC.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\FZVAooL.exe
  C:\Windows\System\FZVAooL.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\DGamKOu.exe
  C:\Windows\System\DGamKOu.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\EhXBtZV.exe
  C:\Windows\System\EhXBtZV.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\zDWPNrX.exe
  C:\Windows\System\zDWPNrX.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ofwbTTi.exe
  C:\Windows\System\ofwbTTi.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\cnxMaZx.exe
  C:\Windows\System\cnxMaZx.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CwZwQDo.exe
  C:\Windows\System\CwZwQDo.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\IggTDVI.exe
  C:\Windows\System\IggTDVI.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\lOWrpqH.exe
  C:\Windows\System\lOWrpqH.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ktPZHjs.exe
  C:\Windows\System\ktPZHjs.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\IjzMXnW.exe
  C:\Windows\System\IjzMXnW.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\OZawVGO.exe
  C:\Windows\System\OZawVGO.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\ExBuhLB.exe
  C:\Windows\System\ExBuhLB.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\aduCeJi.exe
  C:\Windows\System\aduCeJi.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\lcHvPhz.exe
  C:\Windows\System\lcHvPhz.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\xOpejxG.exe
  C:\Windows\System\xOpejxG.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\IegsqLK.exe
  C:\Windows\System\IegsqLK.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\VJTsqyV.exe
  C:\Windows\System\VJTsqyV.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\LhqXsMv.exe
  C:\Windows\System\LhqXsMv.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\cUNgrvZ.exe
  C:\Windows\System\cUNgrvZ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\bkyUAje.exe
  C:\Windows\System\bkyUAje.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ULGTAKK.exe
  C:\Windows\System\ULGTAKK.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\IuDVhlO.exe
  C:\Windows\System\IuDVhlO.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\UCZGJsX.exe
  C:\Windows\System\UCZGJsX.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\fsIyFSu.exe
  C:\Windows\System\fsIyFSu.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\intOWeQ.exe
  C:\Windows\System\intOWeQ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\QPLekch.exe
  C:\Windows\System\QPLekch.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\qSNEtHR.exe
  C:\Windows\System\qSNEtHR.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\QsVZHET.exe
  C:\Windows\System\QsVZHET.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\ZqCeAvH.exe
  C:\Windows\System\ZqCeAvH.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\WGkqgPU.exe
  C:\Windows\System\WGkqgPU.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\midcYbm.exe
  C:\Windows\System\midcYbm.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\uGldVWG.exe
  C:\Windows\System\uGldVWG.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\iSshvua.exe
  C:\Windows\System\iSshvua.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\PsFMitb.exe
  C:\Windows\System\PsFMitb.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\lXVVbKb.exe
  C:\Windows\System\lXVVbKb.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\UaYbfOj.exe
  C:\Windows\System\UaYbfOj.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\DKszkhV.exe
  C:\Windows\System\DKszkhV.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\SoawMCg.exe
  C:\Windows\System\SoawMCg.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ubLTjFq.exe
  C:\Windows\System\ubLTjFq.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\hULNIBU.exe
  C:\Windows\System\hULNIBU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\CYOAiSb.exe
  C:\Windows\System\CYOAiSb.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pJoMhHj.exe
  C:\Windows\System\pJoMhHj.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ijIWxqd.exe
  C:\Windows\System\ijIWxqd.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\KhtSiNK.exe
  C:\Windows\System\KhtSiNK.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\DesYWtk.exe
  C:\Windows\System\DesYWtk.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ZxzNHFS.exe
  C:\Windows\System\ZxzNHFS.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\eOQQIVP.exe
  C:\Windows\System\eOQQIVP.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\YaDGmAG.exe
  C:\Windows\System\YaDGmAG.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ysCQkxc.exe
  C:\Windows\System\ysCQkxc.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\ZndUJVo.exe
  C:\Windows\System\ZndUJVo.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\FCDuFCG.exe
  C:\Windows\System\FCDuFCG.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\SEvsUWD.exe
  C:\Windows\System\SEvsUWD.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\yDarCHG.exe
  C:\Windows\System\yDarCHG.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\bnsNBtb.exe
  C:\Windows\System\bnsNBtb.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\xnFcdeY.exe
  C:\Windows\System\xnFcdeY.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\QqqpfUz.exe
  C:\Windows\System\QqqpfUz.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\bFvopQD.exe
  C:\Windows\System\bFvopQD.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\ZnnMeVf.exe
  C:\Windows\System\ZnnMeVf.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\OcSXBHb.exe
  C:\Windows\System\OcSXBHb.exe
  2⤵
  PID:2916
- C:\Windows\System\TbHscls.exe
  C:\Windows\System\TbHscls.exe
  2⤵
  PID:2196
- C:\Windows\System\OlyQHdp.exe
  C:\Windows\System\OlyQHdp.exe
  2⤵
  PID:2384
- C:\Windows\System\FmChfCY.exe
  C:\Windows\System\FmChfCY.exe
  2⤵
  PID:1116
- C:\Windows\System\dVjVMpA.exe
  C:\Windows\System\dVjVMpA.exe
  2⤵
  PID:1304
- C:\Windows\System\PmCIFaQ.exe
  C:\Windows\System\PmCIFaQ.exe
  2⤵
  PID:636
- C:\Windows\System\ngGuiwX.exe
  C:\Windows\System\ngGuiwX.exe
  2⤵
  PID:1336
- C:\Windows\System\HvApVPe.exe
  C:\Windows\System\HvApVPe.exe
  2⤵
  PID:1480
- C:\Windows\System\GgSGBbF.exe
  C:\Windows\System\GgSGBbF.exe
  2⤵
  PID:1768
- C:\Windows\System\cfbkhex.exe
  C:\Windows\System\cfbkhex.exe
  2⤵
  PID:2548
- C:\Windows\System\bSoFZVb.exe
  C:\Windows\System\bSoFZVb.exe
  2⤵
  PID:2624
- C:\Windows\System\giVmfux.exe
  C:\Windows\System\giVmfux.exe
  2⤵
  PID:2716
- C:\Windows\System\rfFYLKD.exe
  C:\Windows\System\rfFYLKD.exe
  2⤵
  PID:2312
- C:\Windows\System\ZSPpMfJ.exe
  C:\Windows\System\ZSPpMfJ.exe
  2⤵
  PID:2908
- C:\Windows\System\VUKGPam.exe
  C:\Windows\System\VUKGPam.exe
  2⤵
  PID:1196
- C:\Windows\System\KSWuXYQ.exe
  C:\Windows\System\KSWuXYQ.exe
  2⤵
  PID:2260
- C:\Windows\System\KyGDLyp.exe
  C:\Windows\System\KyGDLyp.exe
  2⤵
  PID:3000
- C:\Windows\System\lcpEZOo.exe
  C:\Windows\System\lcpEZOo.exe
  2⤵
  PID:2940
- C:\Windows\System\XDXjbXQ.exe
  C:\Windows\System\XDXjbXQ.exe
  2⤵
  PID:400
- C:\Windows\System\hsTDQCK.exe
  C:\Windows\System\hsTDQCK.exe
  2⤵
  PID:1848
- C:\Windows\System\IZiIzGX.exe
  C:\Windows\System\IZiIzGX.exe
  2⤵
  PID:2328
- C:\Windows\System\mMBfIBD.exe
  C:\Windows\System\mMBfIBD.exe
  2⤵
  PID:1444
- C:\Windows\System\LYYrbPW.exe
  C:\Windows\System\LYYrbPW.exe
  2⤵
  PID:1684
- C:\Windows\System\ujKEent.exe
  C:\Windows\System\ujKEent.exe
  2⤵
  PID:2972
- C:\Windows\System\DGKLUaA.exe
  C:\Windows\System\DGKLUaA.exe
  2⤵
  PID:1820
- C:\Windows\System\QoyLEcD.exe
  C:\Windows\System\QoyLEcD.exe
  2⤵
  PID:2528
- C:\Windows\System\kmWLMAi.exe
  C:\Windows\System\kmWLMAi.exe
  2⤵
  PID:1364
- C:\Windows\System\PdcPpIU.exe
  C:\Windows\System\PdcPpIU.exe
  2⤵
  PID:1020
- C:\Windows\System\HclAmPe.exe
  C:\Windows\System\HclAmPe.exe
  2⤵
  PID:2808
- C:\Windows\System\LBxMOmN.exe
  C:\Windows\System\LBxMOmN.exe
  2⤵
  PID:2252
- C:\Windows\System\PLzhTgV.exe
  C:\Windows\System\PLzhTgV.exe
  2⤵
  PID:2032
- C:\Windows\System\NYJQzaO.exe
  C:\Windows\System\NYJQzaO.exe
  2⤵
  PID:2884
- C:\Windows\System\clRPBEu.exe
  C:\Windows\System\clRPBEu.exe
  2⤵
  PID:2184
- C:\Windows\System\oofKmRk.exe
  C:\Windows\System\oofKmRk.exe
  2⤵
  PID:1500
- C:\Windows\System\XGfHWyu.exe
  C:\Windows\System\XGfHWyu.exe
  2⤵
  PID:2520
- C:\Windows\System\ierJVrW.exe
  C:\Windows\System\ierJVrW.exe
  2⤵
  PID:2544
- C:\Windows\System\DhuFiWs.exe
  C:\Windows\System\DhuFiWs.exe
  2⤵
  PID:1720
- C:\Windows\System\yquoBJk.exe
  C:\Windows\System\yquoBJk.exe
  2⤵
  PID:2904
- C:\Windows\System\LRayzyS.exe
  C:\Windows\System\LRayzyS.exe
  2⤵
  PID:1492
- C:\Windows\System\RiowHjv.exe
  C:\Windows\System\RiowHjv.exe
  2⤵
  PID:2456
- C:\Windows\System\LNTikEs.exe
  C:\Windows\System\LNTikEs.exe
  2⤵
  PID:2556
- C:\Windows\System\djCKYoT.exe
  C:\Windows\System\djCKYoT.exe
  2⤵
  PID:2508
- C:\Windows\System\iPrKxQX.exe
  C:\Windows\System\iPrKxQX.exe
  2⤵
  PID:2496
- C:\Windows\System\YmdocvQ.exe
  C:\Windows\System\YmdocvQ.exe
  2⤵
  PID:2372
- C:\Windows\System\kpmUaHD.exe
  C:\Windows\System\kpmUaHD.exe
  2⤵
  PID:2380
- C:\Windows\System\IBuQNoO.exe
  C:\Windows\System\IBuQNoO.exe
  2⤵
  PID:2224
- C:\Windows\System\JWNztNC.exe
  C:\Windows\System\JWNztNC.exe
  2⤵
  PID:572
- C:\Windows\System\DaHpmbx.exe
  C:\Windows\System\DaHpmbx.exe
  2⤵
  PID:2720
- C:\Windows\System\TnzMyJO.exe
  C:\Windows\System\TnzMyJO.exe
  2⤵
  PID:2776
- C:\Windows\System\WjvLawz.exe
  C:\Windows\System\WjvLawz.exe
  2⤵
  PID:596
- C:\Windows\System\XvDojTx.exe
  C:\Windows\System\XvDojTx.exe
  2⤵
  PID:2984
- C:\Windows\System\OoTdjqe.exe
  C:\Windows\System\OoTdjqe.exe
  2⤵
  PID:912
- C:\Windows\System\CHoleUc.exe
  C:\Windows\System\CHoleUc.exe
  2⤵
  PID:1564
- C:\Windows\System\gHvnTho.exe
  C:\Windows\System\gHvnTho.exe
  2⤵
  PID:2136
- C:\Windows\System\bcdcmcB.exe
  C:\Windows\System\bcdcmcB.exe
  2⤵
  PID:1160
- C:\Windows\System\rYPRzAU.exe
  C:\Windows\System\rYPRzAU.exe
  2⤵
  PID:2068
- C:\Windows\System\QoquXcw.exe
  C:\Windows\System\QoquXcw.exe
  2⤵
  PID:2792
- C:\Windows\System\hEzVXGk.exe
  C:\Windows\System\hEzVXGk.exe
  2⤵
  PID:2804
- C:\Windows\System\PwKIIfO.exe
  C:\Windows\System\PwKIIfO.exe
  2⤵
  PID:2784
- C:\Windows\System\qjjwOFw.exe
  C:\Windows\System\qjjwOFw.exe
  2⤵
  PID:828
- C:\Windows\System\vhruNxm.exe
  C:\Windows\System\vhruNxm.exe
  2⤵
  PID:1616
- C:\Windows\System\kYZrkGB.exe
  C:\Windows\System\kYZrkGB.exe
  2⤵
  PID:2084
- C:\Windows\System\KcJbpiu.exe
  C:\Windows\System\KcJbpiu.exe
  2⤵
  PID:1584
- C:\Windows\System\nmscrVc.exe
  C:\Windows\System\nmscrVc.exe
  2⤵
  PID:2584
- C:\Windows\System\ZevtUzl.exe
  C:\Windows\System\ZevtUzl.exe
  2⤵
  PID:2756
- C:\Windows\System\haaQUPX.exe
  C:\Windows\System\haaQUPX.exe
  2⤵
  PID:2412
- C:\Windows\System\GRQqFEO.exe
  C:\Windows\System\GRQqFEO.exe
  2⤵
  PID:1056
- C:\Windows\System\OymmPJr.exe
  C:\Windows\System\OymmPJr.exe
  2⤵
  PID:1712
- C:\Windows\System\GqQfnGv.exe
  C:\Windows\System\GqQfnGv.exe
  2⤵
  PID:1948
- C:\Windows\System\kFAmZAX.exe
  C:\Windows\System\kFAmZAX.exe
  2⤵
  PID:2448
- C:\Windows\System\kszrLJW.exe
  C:\Windows\System\kszrLJW.exe
  2⤵
  PID:1580
- C:\Windows\System\MhgRahl.exe
  C:\Windows\System\MhgRahl.exe
  2⤵
  PID:1184
- C:\Windows\System\kWXMnju.exe
  C:\Windows\System\kWXMnju.exe
  2⤵
  PID:1888
- C:\Windows\System\aZRlcrZ.exe
  C:\Windows\System\aZRlcrZ.exe
  2⤵
  PID:2708
- C:\Windows\System\gVrngaa.exe
  C:\Windows\System\gVrngaa.exe
  2⤵
  PID:2628
- C:\Windows\System\itmejEV.exe
  C:\Windows\System\itmejEV.exe
  2⤵
  PID:528
- C:\Windows\System\kpZVqQj.exe
  C:\Windows\System\kpZVqQj.exe
  2⤵
  PID:380
- C:\Windows\System\YIMdKbu.exe
  C:\Windows\System\YIMdKbu.exe
  2⤵
  PID:2732
- C:\Windows\System\GyVQhIe.exe
  C:\Windows\System\GyVQhIe.exe
  2⤵
  PID:1572
- C:\Windows\System\ZZMgamL.exe
  C:\Windows\System\ZZMgamL.exe
  2⤵
  PID:1744
- C:\Windows\System\tYBEmtn.exe
  C:\Windows\System\tYBEmtn.exe
  2⤵
  PID:2896
- C:\Windows\System\oqRRFxL.exe
  C:\Windows\System\oqRRFxL.exe
  2⤵
  PID:2272
- C:\Windows\System\BTDTIJT.exe
  C:\Windows\System\BTDTIJT.exe
  2⤵
  PID:3052
- C:\Windows\System\Qqribuf.exe
  C:\Windows\System\Qqribuf.exe
  2⤵
  PID:2788
- C:\Windows\System\VDimmvZ.exe
  C:\Windows\System\VDimmvZ.exe
  2⤵
  PID:1252
- C:\Windows\System\nPCDzRa.exe
  C:\Windows\System\nPCDzRa.exe
  2⤵
  PID:568
- C:\Windows\System\MllAVIr.exe
  C:\Windows\System\MllAVIr.exe
  2⤵
  PID:1516
- C:\Windows\System\LHiKbyP.exe
  C:\Windows\System\LHiKbyP.exe
  2⤵
  PID:2300
- C:\Windows\System\StzsIFC.exe
  C:\Windows\System\StzsIFC.exe
  2⤵
  PID:2552
- C:\Windows\System\HCdicLg.exe
  C:\Windows\System\HCdicLg.exe
  2⤵
  PID:2652
- C:\Windows\System\GtKexoq.exe
  C:\Windows\System\GtKexoq.exe
  2⤵
  PID:2600
- C:\Windows\System\NdZXruw.exe
  C:\Windows\System\NdZXruw.exe
  2⤵
  PID:2952
- C:\Windows\System\YZtOWqG.exe
  C:\Windows\System\YZtOWqG.exe
  2⤵
  PID:2856
- C:\Windows\System\kYWsteD.exe
  C:\Windows\System\kYWsteD.exe
  2⤵
  PID:2420
- C:\Windows\System\wUlWqVp.exe
  C:\Windows\System\wUlWqVp.exe
  2⤵
  PID:844
- C:\Windows\System\HplnmsQ.exe
  C:\Windows\System\HplnmsQ.exe
  2⤵
  PID:2416
- C:\Windows\System\RiexbwC.exe
  C:\Windows\System\RiexbwC.exe
  2⤵
  PID:800
- C:\Windows\System\eHYPhMy.exe
  C:\Windows\System\eHYPhMy.exe
  2⤵
  PID:1724
- C:\Windows\System\NmHBIGJ.exe
  C:\Windows\System\NmHBIGJ.exe
  2⤵
  PID:616
- C:\Windows\System\xciKMSH.exe
  C:\Windows\System\xciKMSH.exe
  2⤵
  PID:2516
- C:\Windows\System\RnfRkuX.exe
  C:\Windows\System\RnfRkuX.exe
  2⤵
  PID:2928
- C:\Windows\System\JvwBneZ.exe
  C:\Windows\System\JvwBneZ.exe
  2⤵
  PID:2660
- C:\Windows\System\vFdVxUF.exe
  C:\Windows\System\vFdVxUF.exe
  2⤵
  PID:2988
- C:\Windows\System\gsdRfCk.exe
  C:\Windows\System\gsdRfCk.exe
  2⤵
  PID:1344
- C:\Windows\System\RLrQvUA.exe
  C:\Windows\System\RLrQvUA.exe
  2⤵
  PID:2860
- C:\Windows\System\UfEtIHf.exe
  C:\Windows\System\UfEtIHf.exe
  2⤵
  PID:2688
- C:\Windows\System\UPEuBgL.exe
  C:\Windows\System\UPEuBgL.exe
  2⤵
  PID:1688
- C:\Windows\System\NyAVRWP.exe
  C:\Windows\System\NyAVRWP.exe
  2⤵
  PID:2852
- C:\Windows\System\UPzhqeJ.exe
  C:\Windows\System\UPzhqeJ.exe
  2⤵
  PID:1504
- C:\Windows\System\ADpxDdG.exe
  C:\Windows\System\ADpxDdG.exe
  2⤵
  PID:1896
- C:\Windows\System\YWtlmSL.exe
  C:\Windows\System\YWtlmSL.exe
  2⤵
  PID:2148
- C:\Windows\System\jPgRrEE.exe
  C:\Windows\System\jPgRrEE.exe
  2⤵
  PID:2768
- C:\Windows\System\QTHswcd.exe
  C:\Windows\System\QTHswcd.exe
  2⤵
  PID:1992
- C:\Windows\System\wNvNyYN.exe
  C:\Windows\System\wNvNyYN.exe
  2⤵
  PID:1952
- C:\Windows\System\lUgdLCe.exe
  C:\Windows\System\lUgdLCe.exe
  2⤵
  PID:1728
- C:\Windows\System\XJsOAlJ.exe
  C:\Windows\System\XJsOAlJ.exe
  2⤵
  PID:2400
- C:\Windows\System\IfvBAIu.exe
  C:\Windows\System\IfvBAIu.exe
  2⤵
  PID:2744
- C:\Windows\System\rUYPdJY.exe
  C:\Windows\System\rUYPdJY.exe
  2⤵
  PID:392
- C:\Windows\System\wFUPZfE.exe
  C:\Windows\System\wFUPZfE.exe
  2⤵
  PID:2232
- C:\Windows\System\eMQzUxh.exe
  C:\Windows\System\eMQzUxh.exe
  2⤵
  PID:1148
- C:\Windows\System\LQdgjQx.exe
  C:\Windows\System\LQdgjQx.exe
  2⤵
  PID:1964
- C:\Windows\System\FYJOtHy.exe
  C:\Windows\System\FYJOtHy.exe
  2⤵
  PID:880
- C:\Windows\System\mgRluZq.exe
  C:\Windows\System\mgRluZq.exe
  2⤵
  PID:2036
- C:\Windows\System\EjyQclY.exe
  C:\Windows\System\EjyQclY.exe
  2⤵
  PID:1588
- C:\Windows\System\jJIgJZo.exe
  C:\Windows\System\jJIgJZo.exe
  2⤵
  PID:760
- C:\Windows\System\tDtYUvO.exe
  C:\Windows\System\tDtYUvO.exe
  2⤵
  PID:1176
- C:\Windows\System\twvDiGP.exe
  C:\Windows\System\twvDiGP.exe
  2⤵
  PID:3088
- C:\Windows\System\mogkISm.exe
  C:\Windows\System\mogkISm.exe
  2⤵
  PID:3108
- C:\Windows\System\lhYWhCK.exe
  C:\Windows\System\lhYWhCK.exe
  2⤵
  PID:3124
- C:\Windows\System\GZlZWWf.exe
  C:\Windows\System\GZlZWWf.exe
  2⤵
  PID:3144
- C:\Windows\System\EglozIT.exe
  C:\Windows\System\EglozIT.exe
  2⤵
  PID:3160
- C:\Windows\System\vGFmMwZ.exe
  C:\Windows\System\vGFmMwZ.exe
  2⤵
  PID:3176
- C:\Windows\System\hlLyDxu.exe
  C:\Windows\System\hlLyDxu.exe
  2⤵
  PID:3192
- C:\Windows\System\RhnCFit.exe
  C:\Windows\System\RhnCFit.exe
  2⤵
  PID:3220
- C:\Windows\System\gQpLRxc.exe
  C:\Windows\System\gQpLRxc.exe
  2⤵
  PID:3236
- C:\Windows\System\SKuWyZk.exe
  C:\Windows\System\SKuWyZk.exe
  2⤵
  PID:3252
- C:\Windows\System\qtBzDtW.exe
  C:\Windows\System\qtBzDtW.exe
  2⤵
  PID:3268
- C:\Windows\System\dTqeCVO.exe
  C:\Windows\System\dTqeCVO.exe
  2⤵
  PID:3284
- C:\Windows\System\KXQEeMi.exe
  C:\Windows\System\KXQEeMi.exe
  2⤵
  PID:3304
- C:\Windows\System\flMJKNH.exe
  C:\Windows\System\flMJKNH.exe
  2⤵
  PID:3320
- C:\Windows\System\fLjGJov.exe
  C:\Windows\System\fLjGJov.exe
  2⤵
  PID:3336
- C:\Windows\System\HaevUWe.exe
  C:\Windows\System\HaevUWe.exe
  2⤵
  PID:3352
- C:\Windows\System\ToRNdlx.exe
  C:\Windows\System\ToRNdlx.exe
  2⤵
  PID:3368
- C:\Windows\System\JDkqtmy.exe
  C:\Windows\System\JDkqtmy.exe
  2⤵
  PID:3384
- C:\Windows\System\MASvXPL.exe
  C:\Windows\System\MASvXPL.exe
  2⤵
  PID:3400
- C:\Windows\System\VXjPJOL.exe
  C:\Windows\System\VXjPJOL.exe
  2⤵
  PID:3416
- C:\Windows\System\prGskti.exe
  C:\Windows\System\prGskti.exe
  2⤵
  PID:3440
- C:\Windows\System\XRQOHZX.exe
  C:\Windows\System\XRQOHZX.exe
  2⤵
  PID:3456
- C:\Windows\System\DBQtmeP.exe
  C:\Windows\System\DBQtmeP.exe
  2⤵
  PID:3472
- C:\Windows\System\UfXGMdo.exe
  C:\Windows\System\UfXGMdo.exe
  2⤵
  PID:3492
- C:\Windows\System\BSncVUd.exe
  C:\Windows\System\BSncVUd.exe
  2⤵
  PID:3508
- C:\Windows\System\hPIvgbO.exe
  C:\Windows\System\hPIvgbO.exe
  2⤵
  PID:3524
- C:\Windows\System\phtkkgy.exe
  C:\Windows\System\phtkkgy.exe
  2⤵
  PID:3540
- C:\Windows\System\cPuRsvO.exe
  C:\Windows\System\cPuRsvO.exe
  2⤵
  PID:3556
- C:\Windows\System\GWLuVYP.exe
  C:\Windows\System\GWLuVYP.exe
  2⤵
  PID:3572
- C:\Windows\System\zqvtSqb.exe
  C:\Windows\System\zqvtSqb.exe
  2⤵
  PID:3592
- C:\Windows\System\TVfAyTr.exe
  C:\Windows\System\TVfAyTr.exe
  2⤵
  PID:3608
- C:\Windows\System\bEsNNRX.exe
  C:\Windows\System\bEsNNRX.exe
  2⤵
  PID:3640
- C:\Windows\System\lvYKuVX.exe
  C:\Windows\System\lvYKuVX.exe
  2⤵
  PID:3656
- C:\Windows\System\fckphIa.exe
  C:\Windows\System\fckphIa.exe
  2⤵
  PID:3672
- C:\Windows\System\eMcVCqs.exe
  C:\Windows\System\eMcVCqs.exe
  2⤵
  PID:3692
- C:\Windows\System\FxIwowQ.exe
  C:\Windows\System\FxIwowQ.exe
  2⤵
  PID:3708
- C:\Windows\System\yRJCxDM.exe
  C:\Windows\System\yRJCxDM.exe
  2⤵
  PID:3724
- C:\Windows\System\YfLRgoP.exe
  C:\Windows\System\YfLRgoP.exe
  2⤵
  PID:3744
- C:\Windows\System\YMRJlnH.exe
  C:\Windows\System\YMRJlnH.exe
  2⤵
  PID:3760
- C:\Windows\System\MxbhPPI.exe
  C:\Windows\System\MxbhPPI.exe
  2⤵
  PID:3776
- C:\Windows\System\PyZCwOq.exe
  C:\Windows\System\PyZCwOq.exe
  2⤵
  PID:3792
- C:\Windows\System\VdQBneZ.exe
  C:\Windows\System\VdQBneZ.exe
  2⤵
  PID:3808
- C:\Windows\System\rbOxLQv.exe
  C:\Windows\System\rbOxLQv.exe
  2⤵
  PID:3824
- C:\Windows\System\wWkUoDI.exe
  C:\Windows\System\wWkUoDI.exe
  2⤵
  PID:3840
- C:\Windows\System\TjtNllL.exe
  C:\Windows\System\TjtNllL.exe
  2⤵
  PID:3864
- C:\Windows\System\CiIVcNt.exe
  C:\Windows\System\CiIVcNt.exe
  2⤵
  PID:3880
- C:\Windows\System\BAjSBqI.exe
  C:\Windows\System\BAjSBqI.exe
  2⤵
  PID:3908
- C:\Windows\System\iWlESOh.exe
  C:\Windows\System\iWlESOh.exe
  2⤵
  PID:3928
- C:\Windows\System\XPlBJLL.exe
  C:\Windows\System\XPlBJLL.exe
  2⤵
  PID:3944
- C:\Windows\System\gCMtTyU.exe
  C:\Windows\System\gCMtTyU.exe
  2⤵
  PID:3960
- C:\Windows\System\JlcCIFn.exe
  C:\Windows\System\JlcCIFn.exe
  2⤵
  PID:3980
- C:\Windows\System\MtCPJhz.exe
  C:\Windows\System\MtCPJhz.exe
  2⤵
  PID:3996
- C:\Windows\System\crQmXGI.exe
  C:\Windows\System\crQmXGI.exe
  2⤵
  PID:4012
- C:\Windows\System\YSBmTMu.exe
  C:\Windows\System\YSBmTMu.exe
  2⤵
  PID:4028
- C:\Windows\System\PCYKdpl.exe
  C:\Windows\System\PCYKdpl.exe
  2⤵
  PID:4044
- C:\Windows\System\yPuxRVw.exe
  C:\Windows\System\yPuxRVw.exe
  2⤵
  PID:4060
- C:\Windows\System\pLonegy.exe
  C:\Windows\System\pLonegy.exe
  2⤵
  PID:4080
- C:\Windows\System\YgLIxeO.exe
  C:\Windows\System\YgLIxeO.exe
  2⤵
  PID:2240
- C:\Windows\System\dlNkkYU.exe
  C:\Windows\System\dlNkkYU.exe
  2⤵
  PID:3076
- C:\Windows\System\mLxTDuw.exe
  C:\Windows\System\mLxTDuw.exe
  2⤵
  PID:3100
- C:\Windows\System\CPOnwZH.exe
  C:\Windows\System\CPOnwZH.exe
  2⤵
  PID:3136
- C:\Windows\System\qxWoxXK.exe
  C:\Windows\System\qxWoxXK.exe
  2⤵
  PID:1340
- C:\Windows\System\hVTbZrb.exe
  C:\Windows\System\hVTbZrb.exe
  2⤵
  PID:3184
- C:\Windows\System\cnhPlcW.exe
  C:\Windows\System\cnhPlcW.exe
  2⤵
  PID:3216
- C:\Windows\System\UlDituW.exe
  C:\Windows\System\UlDituW.exe
  2⤵
  PID:3280
- C:\Windows\System\LFWVQVN.exe
  C:\Windows\System\LFWVQVN.exe
  2⤵
  PID:3380
- C:\Windows\System\fZmBHcd.exe
  C:\Windows\System\fZmBHcd.exe
  2⤵
  PID:3412
- C:\Windows\System\cOxWpeQ.exe
  C:\Windows\System\cOxWpeQ.exe
  2⤵
  PID:3360
- C:\Windows\System\brYFQWZ.exe
  C:\Windows\System\brYFQWZ.exe
  2⤵
  PID:3300
- C:\Windows\System\EcKYAVq.exe
  C:\Windows\System\EcKYAVq.exe
  2⤵
  PID:3428
- C:\Windows\System\ugpkKMa.exe
  C:\Windows\System\ugpkKMa.exe
  2⤵
  PID:3484
- C:\Windows\System\WtixgeS.exe
  C:\Windows\System\WtixgeS.exe
  2⤵
  PID:3516
- C:\Windows\System\gtPtCIF.exe
  C:\Windows\System\gtPtCIF.exe
  2⤵
  PID:3584
- C:\Windows\System\xLXihxb.exe
  C:\Windows\System\xLXihxb.exe
  2⤵
  PID:3636
- C:\Windows\System\ntbVYXo.exe
  C:\Windows\System\ntbVYXo.exe
  2⤵
  PID:3564
- C:\Windows\System\WIhnnjz.exe
  C:\Windows\System\WIhnnjz.exe
  2⤵
  PID:3568
- C:\Windows\System\uUPCzYe.exe
  C:\Windows\System\uUPCzYe.exe
  2⤵
  PID:3680
- C:\Windows\System\YaWJhBw.exe
  C:\Windows\System\YaWJhBw.exe
  2⤵
  PID:3704
- C:\Windows\System\HPJzYAY.exe
  C:\Windows\System\HPJzYAY.exe
  2⤵
  PID:3772
- C:\Windows\System\WWAMJZQ.exe
  C:\Windows\System\WWAMJZQ.exe
  2⤵
  PID:3836
- C:\Windows\System\MrFYCxe.exe
  C:\Windows\System\MrFYCxe.exe
  2⤵
  PID:3872
- C:\Windows\System\XsbpTKq.exe
  C:\Windows\System\XsbpTKq.exe
  2⤵
  PID:3720
- C:\Windows\System\LAHdREe.exe
  C:\Windows\System\LAHdREe.exe
  2⤵
  PID:3860
- C:\Windows\System\bMnJgnI.exe
  C:\Windows\System\bMnJgnI.exe
  2⤵
  PID:3888
- C:\Windows\System\jrzpAqu.exe
  C:\Windows\System\jrzpAqu.exe
  2⤵
  PID:3900
- C:\Windows\System\pZOxwzW.exe
  C:\Windows\System\pZOxwzW.exe
  2⤵
  PID:3940
- C:\Windows\System\bWMLRim.exe
  C:\Windows\System\bWMLRim.exe
  2⤵
  PID:3992
- C:\Windows\System\ZAqrjsk.exe
  C:\Windows\System\ZAqrjsk.exe
  2⤵
  PID:4052
- C:\Windows\System\VJFFHbP.exe
  C:\Windows\System\VJFFHbP.exe
  2⤵
  PID:4036
- C:\Windows\System\aWwdlRO.exe
  C:\Windows\System\aWwdlRO.exe
  2⤵
  PID:4076
- C:\Windows\System\AnbJfpI.exe
  C:\Windows\System\AnbJfpI.exe
  2⤵
  PID:1672
- C:\Windows\System\rYOYwUU.exe
  C:\Windows\System\rYOYwUU.exe
  2⤵
  PID:3152
- C:\Windows\System\PvnZUCk.exe
  C:\Windows\System\PvnZUCk.exe
  2⤵
  PID:3204
- C:\Windows\System\xsVRwuN.exe
  C:\Windows\System\xsVRwuN.exe
  2⤵
  PID:3376
- C:\Windows\System\fpAjSxI.exe
  C:\Windows\System\fpAjSxI.exe
  2⤵
  PID:3156
- C:\Windows\System\XFTtLvy.exe
  C:\Windows\System\XFTtLvy.exe
  2⤵
  PID:3228
- C:\Windows\System\ZmkrsAc.exe
  C:\Windows\System\ZmkrsAc.exe
  2⤵
  PID:3408
- C:\Windows\System\dTSvTJB.exe
  C:\Windows\System\dTSvTJB.exe
  2⤵
  PID:3276
- C:\Windows\System\XuSrHwB.exe
  C:\Windows\System\XuSrHwB.exe
  2⤵
  PID:3620
- C:\Windows\System\ieaNiZf.exe
  C:\Windows\System\ieaNiZf.exe
  2⤵
  PID:3500
- C:\Windows\System\giyMilZ.exe
  C:\Windows\System\giyMilZ.exe
  2⤵
  PID:3736
- C:\Windows\System\KUvaaJR.exe
  C:\Windows\System\KUvaaJR.exe
  2⤵
  PID:3832
- C:\Windows\System\edTGKhD.exe
  C:\Windows\System\edTGKhD.exe
  2⤵
  PID:3740
- C:\Windows\System\bheqAbi.exe
  C:\Windows\System\bheqAbi.exe
  2⤵
  PID:3756
- C:\Windows\System\CISZOHa.exe
  C:\Windows\System\CISZOHa.exe
  2⤵
  PID:3788
- C:\Windows\System\TsHqCjO.exe
  C:\Windows\System\TsHqCjO.exe
  2⤵
  PID:4024
- C:\Windows\System\UPfIVPo.exe
  C:\Windows\System\UPfIVPo.exe
  2⤵
  PID:4072
- C:\Windows\System\ZUXbvZi.exe
  C:\Windows\System\ZUXbvZi.exe
  2⤵
  PID:3972
- C:\Windows\System\LFodhqH.exe
  C:\Windows\System\LFodhqH.exe
  2⤵
  PID:3200
- C:\Windows\System\bMhSpih.exe
  C:\Windows\System\bMhSpih.exe
  2⤵
  PID:3328
- C:\Windows\System\YAdoXjr.exe
  C:\Windows\System\YAdoXjr.exe
  2⤵
  PID:3432
- C:\Windows\System\laiSXiX.exe
  C:\Windows\System\laiSXiX.exe
  2⤵
  PID:3392
- C:\Windows\System\ZBqzZXN.exe
  C:\Windows\System\ZBqzZXN.exe
  2⤵
  PID:3632
- C:\Windows\System\rwSyHlI.exe
  C:\Windows\System\rwSyHlI.exe
  2⤵
  PID:3804
- C:\Windows\System\SEuLRGX.exe
  C:\Windows\System\SEuLRGX.exe
  2⤵
  PID:3140
- C:\Windows\System\htAZkvW.exe
  C:\Windows\System\htAZkvW.exe
  2⤵
  PID:3896
- C:\Windows\System\wazbjbi.exe
  C:\Windows\System\wazbjbi.exe
  2⤵
  PID:4004
- C:\Windows\System\kFrznWS.exe
  C:\Windows\System\kFrznWS.exe
  2⤵
  PID:3424
- C:\Windows\System\XEEKBwM.exe
  C:\Windows\System\XEEKBwM.exe
  2⤵
  PID:3936
- C:\Windows\System\JGNZLTV.exe
  C:\Windows\System\JGNZLTV.exe
  2⤵
  PID:3856
- C:\Windows\System\uDdGxhj.exe
  C:\Windows\System\uDdGxhj.exe
  2⤵
  PID:3648
- C:\Windows\System\zaBSJtY.exe
  C:\Windows\System\zaBSJtY.exe
  2⤵
  PID:3480
- C:\Windows\System\sLSTAfy.exe
  C:\Windows\System\sLSTAfy.exe
  2⤵
  PID:3784
- C:\Windows\System\ZVZxgiu.exe
  C:\Windows\System\ZVZxgiu.exe
  2⤵
  PID:4108
- C:\Windows\System\YadVdJp.exe
  C:\Windows\System\YadVdJp.exe
  2⤵
  PID:4124
- C:\Windows\System\AoPZndL.exe
  C:\Windows\System\AoPZndL.exe
  2⤵
  PID:4144
- C:\Windows\System\gwRRQBi.exe
  C:\Windows\System\gwRRQBi.exe
  2⤵
  PID:4168
- C:\Windows\System\MtOonwU.exe
  C:\Windows\System\MtOonwU.exe
  2⤵
  PID:4184
- C:\Windows\System\uTXeSwF.exe
  C:\Windows\System\uTXeSwF.exe
  2⤵
  PID:4200
- C:\Windows\System\NRDZwwQ.exe
  C:\Windows\System\NRDZwwQ.exe
  2⤵
  PID:4216
- C:\Windows\System\evsSyeP.exe
  C:\Windows\System\evsSyeP.exe
  2⤵
  PID:4232
- C:\Windows\System\XjBLXwd.exe
  C:\Windows\System\XjBLXwd.exe
  2⤵
  PID:4248
- C:\Windows\System\EkvDEMk.exe
  C:\Windows\System\EkvDEMk.exe
  2⤵
  PID:4264
- C:\Windows\System\UHnNtqy.exe
  C:\Windows\System\UHnNtqy.exe
  2⤵
  PID:4280
- C:\Windows\System\UiGjsNa.exe
  C:\Windows\System\UiGjsNa.exe
  2⤵
  PID:4296
- C:\Windows\System\TjBZYph.exe
  C:\Windows\System\TjBZYph.exe
  2⤵
  PID:4312
- C:\Windows\System\zUCJojg.exe
  C:\Windows\System\zUCJojg.exe
  2⤵
  PID:4328
- C:\Windows\System\zCPjJbL.exe
  C:\Windows\System\zCPjJbL.exe
  2⤵
  PID:4348
- C:\Windows\System\FaSVibQ.exe
  C:\Windows\System\FaSVibQ.exe
  2⤵
  PID:4364
- C:\Windows\System\trbtkPJ.exe
  C:\Windows\System\trbtkPJ.exe
  2⤵
  PID:4380
- C:\Windows\System\nkWHlUv.exe
  C:\Windows\System\nkWHlUv.exe
  2⤵
  PID:4396
- C:\Windows\System\QUBcXkM.exe
  C:\Windows\System\QUBcXkM.exe
  2⤵
  PID:4420
- C:\Windows\System\UXQxmeu.exe
  C:\Windows\System\UXQxmeu.exe
  2⤵
  PID:4436
- C:\Windows\System\YjTCzeN.exe
  C:\Windows\System\YjTCzeN.exe
  2⤵
  PID:4452
- C:\Windows\System\MgiehVC.exe
  C:\Windows\System\MgiehVC.exe
  2⤵
  PID:4468
- C:\Windows\System\TUxfBAS.exe
  C:\Windows\System\TUxfBAS.exe
  2⤵
  PID:4484
- C:\Windows\System\ZaFEqkc.exe
  C:\Windows\System\ZaFEqkc.exe
  2⤵
  PID:4500
- C:\Windows\System\PnSMXSl.exe
  C:\Windows\System\PnSMXSl.exe
  2⤵
  PID:4516
- C:\Windows\System\bNvyrTn.exe
  C:\Windows\System\bNvyrTn.exe
  2⤵
  PID:4540
- C:\Windows\System\ASwNoVT.exe
  C:\Windows\System\ASwNoVT.exe
  2⤵
  PID:4556
- C:\Windows\System\ENoCbTy.exe
  C:\Windows\System\ENoCbTy.exe
  2⤵
  PID:4572
- C:\Windows\System\uOkigST.exe
  C:\Windows\System\uOkigST.exe
  2⤵
  PID:4588
- C:\Windows\System\ydEFTtb.exe
  C:\Windows\System\ydEFTtb.exe
  2⤵
  PID:4604
- C:\Windows\System\zgYzZcW.exe
  C:\Windows\System\zgYzZcW.exe
  2⤵
  PID:4620
- C:\Windows\System\yBOJvVi.exe
  C:\Windows\System\yBOJvVi.exe
  2⤵
  PID:4640
- C:\Windows\System\jLJIfGj.exe
  C:\Windows\System\jLJIfGj.exe
  2⤵
  PID:4656
- C:\Windows\System\yvKlwFS.exe
  C:\Windows\System\yvKlwFS.exe
  2⤵
  PID:4672
- C:\Windows\System\iogbeKh.exe
  C:\Windows\System\iogbeKh.exe
  2⤵
  PID:4688
- C:\Windows\System\GbjttQq.exe
  C:\Windows\System\GbjttQq.exe
  2⤵
  PID:4704
- C:\Windows\System\qTuvqVg.exe
  C:\Windows\System\qTuvqVg.exe
  2⤵
  PID:4728
- C:\Windows\System\hPgbTmY.exe
  C:\Windows\System\hPgbTmY.exe
  2⤵
  PID:4748
- C:\Windows\System\UcqCFXV.exe
  C:\Windows\System\UcqCFXV.exe
  2⤵
  PID:4764
- C:\Windows\System\nWJXFVM.exe
  C:\Windows\System\nWJXFVM.exe
  2⤵
  PID:4788
- C:\Windows\System\IiLWYjy.exe
  C:\Windows\System\IiLWYjy.exe
  2⤵
  PID:4804
- C:\Windows\System\EDuKeMi.exe
  C:\Windows\System\EDuKeMi.exe
  2⤵
  PID:4824
- C:\Windows\System\MZNdKhS.exe
  C:\Windows\System\MZNdKhS.exe
  2⤵
  PID:4856
- C:\Windows\System\RgGfuwn.exe
  C:\Windows\System\RgGfuwn.exe
  2⤵
  PID:4872
- C:\Windows\System\Opqinir.exe
  C:\Windows\System\Opqinir.exe
  2⤵
  PID:4892
- C:\Windows\System\tvzeFbp.exe
  C:\Windows\System\tvzeFbp.exe
  2⤵
  PID:4940
- C:\Windows\System\kfPrphJ.exe
  C:\Windows\System\kfPrphJ.exe
  2⤵
  PID:4976
- C:\Windows\System\dVwBYaI.exe
  C:\Windows\System\dVwBYaI.exe
  2⤵
  PID:4992
- C:\Windows\System\RVILaHc.exe
  C:\Windows\System\RVILaHc.exe
  2⤵
  PID:5072
- C:\Windows\System\ijBJcuN.exe
  C:\Windows\System\ijBJcuN.exe
  2⤵
  PID:5092
- C:\Windows\System\XnCiDPk.exe
  C:\Windows\System\XnCiDPk.exe
  2⤵
  PID:5108
- C:\Windows\System\sPGpRVX.exe
  C:\Windows\System\sPGpRVX.exe
  2⤵
  PID:3344
- C:\Windows\System\jATdyZn.exe
  C:\Windows\System\jATdyZn.exe
  2⤵
  PID:4104
- C:\Windows\System\bMPDHSL.exe
  C:\Windows\System\bMPDHSL.exe
  2⤵
  PID:3820
- C:\Windows\System\ECvOTZY.exe
  C:\Windows\System\ECvOTZY.exe
  2⤵
  PID:4152
- C:\Windows\System\WZApcam.exe
  C:\Windows\System\WZApcam.exe
  2⤵
  PID:4212
- C:\Windows\System\ccpgbbF.exe
  C:\Windows\System\ccpgbbF.exe
  2⤵
  PID:4308
- C:\Windows\System\yswYWOh.exe
  C:\Windows\System\yswYWOh.exe
  2⤵
  PID:4260
- C:\Windows\System\UgaTJLg.exe
  C:\Windows\System\UgaTJLg.exe
  2⤵
  PID:4428
- C:\Windows\System\iNnrCfY.exe
  C:\Windows\System\iNnrCfY.exe
  2⤵
  PID:4392
- C:\Windows\System\zjULepa.exe
  C:\Windows\System\zjULepa.exe
  2⤵
  PID:4460
- C:\Windows\System\inKTtFO.exe
  C:\Windows\System\inKTtFO.exe
  2⤵
  PID:4524
- C:\Windows\System\PQNMdsD.exe
  C:\Windows\System\PQNMdsD.exe
  2⤵
  PID:4448
- C:\Windows\System\lWbXVRH.exe
  C:\Windows\System\lWbXVRH.exe
  2⤵
  PID:4568
- C:\Windows\System\CqDSxOa.exe
  C:\Windows\System\CqDSxOa.exe
  2⤵
  PID:4632
- C:\Windows\System\oHPiLmY.exe
  C:\Windows\System\oHPiLmY.exe
  2⤵
  PID:4548
- C:\Windows\System\JAtYaZL.exe
  C:\Windows\System\JAtYaZL.exe
  2⤵
  PID:4668
- C:\Windows\System\hOOTHcn.exe
  C:\Windows\System\hOOTHcn.exe
  2⤵
  PID:4648
- C:\Windows\System\KYPnPnt.exe
  C:\Windows\System\KYPnPnt.exe
  2⤵
  PID:4724
- C:\Windows\System\gHrBESG.exe
  C:\Windows\System\gHrBESG.exe
  2⤵
  PID:4776
- C:\Windows\System\dljSkho.exe
  C:\Windows\System\dljSkho.exe
  2⤵
  PID:4800
- C:\Windows\System\wRHtgKY.exe
  C:\Windows\System\wRHtgKY.exe
  2⤵
  PID:4840
- C:\Windows\System\oXjtIqC.exe
  C:\Windows\System\oXjtIqC.exe
  2⤵
  PID:240
- C:\Windows\System\zpHRMkv.exe
  C:\Windows\System\zpHRMkv.exe
  2⤵
  PID:4904
- C:\Windows\System\cvdXHqM.exe
  C:\Windows\System\cvdXHqM.exe
  2⤵
  PID:4864
- C:\Windows\System\IHJpDrD.exe
  C:\Windows\System\IHJpDrD.exe
  2⤵
  PID:4920
- C:\Windows\System\bSGQGwT.exe
  C:\Windows\System\bSGQGwT.exe
  2⤵
  PID:4988
- C:\Windows\System\KYhoUQO.exe
  C:\Windows\System\KYhoUQO.exe
  2⤵
  PID:4952
- C:\Windows\System\qARoPKU.exe
  C:\Windows\System\qARoPKU.exe
  2⤵
  PID:5004
- C:\Windows\System\tkljyXg.exe
  C:\Windows\System\tkljyXg.exe
  2⤵
  PID:5048
- C:\Windows\System\NyIGRcL.exe
  C:\Windows\System\NyIGRcL.exe
  2⤵
  PID:5040
- C:\Windows\System\jLWNCax.exe
  C:\Windows\System\jLWNCax.exe
  2⤵
  PID:5088
- C:\Windows\System\ELtNKXe.exe
  C:\Windows\System\ELtNKXe.exe
  2⤵
  PID:3296
- C:\Windows\System\HGTCwEo.exe
  C:\Windows\System\HGTCwEo.exe
  2⤵
  PID:3096
- C:\Windows\System\mJLrWjB.exe
  C:\Windows\System\mJLrWjB.exe
  2⤵
  PID:4244
- C:\Windows\System\PlIBWwE.exe
  C:\Windows\System\PlIBWwE.exe
  2⤵
  PID:4272
- C:\Windows\System\BHVWOvn.exe
  C:\Windows\System\BHVWOvn.exe
  2⤵
  PID:5116
- C:\Windows\System\fZjSXsd.exe
  C:\Windows\System\fZjSXsd.exe
  2⤵
  PID:4120
- C:\Windows\System\RmUOpCH.exe
  C:\Windows\System\RmUOpCH.exe
  2⤵
  PID:4372
- C:\Windows\System\ompzDTo.exe
  C:\Windows\System\ompzDTo.exe
  2⤵
  PID:4160
- C:\Windows\System\VsjgBdm.exe
  C:\Windows\System\VsjgBdm.exe
  2⤵
  PID:4228
- C:\Windows\System\wQdlJxe.exe
  C:\Windows\System\wQdlJxe.exe
  2⤵
  PID:4492
- C:\Windows\System\OBcXisp.exe
  C:\Windows\System\OBcXisp.exe
  2⤵
  PID:4628
- C:\Windows\System\JCfjUnt.exe
  C:\Windows\System\JCfjUnt.exe
  2⤵
  PID:4324
- C:\Windows\System\LBCBloz.exe
  C:\Windows\System\LBCBloz.exe
  2⤵
  PID:4596
- C:\Windows\System\DJeyVpm.exe
  C:\Windows\System\DJeyVpm.exe
  2⤵
  PID:4476
- C:\Windows\System\EyeEyKb.exe
  C:\Windows\System\EyeEyKb.exe
  2⤵
  PID:4712
- C:\Windows\System\nioBWht.exe
  C:\Windows\System\nioBWht.exe
  2⤵
  PID:4772
- C:\Windows\System\DIgvjQc.exe
  C:\Windows\System\DIgvjQc.exe
  2⤵
  PID:4680
- C:\Windows\System\FxRwgss.exe
  C:\Windows\System\FxRwgss.exe
  2⤵
  PID:4816
- C:\Windows\System\tuGrjpo.exe
  C:\Windows\System\tuGrjpo.exe
  2⤵
  PID:4880
- C:\Windows\System\BhVpkYa.exe
  C:\Windows\System\BhVpkYa.exe
  2⤵
  PID:4912
- C:\Windows\System\xVNYWGN.exe
  C:\Windows\System\xVNYWGN.exe
  2⤵
  PID:4984
- C:\Windows\System\vHgFVNy.exe
  C:\Windows\System\vHgFVNy.exe
  2⤵
  PID:4968
- C:\Windows\System\ghOjtiy.exe
  C:\Windows\System\ghOjtiy.exe
  2⤵
  PID:5024
- C:\Windows\System\OMkdOYz.exe
  C:\Windows\System\OMkdOYz.exe
  2⤵
  PID:5084
- C:\Windows\System\KwfGcwB.exe
  C:\Windows\System\KwfGcwB.exe
  2⤵
  PID:3688
- C:\Windows\System\lfhfuFR.exe
  C:\Windows\System\lfhfuFR.exe
  2⤵
  PID:4256
- C:\Windows\System\jTzHvUy.exe
  C:\Windows\System\jTzHvUy.exe
  2⤵
  PID:4192
- C:\Windows\System\IvYuNeS.exe
  C:\Windows\System\IvYuNeS.exe
  2⤵
  PID:4056
- C:\Windows\System\iVHkEVw.exe
  C:\Windows\System\iVHkEVw.exe
  2⤵
  PID:4924
- C:\Windows\System\ycuARnv.exe
  C:\Windows\System\ycuARnv.exe
  2⤵
  PID:4612
- C:\Windows\System\GiMjlfX.exe
  C:\Windows\System\GiMjlfX.exe
  2⤵
  PID:4736
- C:\Windows\System\OkpVWKv.exe
  C:\Windows\System\OkpVWKv.exe
  2⤵
  PID:4412
- C:\Windows\System\ProQfHW.exe
  C:\Windows\System\ProQfHW.exe
  2⤵
  PID:4888
- C:\Windows\System\SSuTDkA.exe
  C:\Windows\System\SSuTDkA.exe
  2⤵
  PID:4884
- C:\Windows\System\gCFzDsC.exe
  C:\Windows\System\gCFzDsC.exe
  2⤵
  PID:5000
- C:\Windows\System\gkdOeRG.exe
  C:\Windows\System\gkdOeRG.exe
  2⤵
  PID:5032
- C:\Windows\System\eKDLDSG.exe
  C:\Windows\System\eKDLDSG.exe
  2⤵
  PID:5060
- C:\Windows\System\WmKCwJs.exe
  C:\Windows\System\WmKCwJs.exe
  2⤵
  PID:4360
- C:\Windows\System\MXwWmbG.exe
  C:\Windows\System\MXwWmbG.exe
  2⤵
  PID:4508
- C:\Windows\System\ysQVdtJ.exe
  C:\Windows\System\ysQVdtJ.exe
  2⤵
  PID:4536
- C:\Windows\System\kdlpVTd.exe
  C:\Windows\System\kdlpVTd.exe
  2⤵
  PID:4964
- C:\Windows\System\iecEOIc.exe
  C:\Windows\System\iecEOIc.exe
  2⤵
  PID:4480
- C:\Windows\System\NtMjzah.exe
  C:\Windows\System\NtMjzah.exe
  2⤵
  PID:3448
- C:\Windows\System\VNcmzYw.exe
  C:\Windows\System\VNcmzYw.exe
  2⤵
  PID:4908
- C:\Windows\System\KZMqcJy.exe
  C:\Windows\System\KZMqcJy.exe
  2⤵
  PID:4760
- C:\Windows\System\HORCzWK.exe
  C:\Windows\System\HORCzWK.exe
  2⤵
  PID:5128
- C:\Windows\System\RPbgZAK.exe
  C:\Windows\System\RPbgZAK.exe
  2⤵
  PID:5144
- C:\Windows\System\lkkQrBD.exe
  C:\Windows\System\lkkQrBD.exe
  2⤵
  PID:5160
- C:\Windows\System\qhHxgBB.exe
  C:\Windows\System\qhHxgBB.exe
  2⤵
  PID:5176
- C:\Windows\System\PDhyCRb.exe
  C:\Windows\System\PDhyCRb.exe
  2⤵
  PID:5192
- C:\Windows\System\xnBIFlR.exe
  C:\Windows\System\xnBIFlR.exe
  2⤵
  PID:5208
- C:\Windows\System\NjgCcLF.exe
  C:\Windows\System\NjgCcLF.exe
  2⤵
  PID:5224
- C:\Windows\System\zTpiHWZ.exe
  C:\Windows\System\zTpiHWZ.exe
  2⤵
  PID:5240
- C:\Windows\System\ZFjGfSf.exe
  C:\Windows\System\ZFjGfSf.exe
  2⤵
  PID:5256
- C:\Windows\System\XykSqCp.exe
  C:\Windows\System\XykSqCp.exe
  2⤵
  PID:5272
- C:\Windows\System\boDwoNL.exe
  C:\Windows\System\boDwoNL.exe
  2⤵
  PID:5288
- C:\Windows\System\DQzDDVF.exe
  C:\Windows\System\DQzDDVF.exe
  2⤵
  PID:5304
- C:\Windows\System\JfjgMmt.exe
  C:\Windows\System\JfjgMmt.exe
  2⤵
  PID:5320
- C:\Windows\System\rbvFJBI.exe
  C:\Windows\System\rbvFJBI.exe
  2⤵
  PID:5336
- C:\Windows\System\sBJotNP.exe
  C:\Windows\System\sBJotNP.exe
  2⤵
  PID:5352
- C:\Windows\System\rKKNyWZ.exe
  C:\Windows\System\rKKNyWZ.exe
  2⤵
  PID:5368
- C:\Windows\System\mESrcuG.exe
  C:\Windows\System\mESrcuG.exe
  2⤵
  PID:5388
- C:\Windows\System\vIDwCqa.exe
  C:\Windows\System\vIDwCqa.exe
  2⤵
  PID:5404
- C:\Windows\System\zBybapr.exe
  C:\Windows\System\zBybapr.exe
  2⤵
  PID:5420
- C:\Windows\System\oIlEmcT.exe
  C:\Windows\System\oIlEmcT.exe
  2⤵
  PID:5436
- C:\Windows\System\MTfEmgX.exe
  C:\Windows\System\MTfEmgX.exe
  2⤵
  PID:5452
- C:\Windows\System\jQbOTHX.exe
  C:\Windows\System\jQbOTHX.exe
  2⤵
  PID:5468
- C:\Windows\System\iMKCopp.exe
  C:\Windows\System\iMKCopp.exe
  2⤵
  PID:5484
- C:\Windows\System\ohoBoHV.exe
  C:\Windows\System\ohoBoHV.exe
  2⤵
  PID:5500
- C:\Windows\System\JouiPSw.exe
  C:\Windows\System\JouiPSw.exe
  2⤵
  PID:5516
- C:\Windows\System\ATQYcbZ.exe
  C:\Windows\System\ATQYcbZ.exe
  2⤵
  PID:5532
- C:\Windows\System\yjnwFLC.exe
  C:\Windows\System\yjnwFLC.exe
  2⤵
  PID:5548
- C:\Windows\System\XfjhfBZ.exe
  C:\Windows\System\XfjhfBZ.exe
  2⤵
  PID:5564
- C:\Windows\System\wWOQvIT.exe
  C:\Windows\System\wWOQvIT.exe
  2⤵
  PID:5580
- C:\Windows\System\RqgWyUd.exe
  C:\Windows\System\RqgWyUd.exe
  2⤵
  PID:5596
- C:\Windows\System\RgAzqLW.exe
  C:\Windows\System\RgAzqLW.exe
  2⤵
  PID:5612
- C:\Windows\System\AGCbsKc.exe
  C:\Windows\System\AGCbsKc.exe
  2⤵
  PID:5628
- C:\Windows\System\EKKGgjQ.exe
  C:\Windows\System\EKKGgjQ.exe
  2⤵
  PID:5644
- C:\Windows\System\HQSbcqP.exe
  C:\Windows\System\HQSbcqP.exe
  2⤵
  PID:5660
- C:\Windows\System\RUcBheM.exe
  C:\Windows\System\RUcBheM.exe
  2⤵
  PID:5676
- C:\Windows\System\oOMCJtx.exe
  C:\Windows\System\oOMCJtx.exe
  2⤵
  PID:5692
- C:\Windows\System\OhKOSZf.exe
  C:\Windows\System\OhKOSZf.exe
  2⤵
  PID:5708
- C:\Windows\System\rzGKmhH.exe
  C:\Windows\System\rzGKmhH.exe
  2⤵
  PID:5724
- C:\Windows\System\AQGVLYX.exe
  C:\Windows\System\AQGVLYX.exe
  2⤵
  PID:5740
- C:\Windows\System\MpfbHeK.exe
  C:\Windows\System\MpfbHeK.exe
  2⤵
  PID:5756
- C:\Windows\System\LJolHBr.exe
  C:\Windows\System\LJolHBr.exe
  2⤵
  PID:5772
- C:\Windows\System\ygENmye.exe
  C:\Windows\System\ygENmye.exe
  2⤵
  PID:5788
- C:\Windows\System\dDRjCaF.exe
  C:\Windows\System\dDRjCaF.exe
  2⤵
  PID:5804
- C:\Windows\System\DHJufrD.exe
  C:\Windows\System\DHJufrD.exe
  2⤵
  PID:5820
- C:\Windows\System\MVGYKan.exe
  C:\Windows\System\MVGYKan.exe
  2⤵
  PID:5836
- C:\Windows\System\tqYreBo.exe
  C:\Windows\System\tqYreBo.exe
  2⤵
  PID:5852
- C:\Windows\System\yIbzfoq.exe
  C:\Windows\System\yIbzfoq.exe
  2⤵
  PID:5868
- C:\Windows\System\BqddOGk.exe
  C:\Windows\System\BqddOGk.exe
  2⤵
  PID:5884
- C:\Windows\System\mcUJMDQ.exe
  C:\Windows\System\mcUJMDQ.exe
  2⤵
  PID:5900
- C:\Windows\System\oSSeXTS.exe
  C:\Windows\System\oSSeXTS.exe
  2⤵
  PID:5916
- C:\Windows\System\PIAdNXR.exe
  C:\Windows\System\PIAdNXR.exe
  2⤵
  PID:5932
- C:\Windows\System\ncbcsKi.exe
  C:\Windows\System\ncbcsKi.exe
  2⤵
  PID:5948
- C:\Windows\System\uzMNQRp.exe
  C:\Windows\System\uzMNQRp.exe
  2⤵
  PID:5964
- C:\Windows\System\GOoLldc.exe
  C:\Windows\System\GOoLldc.exe
  2⤵
  PID:5980
- C:\Windows\System\BpEqzet.exe
  C:\Windows\System\BpEqzet.exe
  2⤵
  PID:5996
- C:\Windows\System\SSJAmZE.exe
  C:\Windows\System\SSJAmZE.exe
  2⤵
  PID:6012
- C:\Windows\System\tkxpSnY.exe
  C:\Windows\System\tkxpSnY.exe
  2⤵
  PID:6028
- C:\Windows\System\aAxZIFq.exe
  C:\Windows\System\aAxZIFq.exe
  2⤵
  PID:6048
- C:\Windows\System\cNqyQWx.exe
  C:\Windows\System\cNqyQWx.exe
  2⤵
  PID:6064
- C:\Windows\System\nThxvaB.exe
  C:\Windows\System\nThxvaB.exe
  2⤵
  PID:6080
- C:\Windows\System\MFMNFKF.exe
  C:\Windows\System\MFMNFKF.exe
  2⤵
  PID:6096
- C:\Windows\System\TMQhZim.exe
  C:\Windows\System\TMQhZim.exe
  2⤵
  PID:6112
- C:\Windows\System\ZfCjWyw.exe
  C:\Windows\System\ZfCjWyw.exe
  2⤵
  PID:6128
- C:\Windows\System\NVeYwva.exe
  C:\Windows\System\NVeYwva.exe
  2⤵
  PID:5104
- C:\Windows\System\cbwzTuM.exe
  C:\Windows\System\cbwzTuM.exe
  2⤵
  PID:5124
- C:\Windows\System\dSvCCPG.exe
  C:\Windows\System\dSvCCPG.exe
  2⤵
  PID:5156
- C:\Windows\System\obsOkoq.exe
  C:\Windows\System\obsOkoq.exe
  2⤵
  PID:5216
- C:\Windows\System\CbBZawO.exe
  C:\Windows\System\CbBZawO.exe
  2⤵
  PID:5172
- C:\Windows\System\LbXNcLJ.exe
  C:\Windows\System\LbXNcLJ.exe
  2⤵
  PID:5252
- C:\Windows\System\PIUYpGH.exe
  C:\Windows\System\PIUYpGH.exe
  2⤵
  PID:5312
- C:\Windows\System\KVWFBDX.exe
  C:\Windows\System\KVWFBDX.exe
  2⤵
  PID:4356
- C:\Windows\System\yUSTOBK.exe
  C:\Windows\System\yUSTOBK.exe
  2⤵
  PID:5296
- C:\Windows\System\jZkVzZd.exe
  C:\Windows\System\jZkVzZd.exe
  2⤵
  PID:5384
- C:\Windows\System\EoTAynQ.exe
  C:\Windows\System\EoTAynQ.exe
  2⤵
  PID:5412
- C:\Windows\System\hXhOYXL.exe
  C:\Windows\System\hXhOYXL.exe
  2⤵
  PID:5448
- C:\Windows\System\WaWadzg.exe
  C:\Windows\System\WaWadzg.exe
  2⤵
  PID:5464
- C:\Windows\System\ETbvKib.exe
  C:\Windows\System\ETbvKib.exe
  2⤵
  PID:5508
- C:\Windows\System\SMQTaaH.exe
  C:\Windows\System\SMQTaaH.exe
  2⤵
  PID:5540
- C:\Windows\System\HWyPwNS.exe
  C:\Windows\System\HWyPwNS.exe
  2⤵
  PID:5556
- C:\Windows\System\JeBOkXT.exe
  C:\Windows\System\JeBOkXT.exe
  2⤵
  PID:5608
- C:\Windows\System\KMSmokG.exe
  C:\Windows\System\KMSmokG.exe
  2⤵
  PID:5620
- C:\Windows\System\SCZOWSW.exe
  C:\Windows\System\SCZOWSW.exe
  2⤵
  PID:5668
- C:\Windows\System\OngdGRt.exe
  C:\Windows\System\OngdGRt.exe
  2⤵
  PID:5684
- C:\Windows\System\fdCNhtm.exe
  C:\Windows\System\fdCNhtm.exe
  2⤵
  PID:5720
- C:\Windows\System\rUvhHZH.exe
  C:\Windows\System\rUvhHZH.exe
  2⤵
  PID:5752
- C:\Windows\System\AgwDGqI.exe
  C:\Windows\System\AgwDGqI.exe
  2⤵
  PID:5796
- C:\Windows\System\pUZuwiR.exe
  C:\Windows\System\pUZuwiR.exe
  2⤵
  PID:5828
- C:\Windows\System\pCVMAYD.exe
  C:\Windows\System\pCVMAYD.exe
  2⤵
  PID:5848
- C:\Windows\System\KFprsEl.exe
  C:\Windows\System\KFprsEl.exe
  2⤵
  PID:5880
- C:\Windows\System\NAfXpBs.exe
  C:\Windows\System\NAfXpBs.exe
  2⤵
  PID:5912
- C:\Windows\System\HOiSkIF.exe
  C:\Windows\System\HOiSkIF.exe
  2⤵
  PID:5944
- C:\Windows\System\cEncToa.exe
  C:\Windows\System\cEncToa.exe
  2⤵
  PID:5992
- C:\Windows\System\LvhDYVs.exe
  C:\Windows\System\LvhDYVs.exe
  2⤵
  PID:6004
- C:\Windows\System\ZAtMrkM.exe
  C:\Windows\System\ZAtMrkM.exe
  2⤵
  PID:4416
- C:\Windows\System\gfINjTi.exe
  C:\Windows\System\gfINjTi.exe
  2⤵
  PID:6088
- C:\Windows\System\bBFJHEX.exe
  C:\Windows\System\bBFJHEX.exe
  2⤵
  PID:6124
- C:\Windows\System\JXToxFK.exe
  C:\Windows\System\JXToxFK.exe
  2⤵
  PID:6136
- C:\Windows\System\AVZryQM.exe
  C:\Windows\System\AVZryQM.exe
  2⤵
  PID:5136
- C:\Windows\System\QVXFHsg.exe
  C:\Windows\System\QVXFHsg.exe
  2⤵
  PID:5236
- C:\Windows\System\IdBvISZ.exe
  C:\Windows\System\IdBvISZ.exe
  2⤵
  PID:5264
- C:\Windows\System\hpBxwPL.exe
  C:\Windows\System\hpBxwPL.exe
  2⤵
  PID:5376
- C:\Windows\System\xcXKWjg.exe
  C:\Windows\System\xcXKWjg.exe
  2⤵
  PID:5444
- C:\Windows\System\zgojrke.exe
  C:\Windows\System\zgojrke.exe
  2⤵
  PID:3032
- C:\Windows\System\sIfiozX.exe
  C:\Windows\System\sIfiozX.exe
  2⤵
  PID:5332
- C:\Windows\System\iJJHKbm.exe
  C:\Windows\System\iJJHKbm.exe
  2⤵
  PID:5396
- C:\Windows\System\lZBbPEE.exe
  C:\Windows\System\lZBbPEE.exe
  2⤵
  PID:5636
- C:\Windows\System\tBsFFgw.exe
  C:\Windows\System\tBsFFgw.exe
  2⤵
  PID:5768
- C:\Windows\System\Estgjwo.exe
  C:\Windows\System\Estgjwo.exe
  2⤵
  PID:5896
- C:\Windows\System\YmKRRBl.exe
  C:\Windows\System\YmKRRBl.exe
  2⤵
  PID:5940
- C:\Windows\System\mRexxBN.exe
  C:\Windows\System\mRexxBN.exe
  2⤵
  PID:6076
- C:\Windows\System\sPevzKc.exe
  C:\Windows\System\sPevzKc.exe
  2⤵
  PID:6024
- C:\Windows\System\KOKWwTk.exe
  C:\Windows\System\KOKWwTk.exe
  2⤵
  PID:5204
- C:\Windows\System\VxzVkHQ.exe
  C:\Windows\System\VxzVkHQ.exe
  2⤵
  PID:5152
- C:\Windows\System\JkoGVxe.exe
  C:\Windows\System\JkoGVxe.exe
  2⤵
  PID:6108
- C:\Windows\System\KHyVTWg.exe
  C:\Windows\System\KHyVTWg.exe
  2⤵
  PID:6168
- C:\Windows\System\CSGazhU.exe
  C:\Windows\System\CSGazhU.exe
  2⤵
  PID:6184
- C:\Windows\System\bsZCNyf.exe
  C:\Windows\System\bsZCNyf.exe
  2⤵
  PID:6216
- C:\Windows\System\nXPNMZE.exe
  C:\Windows\System\nXPNMZE.exe
  2⤵
  PID:6232
- C:\Windows\System\CwnZSyu.exe
  C:\Windows\System\CwnZSyu.exe
  2⤵
  PID:6252
- C:\Windows\System\UBaBAYC.exe
  C:\Windows\System\UBaBAYC.exe
  2⤵
  PID:6280
- C:\Windows\System\MEZGuAv.exe
  C:\Windows\System\MEZGuAv.exe
  2⤵
  PID:6296
- C:\Windows\System\isWXlEI.exe
  C:\Windows\System\isWXlEI.exe
  2⤵
  PID:6320
- C:\Windows\System\bQPYawu.exe
  C:\Windows\System\bQPYawu.exe
  2⤵
  PID:6336
- C:\Windows\System\SyVniNP.exe
  C:\Windows\System\SyVniNP.exe
  2⤵
  PID:6352
- C:\Windows\System\vIiCctD.exe
  C:\Windows\System\vIiCctD.exe
  2⤵
  PID:6484
- C:\Windows\System\kgVeaBq.exe
  C:\Windows\System\kgVeaBq.exe
  2⤵
  PID:6556
- C:\Windows\System\zjxCcHI.exe
  C:\Windows\System\zjxCcHI.exe
  2⤵
  PID:6584
- C:\Windows\System\vMTCKKi.exe
  C:\Windows\System\vMTCKKi.exe
  2⤵
  PID:6620
- C:\Windows\System\xaXtVBR.exe
  C:\Windows\System\xaXtVBR.exe
  2⤵
  PID:6676
- C:\Windows\System\aZtMtPg.exe
  C:\Windows\System\aZtMtPg.exe
  2⤵
  PID:6744
- C:\Windows\System\tuaxPRy.exe
  C:\Windows\System\tuaxPRy.exe
  2⤵
  PID:6784
- C:\Windows\System\WLhrvSl.exe
  C:\Windows\System\WLhrvSl.exe
  2⤵
  PID:6804
- C:\Windows\System\FHvcCOL.exe
  C:\Windows\System\FHvcCOL.exe
  2⤵
  PID:7152
- C:\Windows\System\dqrhqOg.exe
  C:\Windows\System\dqrhqOg.exe
  2⤵
  PID:5328
- C:\Windows\System\bvhaMfY.exe
  C:\Windows\System\bvhaMfY.exe
  2⤵
  PID:6060
- C:\Windows\System\PhZAttL.exe
  C:\Windows\System\PhZAttL.exe
  2⤵
  PID:6164
- C:\Windows\System\DblrVTa.exe
  C:\Windows\System\DblrVTa.exe
  2⤵
  PID:5576
- C:\Windows\System\eJJtLRz.exe
  C:\Windows\System\eJJtLRz.exe
  2⤵
  PID:6156
- C:\Windows\System\hZWIrik.exe
  C:\Windows\System\hZWIrik.exe
  2⤵
  PID:6204
- C:\Windows\System\hRKXhUS.exe
  C:\Windows\System\hRKXhUS.exe
  2⤵
  PID:6360
- C:\Windows\System\hpKuzTq.exe
  C:\Windows\System\hpKuzTq.exe
  2⤵
  PID:6240
- C:\Windows\System\BuKYUKx.exe
  C:\Windows\System\BuKYUKx.exe
  2⤵
  PID:6392
- C:\Windows\System\AGLTMTc.exe
  C:\Windows\System\AGLTMTc.exe
  2⤵
  PID:6400
- C:\Windows\System\JOvriuG.exe
  C:\Windows\System\JOvriuG.exe
  2⤵
  PID:6452
- C:\Windows\System\ZyUSVtW.exe
  C:\Windows\System\ZyUSVtW.exe
  2⤵
  PID:6552
- C:\Windows\System\XqqYdOu.exe
  C:\Windows\System\XqqYdOu.exe
  2⤵
  PID:6572
- C:\Windows\System\ODdQOCx.exe
  C:\Windows\System\ODdQOCx.exe
  2⤵
  PID:6608
- C:\Windows\System\aILURds.exe
  C:\Windows\System\aILURds.exe
  2⤵
  PID:6604
- C:\Windows\System\vEJTYfD.exe
  C:\Windows\System\vEJTYfD.exe
  2⤵
  PID:6644
- C:\Windows\System\BOVibsc.exe
  C:\Windows\System\BOVibsc.exe
  2⤵
  PID:6672
- C:\Windows\System\oRpsqOw.exe
  C:\Windows\System\oRpsqOw.exe
  2⤵
  PID:6796
- C:\Windows\System\LXibVym.exe
  C:\Windows\System\LXibVym.exe
  2⤵
  PID:6692
- C:\Windows\System\TzZLuUK.exe
  C:\Windows\System\TzZLuUK.exe
  2⤵
  PID:6736
- C:\Windows\System\IYlOrcY.exe
  C:\Windows\System\IYlOrcY.exe
  2⤵
  PID:6684
- C:\Windows\System\ptBDyWA.exe
  C:\Windows\System\ptBDyWA.exe
  2⤵
  PID:6768
- C:\Windows\System\MtsaJuS.exe
  C:\Windows\System\MtsaJuS.exe
  2⤵
  PID:6944
- C:\Windows\System\XYvmVyO.exe
  C:\Windows\System\XYvmVyO.exe
  2⤵
  PID:6968
- C:\Windows\System\EeWrOOO.exe
  C:\Windows\System\EeWrOOO.exe
  2⤵
  PID:7012
- C:\Windows\System\HnixNBZ.exe
  C:\Windows\System\HnixNBZ.exe
  2⤵
  PID:7044
- C:\Windows\System\LMbTGIl.exe
  C:\Windows\System\LMbTGIl.exe
  2⤵
  PID:7068
- C:\Windows\System\uawArSJ.exe
  C:\Windows\System\uawArSJ.exe
  2⤵
  PID:7084
- C:\Windows\System\XZivoCN.exe
  C:\Windows\System\XZivoCN.exe
  2⤵
  PID:7100
- C:\Windows\System\GWMhBXt.exe
  C:\Windows\System\GWMhBXt.exe
  2⤵
  PID:7116
- C:\Windows\System\ohXBGBE.exe
  C:\Windows\System\ohXBGBE.exe
  2⤵
  PID:6816
- C:\Windows\System\ykjEKmf.exe
  C:\Windows\System\ykjEKmf.exe
  2⤵
  PID:6200
- C:\Windows\System\zjVhEdE.exe
  C:\Windows\System\zjVhEdE.exe
  2⤵
  PID:7128
- C:\Windows\System\BlrfhvU.exe
  C:\Windows\System\BlrfhvU.exe
  2⤵
  PID:6212
- C:\Windows\System\mnGlsWO.exe
  C:\Windows\System\mnGlsWO.exe
  2⤵
  PID:5460
- C:\Windows\System\gpasnJE.exe
  C:\Windows\System\gpasnJE.exe
  2⤵
  PID:6244
- C:\Windows\System\qeYwTey.exe
  C:\Windows\System\qeYwTey.exe
  2⤵
  PID:6780
- C:\Windows\System\QrmAYkw.exe
  C:\Windows\System\QrmAYkw.exe
  2⤵
  PID:6756
- C:\Windows\System\BSxTxln.exe
  C:\Windows\System\BSxTxln.exe
  2⤵
  PID:6436
- C:\Windows\System\ZSAvolQ.exe
  C:\Windows\System\ZSAvolQ.exe
  2⤵
  PID:6728
- C:\Windows\System\DqVZzZw.exe
  C:\Windows\System\DqVZzZw.exe
  2⤵
  PID:6776
- C:\Windows\System\evZQwmt.exe
  C:\Windows\System\evZQwmt.exe
  2⤵
  PID:6840
- C:\Windows\System\VSRXSSt.exe
  C:\Windows\System\VSRXSSt.exe
  2⤵
  PID:6496
- C:\Windows\System\pHDmmpj.exe
  C:\Windows\System\pHDmmpj.exe
  2⤵
  PID:7140
- C:\Windows\System\eucuTQP.exe
  C:\Windows\System\eucuTQP.exe
  2⤵
  PID:6364
- C:\Windows\System\vNqJcdk.exe
  C:\Windows\System\vNqJcdk.exe
  2⤵
  PID:6228
- C:\Windows\System\YBCycyO.exe
  C:\Windows\System\YBCycyO.exe
  2⤵
  PID:6344
- C:\Windows\System\yHQESxK.exe
  C:\Windows\System\yHQESxK.exe
  2⤵
  PID:6704
- C:\Windows\System\fxHhKFv.exe
  C:\Windows\System\fxHhKFv.exe
  2⤵
  PID:6248
- C:\Windows\System\mTfyiau.exe
  C:\Windows\System\mTfyiau.exe
  2⤵
  PID:6892
- C:\Windows\System\HrJSqJq.exe
  C:\Windows\System\HrJSqJq.exe
  2⤵
  PID:6832
- C:\Windows\System\HMCBIcZ.exe
  C:\Windows\System\HMCBIcZ.exe
  2⤵
  PID:5524
- C:\Windows\System\HMdayTu.exe
  C:\Windows\System\HMdayTu.exe
  2⤵
  PID:6140
- C:\Windows\System\kaXNwLE.exe
  C:\Windows\System\kaXNwLE.exe
  2⤵
  PID:6872
- C:\Windows\System\USGnmCA.exe
  C:\Windows\System\USGnmCA.exe
  2⤵
  PID:6976
- C:\Windows\System\MaTfTpx.exe
  C:\Windows\System\MaTfTpx.exe
  2⤵
  PID:7060
- C:\Windows\System\YCvsfjx.exe
  C:\Windows\System\YCvsfjx.exe
  2⤵
  PID:6908
- C:\Windows\System\GAdTObJ.exe
  C:\Windows\System\GAdTObJ.exe
  2⤵
  PID:6920
- C:\Windows\System\yuawxyM.exe
  C:\Windows\System\yuawxyM.exe
  2⤵
  PID:6368
- C:\Windows\System\VhHXgII.exe
  C:\Windows\System\VhHXgII.exe
  2⤵
  PID:5560
- C:\Windows\System\FGNOpUR.exe
  C:\Windows\System\FGNOpUR.exe
  2⤵
  PID:5184
- C:\Windows\System\jEPznbP.exe
  C:\Windows\System\jEPznbP.exe
  2⤵
  PID:6512
- C:\Windows\System\eDYqJfP.exe
  C:\Windows\System\eDYqJfP.exe
  2⤵
  PID:6476
- C:\Windows\System\IhzjsCV.exe
  C:\Windows\System\IhzjsCV.exe
  2⤵
  PID:6656
- C:\Windows\System\OCzpRVr.exe
  C:\Windows\System\OCzpRVr.exe
  2⤵
  PID:7036
- C:\Windows\System\njURZFj.exe
  C:\Windows\System\njURZFj.exe
  2⤵
  PID:6716
- C:\Windows\System\mtERjSO.exe
  C:\Windows\System\mtERjSO.exe
  2⤵
  PID:7064
- C:\Windows\System\caeSlYt.exe
  C:\Windows\System\caeSlYt.exe
  2⤵
  PID:6792
- C:\Windows\System\GJVvjkL.exe
  C:\Windows\System\GJVvjkL.exe
  2⤵
  PID:6932
- C:\Windows\System\ymNrSKy.exe
  C:\Windows\System\ymNrSKy.exe
  2⤵
  PID:6800
- C:\Windows\System\wiWxysH.exe
  C:\Windows\System\wiWxysH.exe
  2⤵
  PID:6988
- C:\Windows\System\TnMKIyF.exe
  C:\Windows\System\TnMKIyF.exe
  2⤵
  PID:7040
- C:\Windows\System\YSBkkxO.exe
  C:\Windows\System\YSBkkxO.exe
  2⤵
  PID:6528
- C:\Windows\System\iSZCKBc.exe
  C:\Windows\System\iSZCKBc.exe
  2⤵
  PID:6956
- C:\Windows\System\epoxzhB.exe
  C:\Windows\System\epoxzhB.exe
  2⤵
  PID:6396
- C:\Windows\System\MNSNYhT.exe
  C:\Windows\System\MNSNYhT.exe
  2⤵
  PID:2956
- C:\Windows\System\WVxyhIr.exe
  C:\Windows\System\WVxyhIr.exe
  2⤵
  PID:6416
- C:\Windows\System\bLMGqwB.exe
  C:\Windows\System\bLMGqwB.exe
  2⤵
  PID:7164
- C:\Windows\System\pgxlyAZ.exe
  C:\Windows\System\pgxlyAZ.exe
  2⤵
  PID:6940
- C:\Windows\System\VQSlYHE.exe
  C:\Windows\System\VQSlYHE.exe
  2⤵
  PID:2368
- C:\Windows\System\NkfDVlK.exe
  C:\Windows\System\NkfDVlK.exe
  2⤵
  PID:6160
- C:\Windows\System\CDRfRJd.exe
  C:\Windows\System\CDRfRJd.exe
  2⤵
  PID:6824
- C:\Windows\System\jyomxqG.exe
  C:\Windows\System\jyomxqG.exe
  2⤵
  PID:6856
- C:\Windows\System\XHitekt.exe
  C:\Windows\System\XHitekt.exe
  2⤵
  PID:5592
- C:\Windows\System\sPxsgxw.exe
  C:\Windows\System\sPxsgxw.exe
  2⤵
  PID:6936
- C:\Windows\System\wHeVQSk.exe
  C:\Windows\System\wHeVQSk.exe
  2⤵
  PID:6272
- C:\Windows\System\FYldhLA.exe
  C:\Windows\System\FYldhLA.exe
  2⤵
  PID:6516
- C:\Windows\System\JDXNyxN.exe
  C:\Windows\System\JDXNyxN.exe
  2⤵
  PID:2620
- C:\Windows\System\SKMhGYK.exe
  C:\Windows\System\SKMhGYK.exe
  2⤵
  PID:5704
- C:\Windows\System\FJULULm.exe
  C:\Windows\System\FJULULm.exe
  2⤵
  PID:5528
- C:\Windows\System\lGraYsZ.exe
  C:\Windows\System\lGraYsZ.exe
  2⤵
  PID:7056
- C:\Windows\System\GfmGXWs.exe
  C:\Windows\System\GfmGXWs.exe
  2⤵
  PID:6480
- C:\Windows\System\PgWzFGP.exe
  C:\Windows\System\PgWzFGP.exe
  2⤵
  PID:5100
- C:\Windows\System\BZkimgG.exe
  C:\Windows\System\BZkimgG.exe
  2⤵
  PID:6380
- C:\Windows\System\vyNGBMO.exe
  C:\Windows\System\vyNGBMO.exe
  2⤵
  PID:6616
- C:\Windows\System\kKjbXnc.exe
  C:\Windows\System\kKjbXnc.exe
  2⤵
  PID:5716
- C:\Windows\System\kvTBAar.exe
  C:\Windows\System\kvTBAar.exe
  2⤵
  PID:6696
- C:\Windows\System\LcPpVpl.exe
  C:\Windows\System\LcPpVpl.exe
  2⤵
  PID:6592
- C:\Windows\System\xsjsMdE.exe
  C:\Windows\System\xsjsMdE.exe
  2⤵
  PID:2044
- C:\Windows\System\nLwSSZd.exe
  C:\Windows\System\nLwSSZd.exe
  2⤵
  PID:6312
- C:\Windows\System\ReqaDmg.exe
  C:\Windows\System\ReqaDmg.exe
  2⤵
  PID:6984
- C:\Windows\System\QreaLpU.exe
  C:\Windows\System\QreaLpU.exe
  2⤵
  PID:6548
- C:\Windows\System\tRthRRF.exe
  C:\Windows\System\tRthRRF.exe
  2⤵
  PID:6632
- C:\Windows\System\ApxsWek.exe
  C:\Windows\System\ApxsWek.exe
  2⤵
  PID:7188
- C:\Windows\System\gFUPufq.exe
  C:\Windows\System\gFUPufq.exe
  2⤵
  PID:7204
- C:\Windows\System\TbWAjGt.exe
  C:\Windows\System\TbWAjGt.exe
  2⤵
  PID:7220
- C:\Windows\System\xsDRzKS.exe
  C:\Windows\System\xsDRzKS.exe
  2⤵
  PID:7236
- C:\Windows\System\ITveiXw.exe
  C:\Windows\System\ITveiXw.exe
  2⤵
  PID:7252
- C:\Windows\System\mfmSAsI.exe
  C:\Windows\System\mfmSAsI.exe
  2⤵
  PID:7268
- C:\Windows\System\masOSeY.exe
  C:\Windows\System\masOSeY.exe
  2⤵
  PID:7284
- C:\Windows\System\DlChyLS.exe
  C:\Windows\System\DlChyLS.exe
  2⤵
  PID:7300
- C:\Windows\System\DCOyipV.exe
  C:\Windows\System\DCOyipV.exe
  2⤵
  PID:7316
- C:\Windows\System\fQLrlAU.exe
  C:\Windows\System\fQLrlAU.exe
  2⤵
  PID:7332
- C:\Windows\System\WQkxoxI.exe
  C:\Windows\System\WQkxoxI.exe
  2⤵
  PID:7348
- C:\Windows\System\cYnnwLS.exe
  C:\Windows\System\cYnnwLS.exe
  2⤵
  PID:7364
- C:\Windows\System\hmfyrcF.exe
  C:\Windows\System\hmfyrcF.exe
  2⤵
  PID:7380
- C:\Windows\System\qSeFbYw.exe
  C:\Windows\System\qSeFbYw.exe
  2⤵
  PID:7396
- C:\Windows\System\OLpfNTe.exe
  C:\Windows\System\OLpfNTe.exe
  2⤵
  PID:7412
- C:\Windows\System\WHsepLU.exe
  C:\Windows\System\WHsepLU.exe
  2⤵
  PID:7428
- C:\Windows\System\SjHYCaA.exe
  C:\Windows\System\SjHYCaA.exe
  2⤵
  PID:7444
- C:\Windows\System\FEFtDtr.exe
  C:\Windows\System\FEFtDtr.exe
  2⤵
  PID:7460
- C:\Windows\System\kKyGjeW.exe
  C:\Windows\System\kKyGjeW.exe
  2⤵
  PID:7476
- C:\Windows\System\HTXbPDF.exe
  C:\Windows\System\HTXbPDF.exe
  2⤵
  PID:7496
- C:\Windows\System\dGvyRFu.exe
  C:\Windows\System\dGvyRFu.exe
  2⤵
  PID:7512
- C:\Windows\System\qbYcgvQ.exe
  C:\Windows\System\qbYcgvQ.exe
  2⤵
  PID:7528
- C:\Windows\System\HpGleOl.exe
  C:\Windows\System\HpGleOl.exe
  2⤵
  PID:7544
- C:\Windows\System\xhNgpzc.exe
  C:\Windows\System\xhNgpzc.exe
  2⤵
  PID:7564
- C:\Windows\System\dTQiNHN.exe
  C:\Windows\System\dTQiNHN.exe
  2⤵
  PID:7580
- C:\Windows\System\Yekixgp.exe
  C:\Windows\System\Yekixgp.exe
  2⤵
  PID:7600
- C:\Windows\System\bgoTXTx.exe
  C:\Windows\System\bgoTXTx.exe
  2⤵
  PID:7616
- C:\Windows\System\yoAXpEV.exe
  C:\Windows\System\yoAXpEV.exe
  2⤵
  PID:7632
- C:\Windows\System\gyxEyEv.exe
  C:\Windows\System\gyxEyEv.exe
  2⤵
  PID:7716
- C:\Windows\System\fJNxvIM.exe
  C:\Windows\System\fJNxvIM.exe
  2⤵
  PID:7740
- C:\Windows\System\hqbiUwg.exe
  C:\Windows\System\hqbiUwg.exe
  2⤵
  PID:7756
- C:\Windows\System\SPDWQgy.exe
  C:\Windows\System\SPDWQgy.exe
  2⤵
  PID:7772
- C:\Windows\System\rPAdcBZ.exe
  C:\Windows\System\rPAdcBZ.exe
  2⤵
  PID:7788
- C:\Windows\System\WnZNWbd.exe
  C:\Windows\System\WnZNWbd.exe
  2⤵
  PID:7804
- C:\Windows\System\vPzzavA.exe
  C:\Windows\System\vPzzavA.exe
  2⤵
  PID:7820
- C:\Windows\System\ZDXOQuN.exe
  C:\Windows\System\ZDXOQuN.exe
  2⤵
  PID:7840
- C:\Windows\System\XVgeokk.exe
  C:\Windows\System\XVgeokk.exe
  2⤵
  PID:7856
- C:\Windows\System\GYPAcSR.exe
  C:\Windows\System\GYPAcSR.exe
  2⤵
  PID:7872
- C:\Windows\System\aGSkZLq.exe
  C:\Windows\System\aGSkZLq.exe
  2⤵
  PID:7896
- C:\Windows\System\rBodxKs.exe
  C:\Windows\System\rBodxKs.exe
  2⤵
  PID:7916
- C:\Windows\System\UiqswjB.exe
  C:\Windows\System\UiqswjB.exe
  2⤵
  PID:7932
- C:\Windows\System\tkuyZhK.exe
  C:\Windows\System\tkuyZhK.exe
  2⤵
  PID:7948
- C:\Windows\System\EKeNNEA.exe
  C:\Windows\System\EKeNNEA.exe
  2⤵
  PID:7964
- C:\Windows\System\VVCtxCG.exe
  C:\Windows\System\VVCtxCG.exe
  2⤵
  PID:7980
- C:\Windows\System\XnIOYju.exe
  C:\Windows\System\XnIOYju.exe
  2⤵
  PID:8004
- C:\Windows\System\uxQLUOt.exe
  C:\Windows\System\uxQLUOt.exe
  2⤵
  PID:8020
- C:\Windows\System\RghHdXx.exe
  C:\Windows\System\RghHdXx.exe
  2⤵
  PID:8036
- C:\Windows\System\dkneubp.exe
  C:\Windows\System\dkneubp.exe
  2⤵
  PID:8056
- C:\Windows\System\ANeFORY.exe
  C:\Windows\System\ANeFORY.exe
  2⤵
  PID:8072
- C:\Windows\System\MXqNVtA.exe
  C:\Windows\System\MXqNVtA.exe
  2⤵
  PID:8088
- C:\Windows\System\zcnQFEa.exe
  C:\Windows\System\zcnQFEa.exe
  2⤵
  PID:8104
- C:\Windows\System\UGyoiOB.exe
  C:\Windows\System\UGyoiOB.exe
  2⤵
  PID:8132
- C:\Windows\System\CwFmJZZ.exe
  C:\Windows\System\CwFmJZZ.exe
  2⤵
  PID:8148
- C:\Windows\System\AzQnKzW.exe
  C:\Windows\System\AzQnKzW.exe
  2⤵
  PID:8168
- C:\Windows\System\FEPWDNw.exe
  C:\Windows\System\FEPWDNw.exe
  2⤵
  PID:8184
- C:\Windows\System\esUNNyW.exe
  C:\Windows\System\esUNNyW.exe
  2⤵
  PID:6180
- C:\Windows\System\EXayIZu.exe
  C:\Windows\System\EXayIZu.exe
  2⤵
  PID:7176
- C:\Windows\System\BLqwRud.exe
  C:\Windows\System\BLqwRud.exe
  2⤵
  PID:7216
- C:\Windows\System\ZHPCCuA.exe
  C:\Windows\System\ZHPCCuA.exe
  2⤵
  PID:7308
- C:\Windows\System\ScvokKY.exe
  C:\Windows\System\ScvokKY.exe
  2⤵
  PID:7436
- C:\Windows\System\BFDHmlY.exe
  C:\Windows\System\BFDHmlY.exe
  2⤵
  PID:6224
- C:\Windows\System\tNyIfnz.exe
  C:\Windows\System\tNyIfnz.exe
  2⤵
  PID:5640
- C:\Windows\System\xTuVBjw.exe
  C:\Windows\System\xTuVBjw.exe
  2⤵
  PID:7000
- C:\Windows\System\JZmRXMu.exe
  C:\Windows\System\JZmRXMu.exe
  2⤵
  PID:6152
- C:\Windows\System\lTpJFUA.exe
  C:\Windows\System\lTpJFUA.exe
  2⤵
  PID:5656
- C:\Windows\System\sQPgyFi.exe
  C:\Windows\System\sQPgyFi.exe
  2⤵
  PID:2288
- C:\Windows\System\kVeGwYs.exe
  C:\Windows\System\kVeGwYs.exe
  2⤵
  PID:6880
- C:\Windows\System\rKQugnl.exe
  C:\Windows\System\rKQugnl.exe
  2⤵
  PID:7736
- C:\Windows\System\LrAsDYw.exe
  C:\Windows\System\LrAsDYw.exe
  2⤵
  PID:7800
- C:\Windows\System\vnXvZRC.exe
  C:\Windows\System\vnXvZRC.exe
  2⤵
  PID:7832
- C:\Windows\System\GHyinkV.exe
  C:\Windows\System\GHyinkV.exe
  2⤵
  PID:7784
- C:\Windows\System\BvTFeul.exe
  C:\Windows\System\BvTFeul.exe
  2⤵
  PID:7908
- C:\Windows\System\FwjtGig.exe
  C:\Windows\System\FwjtGig.exe
  2⤵
  PID:7852
- C:\Windows\System\LckHBNg.exe
  C:\Windows\System\LckHBNg.exe
  2⤵
  PID:7880
- C:\Windows\System\eidCUvx.exe
  C:\Windows\System\eidCUvx.exe
  2⤵
  PID:7944
- C:\Windows\System\ioYQKya.exe
  C:\Windows\System\ioYQKya.exe
  2⤵
  PID:7988
- C:\Windows\System\zxBhXOA.exe
  C:\Windows\System\zxBhXOA.exe
  2⤵
  PID:8016
- C:\Windows\System\PMWAoCw.exe
  C:\Windows\System\PMWAoCw.exe
  2⤵
  PID:8028
- C:\Windows\System\mMehGcJ.exe
  C:\Windows\System\mMehGcJ.exe
  2⤵
  PID:8084
- C:\Windows\System\ASyOpvy.exe
  C:\Windows\System\ASyOpvy.exe
  2⤵
  PID:8124
- C:\Windows\System\uXpKwgI.exe
  C:\Windows\System\uXpKwgI.exe
  2⤵
  PID:6668
- C:\Windows\System\RrMwQVL.exe
  C:\Windows\System\RrMwQVL.exe
  2⤵
  PID:7344
- C:\Windows\System\WlHgVxt.exe
  C:\Windows\System\WlHgVxt.exe
  2⤵
  PID:6688
- C:\Windows\System\BXYmlGs.exe
  C:\Windows\System\BXYmlGs.exe
  2⤵
  PID:5700
- C:\Windows\System\UUQrsmy.exe
  C:\Windows\System\UUQrsmy.exe
  2⤵
  PID:6492
- C:\Windows\System\lnCuzOL.exe
  C:\Windows\System\lnCuzOL.exe
  2⤵
  PID:5976
- C:\Windows\System\gdQYVCb.exe
  C:\Windows\System\gdQYVCb.exe
  2⤵
  PID:5780
- C:\Windows\System\wIGgCbX.exe
  C:\Windows\System\wIGgCbX.exe
  2⤵
  PID:6464
- C:\Windows\System\ovhtSFN.exe
  C:\Windows\System\ovhtSFN.exe
  2⤵
  PID:7768
- C:\Windows\System\oblyTtW.exe
  C:\Windows\System\oblyTtW.exe
  2⤵
  PID:8100
- C:\Windows\System\uGoubPa.exe
  C:\Windows\System\uGoubPa.exe
  2⤵
  PID:8200
- C:\Windows\System\sygEuzx.exe
  C:\Windows\System\sygEuzx.exe
  2⤵
  PID:8220
- C:\Windows\System\wvTsyck.exe
  C:\Windows\System\wvTsyck.exe
  2⤵
  PID:8240
- C:\Windows\System\mXiruWF.exe
  C:\Windows\System\mXiruWF.exe
  2⤵
  PID:8256
- C:\Windows\System\FCXhOKr.exe
  C:\Windows\System\FCXhOKr.exe
  2⤵
  PID:8272
- C:\Windows\System\vyIhBmY.exe
  C:\Windows\System\vyIhBmY.exe
  2⤵
  PID:8292
- C:\Windows\System\BXjpgie.exe
  C:\Windows\System\BXjpgie.exe
  2⤵
  PID:8308
- C:\Windows\System\UcBwGkL.exe
  C:\Windows\System\UcBwGkL.exe
  2⤵
  PID:8324
- C:\Windows\System\QuPyMXN.exe
  C:\Windows\System\QuPyMXN.exe
  2⤵
  PID:8340
- C:\Windows\System\OQhcdTd.exe
  C:\Windows\System\OQhcdTd.exe
  2⤵
  PID:8356
- C:\Windows\System\KmfUyPL.exe
  C:\Windows\System\KmfUyPL.exe
  2⤵
  PID:8372
- C:\Windows\System\IiPiGur.exe
  C:\Windows\System\IiPiGur.exe
  2⤵
  PID:8392
- C:\Windows\System\nYLLHsr.exe
  C:\Windows\System\nYLLHsr.exe
  2⤵
  PID:8408
- C:\Windows\System\lnXqSTS.exe
  C:\Windows\System\lnXqSTS.exe
  2⤵
  PID:8424
- C:\Windows\System\NkMKcpr.exe
  C:\Windows\System\NkMKcpr.exe
  2⤵
  PID:8440
- C:\Windows\System\xgtrOcm.exe
  C:\Windows\System\xgtrOcm.exe
  2⤵
  PID:8456
- C:\Windows\System\JiYFMxy.exe
  C:\Windows\System\JiYFMxy.exe
  2⤵
  PID:8472
- C:\Windows\System\gXKoAcv.exe
  C:\Windows\System\gXKoAcv.exe
  2⤵
  PID:8488
- C:\Windows\System\TxWIYFm.exe
  C:\Windows\System\TxWIYFm.exe
  2⤵
  PID:8504
- C:\Windows\System\pXhStJD.exe
  C:\Windows\System\pXhStJD.exe
  2⤵
  PID:8520
- C:\Windows\System\AgjBywi.exe
  C:\Windows\System\AgjBywi.exe
  2⤵
  PID:8536
- C:\Windows\System\gBqSxKI.exe
  C:\Windows\System\gBqSxKI.exe
  2⤵
  PID:8552
- C:\Windows\System\dvIAqKY.exe
  C:\Windows\System\dvIAqKY.exe
  2⤵
  PID:8568
- C:\Windows\System\qNGrgVy.exe
  C:\Windows\System\qNGrgVy.exe
  2⤵
  PID:8588
- C:\Windows\System\dTKGEkQ.exe
  C:\Windows\System\dTKGEkQ.exe
  2⤵
  PID:8604
- C:\Windows\System\paEXHdd.exe
  C:\Windows\System\paEXHdd.exe
  2⤵
  PID:8620
- C:\Windows\System\RmochDl.exe
  C:\Windows\System\RmochDl.exe
  2⤵
  PID:8636
- C:\Windows\System\AodwKZy.exe
  C:\Windows\System\AodwKZy.exe
  2⤵
  PID:8652
- C:\Windows\System\cKYfIUq.exe
  C:\Windows\System\cKYfIUq.exe
  2⤵
  PID:8668
- C:\Windows\System\BYDGPTs.exe
  C:\Windows\System\BYDGPTs.exe
  2⤵
  PID:8684
- C:\Windows\System\xzgGdrA.exe
  C:\Windows\System\xzgGdrA.exe
  2⤵
  PID:8700
- C:\Windows\System\NxipLlV.exe
  C:\Windows\System\NxipLlV.exe
  2⤵
  PID:8716
- C:\Windows\System\uMbAsiq.exe
  C:\Windows\System\uMbAsiq.exe
  2⤵
  PID:8732
- C:\Windows\System\psiXrIY.exe
  C:\Windows\System\psiXrIY.exe
  2⤵
  PID:8748
- C:\Windows\System\GJqOMEO.exe
  C:\Windows\System\GJqOMEO.exe
  2⤵
  PID:8768
- C:\Windows\System\jLlGuhX.exe
  C:\Windows\System\jLlGuhX.exe
  2⤵
  PID:8784
- C:\Windows\System\UWoojKe.exe
  C:\Windows\System\UWoojKe.exe
  2⤵
  PID:8800
- C:\Windows\System\cKofWOF.exe
  C:\Windows\System\cKofWOF.exe
  2⤵
  PID:8820
- C:\Windows\System\vQjzWbB.exe
  C:\Windows\System\vQjzWbB.exe
  2⤵
  PID:8840
- C:\Windows\System\LcseQyR.exe
  C:\Windows\System\LcseQyR.exe
  2⤵
  PID:8856
- C:\Windows\System\ZkQSmyN.exe
  C:\Windows\System\ZkQSmyN.exe
  2⤵
  PID:8876
- C:\Windows\System\zLLcQJj.exe
  C:\Windows\System\zLLcQJj.exe
  2⤵
  PID:8892
- C:\Windows\System\lhOoSEy.exe
  C:\Windows\System\lhOoSEy.exe
  2⤵
  PID:8928
- C:\Windows\System\KjPvJoZ.exe
  C:\Windows\System\KjPvJoZ.exe
  2⤵
  PID:8948
- C:\Windows\System\LuObHLP.exe
  C:\Windows\System\LuObHLP.exe
  2⤵
  PID:8964
- C:\Windows\System\ylMwwNC.exe
  C:\Windows\System\ylMwwNC.exe
  2⤵
  PID:8980
- C:\Windows\System\dhbvdgR.exe
  C:\Windows\System\dhbvdgR.exe
  2⤵
  PID:9000
- C:\Windows\System\LFKGrWz.exe
  C:\Windows\System\LFKGrWz.exe
  2⤵
  PID:9016
- C:\Windows\System\ZQrVBwV.exe
  C:\Windows\System\ZQrVBwV.exe
  2⤵
  PID:9032
- C:\Windows\System\KYnaHmD.exe
  C:\Windows\System\KYnaHmD.exe
  2⤵
  PID:9052
- C:\Windows\System\IpvaSwl.exe
  C:\Windows\System\IpvaSwl.exe
  2⤵
  PID:9068
- C:\Windows\System\ptJfsSH.exe
  C:\Windows\System\ptJfsSH.exe
  2⤵
  PID:9088
- C:\Windows\System\QAJDnnQ.exe
  C:\Windows\System\QAJDnnQ.exe
  2⤵
  PID:9104
- C:\Windows\System\lxpRqGP.exe
  C:\Windows\System\lxpRqGP.exe
  2⤵
  PID:9120
- C:\Windows\System\QSKfVUE.exe
  C:\Windows\System\QSKfVUE.exe
  2⤵
  PID:9136
- C:\Windows\System\McPtyhi.exe
  C:\Windows\System\McPtyhi.exe
  2⤵
  PID:9156
- C:\Windows\System\zqsDIKn.exe
  C:\Windows\System\zqsDIKn.exe
  2⤵
  PID:9172
- C:\Windows\System\Nrvoqpq.exe
  C:\Windows\System\Nrvoqpq.exe
  2⤵
  PID:9188
- C:\Windows\System\IPSKUut.exe
  C:\Windows\System\IPSKUut.exe
  2⤵
  PID:9208
- C:\Windows\System\RqCYNvv.exe
  C:\Windows\System\RqCYNvv.exe
  2⤵
  PID:7892
- C:\Windows\System\vdQHPji.exe
  C:\Windows\System\vdQHPji.exe
  2⤵
  PID:6540
- C:\Windows\System\ekAPttJ.exe
  C:\Windows\System\ekAPttJ.exe
  2⤵
  PID:7864
- C:\Windows\System\cHcIKEZ.exe
  C:\Windows\System\cHcIKEZ.exe
  2⤵
  PID:7004
- C:\Windows\System\ZWfMuCd.exe
  C:\Windows\System\ZWfMuCd.exe
  2⤵
  PID:8232
- C:\Windows\System\ZtJQdPB.exe
  C:\Windows\System\ZtJQdPB.exe
  2⤵
  PID:7296
- C:\Windows\System\TrutzMt.exe
  C:\Windows\System\TrutzMt.exe
  2⤵
  PID:7360
- C:\Windows\System\furOSqv.exe
  C:\Windows\System\furOSqv.exe
  2⤵
  PID:8216
- C:\Windows\System\PZbBlMv.exe
  C:\Windows\System\PZbBlMv.exe
  2⤵
  PID:7588
- C:\Windows\System\vwfEMan.exe
  C:\Windows\System\vwfEMan.exe
  2⤵
  PID:7552
- C:\Windows\System\AuWzvYc.exe
  C:\Windows\System\AuWzvYc.exe
  2⤵
  PID:7672
- C:\Windows\System\ciNAsrD.exe
  C:\Windows\System\ciNAsrD.exe
  2⤵
  PID:7572
- C:\Windows\System\ablCPlT.exe
  C:\Windows\System\ablCPlT.exe
  2⤵
  PID:7724
- C:\Windows\System\kJqPXyq.exe
  C:\Windows\System\kJqPXyq.exe
  2⤵
  PID:7676
- C:\Windows\System\FBqOVGC.exe
  C:\Windows\System\FBqOVGC.exe
  2⤵
  PID:7828
- C:\Windows\System\UEXVKYV.exe
  C:\Windows\System\UEXVKYV.exe
  2⤵
  PID:7884
- C:\Windows\System\UmuxIvG.exe
  C:\Windows\System\UmuxIvG.exe
  2⤵
  PID:7924
- C:\Windows\System\GpiyWxp.exe
  C:\Windows\System\GpiyWxp.exe
  2⤵
  PID:7212
- C:\Windows\System\WuPaIDr.exe
  C:\Windows\System\WuPaIDr.exe
  2⤵
  PID:6864
- C:\Windows\System\sIEgHTy.exe
  C:\Windows\System\sIEgHTy.exe
  2⤵
  PID:6904
- C:\Windows\System\YmhHRPk.exe
  C:\Windows\System\YmhHRPk.exe
  2⤵
  PID:8068
- C:\Windows\System\isOHkOD.exe
  C:\Windows\System\isOHkOD.exe
  2⤵
  PID:8252
- C:\Windows\System\RkNsTKI.exe
  C:\Windows\System\RkNsTKI.exe
  2⤵
  PID:8316
- C:\Windows\System\qvEcBLJ.exe
  C:\Windows\System\qvEcBLJ.exe
  2⤵
  PID:8384
- C:\Windows\System\qHFehJx.exe
  C:\Windows\System\qHFehJx.exe
  2⤵
  PID:8364
- C:\Windows\System\VHsfKPI.exe
  C:\Windows\System\VHsfKPI.exe
  2⤵
  PID:8304
- C:\Windows\System\jHBcdRS.exe
  C:\Windows\System\jHBcdRS.exe
  2⤵
  PID:8480
- C:\Windows\System\gwUQCEs.exe
  C:\Windows\System\gwUQCEs.exe
  2⤵
  PID:8404
- C:\Windows\System\rYRvSgC.exe
  C:\Windows\System\rYRvSgC.exe
  2⤵
  PID:8548
- C:\Windows\System\mIyjtzp.exe
  C:\Windows\System\mIyjtzp.exe
  2⤵
  PID:8496
- C:\Windows\System\ENAeAxT.exe
  C:\Windows\System\ENAeAxT.exe
  2⤵
  PID:8436
- C:\Windows\System\wqAZqtX.exe
  C:\Windows\System\wqAZqtX.exe
  2⤵
  PID:8612
- C:\Windows\System\tNVEKkq.exe
  C:\Windows\System\tNVEKkq.exe
  2⤵
  PID:8648
- C:\Windows\System\MucUwcZ.exe
  C:\Windows\System\MucUwcZ.exe
  2⤵
  PID:8708
- C:\Windows\System\jwXRXHl.exe
  C:\Windows\System\jwXRXHl.exe
  2⤵
  PID:8664
- C:\Windows\System\ArMhBbj.exe
  C:\Windows\System\ArMhBbj.exe
  2⤵
  PID:8724
- C:\Windows\System\KluwcIn.exe
  C:\Windows\System\KluwcIn.exe
  2⤵
  PID:8756
- C:\Windows\System\naRphdX.exe
  C:\Windows\System\naRphdX.exe
  2⤵
  PID:8776
- C:\Windows\System\tTnXmfs.exe
  C:\Windows\System\tTnXmfs.exe
  2⤵
  PID:8832
- C:\Windows\System\jGOvkiu.exe
  C:\Windows\System\jGOvkiu.exe
  2⤵
  PID:9008
- C:\Windows\System\esPoRUf.exe
  C:\Windows\System\esPoRUf.exe
  2⤵
  PID:9044
- C:\Windows\System\VMcPcef.exe
  C:\Windows\System\VMcPcef.exe
  2⤵
  PID:8960
- C:\Windows\System\PArUbfn.exe
  C:\Windows\System\PArUbfn.exe
  2⤵
  PID:9084
- C:\Windows\System\DxAxAnb.exe
  C:\Windows\System\DxAxAnb.exe
  2⤵
  PID:9112
- C:\Windows\System\DeFLEin.exe
  C:\Windows\System\DeFLEin.exe
  2⤵
  PID:9152
- C:\Windows\System\JcSZCbU.exe
  C:\Windows\System\JcSZCbU.exe
  2⤵
  PID:9100
- C:\Windows\System\IjJyoln.exe
  C:\Windows\System\IjJyoln.exe
  2⤵
  PID:9168
- C:\Windows\System\HsgyWbT.exe
  C:\Windows\System\HsgyWbT.exe
  2⤵
  PID:6424
- C:\Windows\System\mRJjNrQ.exe
  C:\Windows\System\mRJjNrQ.exe
  2⤵
  PID:7712
- C:\Windows\System\jpYgTzV.exe
  C:\Windows\System\jpYgTzV.exe
  2⤵
  PID:8196
- C:\Windows\System\wJjVnrS.exe
  C:\Windows\System\wJjVnrS.exe
  2⤵
  PID:7484
- C:\Windows\System\iNJxAjq.exe
  C:\Windows\System\iNJxAjq.exe
  2⤵
  PID:8080
- C:\Windows\System\mocSbao.exe
  C:\Windows\System\mocSbao.exe
  2⤵
  PID:7612
- C:\Windows\System\YAJeMkn.exe
  C:\Windows\System\YAJeMkn.exe
  2⤵
  PID:7700
- C:\Windows\System\IKRDUvZ.exe
  C:\Windows\System\IKRDUvZ.exe
  2⤵
  PID:7492
- C:\Windows\System\JaKyhhV.exe
  C:\Windows\System\JaKyhhV.exe
  2⤵
  PID:7960
- C:\Windows\System\xBWWzqM.exe
  C:\Windows\System\xBWWzqM.exe
  2⤵
  PID:7640
- C:\Windows\System\PukxXCo.exe
  C:\Windows\System\PukxXCo.exe
  2⤵
  PID:8064
- C:\Windows\System\WqJipAr.exe
  C:\Windows\System\WqJipAr.exe
  2⤵
  PID:7200
- C:\Windows\System\IkGhbwB.exe
  C:\Windows\System\IkGhbwB.exe
  2⤵
  PID:8416
- C:\Windows\System\YuMgrrP.exe
  C:\Windows\System\YuMgrrP.exe
  2⤵
  PID:8332
- C:\Windows\System\oryViDT.exe
  C:\Windows\System\oryViDT.exe
  2⤵
  PID:8212
- C:\Windows\System\LGofzWi.exe
  C:\Windows\System\LGofzWi.exe
  2⤵
  PID:8564
- C:\Windows\System\ejYICFz.exe
  C:\Windows\System\ejYICFz.exe
  2⤵
  PID:8300
- C:\Windows\System\vclnvdn.exe
  C:\Windows\System\vclnvdn.exe
  2⤵
  PID:8828
- C:\Windows\System\MvYFtWN.exe
  C:\Windows\System\MvYFtWN.exe
  2⤵
  PID:8696
- C:\Windows\System\MRaTSLR.exe
  C:\Windows\System\MRaTSLR.exe
  2⤵
  PID:8500
- C:\Windows\System\qaSwSRO.exe
  C:\Windows\System\qaSwSRO.exe
  2⤵
  PID:8864
- C:\Windows\System\MGpMEer.exe
  C:\Windows\System\MGpMEer.exe
  2⤵
  PID:8580
- C:\Windows\System\EBiUwCP.exe
  C:\Windows\System\EBiUwCP.exe
  2⤵
  PID:8852
- C:\Windows\System\JTmXUlW.exe
  C:\Windows\System\JTmXUlW.exe
  2⤵
  PID:8888
- C:\Windows\System\KVHmlEt.exe
  C:\Windows\System\KVHmlEt.exe
  2⤵
  PID:8956
- C:\Windows\System\paaAEMe.exe
  C:\Windows\System\paaAEMe.exe
  2⤵
  PID:9096
- C:\Windows\System\TesnFzb.exe
  C:\Windows\System\TesnFzb.exe
  2⤵
  PID:6260
- C:\Windows\System\dnVumlg.exe
  C:\Windows\System\dnVumlg.exe
  2⤵
  PID:7660
- C:\Windows\System\BgxkPaJ.exe
  C:\Windows\System\BgxkPaJ.exe
  2⤵
  PID:7524
- C:\Windows\System\LLvphEW.exe
  C:\Windows\System\LLvphEW.exe
  2⤵
  PID:8924
- C:\Windows\System\gmPiTdk.exe
  C:\Windows\System\gmPiTdk.exe
  2⤵
  PID:9076
- C:\Windows\System\xUdAVuU.exe
  C:\Windows\System\xUdAVuU.exe
  2⤵
  PID:7816
- C:\Windows\System\mYgkXhB.exe
  C:\Windows\System\mYgkXhB.exe
  2⤵
  PID:7328
- C:\Windows\System\NaszSZa.exe
  C:\Windows\System\NaszSZa.exe
  2⤵
  PID:7376
- C:\Windows\System\ytMtsEv.exe
  C:\Windows\System\ytMtsEv.exe
  2⤵
  PID:8120
- C:\Windows\System\zakUwTW.exe
  C:\Windows\System\zakUwTW.exe
  2⤵
  PID:8336
- C:\Windows\System\gAcHmbx.exe
  C:\Windows\System\gAcHmbx.exe
  2⤵
  PID:8400
- C:\Windows\System\TRaUmtw.exe
  C:\Windows\System\TRaUmtw.exe
  2⤵
  PID:8900
- C:\Windows\System\jOwYxFj.exe
  C:\Windows\System\jOwYxFj.exe
  2⤵
  PID:8940
- C:\Windows\System\TsugVey.exe
  C:\Windows\System\TsugVey.exe
  2⤵
  PID:7912
- C:\Windows\System\NnELjDW.exe
  C:\Windows\System\NnELjDW.exe
  2⤵
  PID:8848
- C:\Windows\System\ZrEpUyk.exe
  C:\Windows\System\ZrEpUyk.exe
  2⤵
  PID:8180
- C:\Windows\System\TVQdCTS.exe
  C:\Windows\System\TVQdCTS.exe
  2⤵
  PID:8912
- C:\Windows\System\SClnDaf.exe
  C:\Windows\System\SClnDaf.exe
  2⤵
  PID:7668
- C:\Windows\System\kInQRnh.exe
  C:\Windows\System\kInQRnh.exe
  2⤵
  PID:7796
- C:\Windows\System\FpGVxuB.exe
  C:\Windows\System\FpGVxuB.exe
  2⤵
  PID:7392
- C:\Windows\System\baSiHaQ.exe
  C:\Windows\System\baSiHaQ.exe
  2⤵
  PID:8012
- C:\Windows\System\NgjpZHl.exe
  C:\Windows\System\NgjpZHl.exe
  2⤵
  PID:8764
- C:\Windows\System\PKRoUdE.exe
  C:\Windows\System\PKRoUdE.exe
  2⤵
  PID:7356
- C:\Windows\System\jkvBmEG.exe
  C:\Windows\System\jkvBmEG.exe
  2⤵
  PID:8992
- C:\Windows\System\tyrAwpB.exe
  C:\Windows\System\tyrAwpB.exe
  2⤵
  PID:9224
- C:\Windows\System\tOUfxGF.exe
  C:\Windows\System\tOUfxGF.exe
  2⤵
  PID:9240
- C:\Windows\System\lBPpVIv.exe
  C:\Windows\System\lBPpVIv.exe
  2⤵
  PID:9256
- C:\Windows\System\pVeVypg.exe
  C:\Windows\System\pVeVypg.exe
  2⤵
  PID:9272
- C:\Windows\System\AVeAbcy.exe
  C:\Windows\System\AVeAbcy.exe
  2⤵
  PID:9288
- C:\Windows\System\DNryELR.exe
  C:\Windows\System\DNryELR.exe
  2⤵
  PID:9308
- C:\Windows\System\sQWGBLd.exe
  C:\Windows\System\sQWGBLd.exe
  2⤵
  PID:9328
- C:\Windows\System\rdAzLoc.exe
  C:\Windows\System\rdAzLoc.exe
  2⤵
  PID:9348
- C:\Windows\System\sVLaVgm.exe
  C:\Windows\System\sVLaVgm.exe
  2⤵
  PID:9392
- C:\Windows\System\yQmSZEP.exe
  C:\Windows\System\yQmSZEP.exe
  2⤵
  PID:9408
- C:\Windows\System\VJAGVRJ.exe
  C:\Windows\System\VJAGVRJ.exe
  2⤵
  PID:9464
- C:\Windows\System\aEOlCFH.exe
  C:\Windows\System\aEOlCFH.exe
  2⤵
  PID:9496
- C:\Windows\System\FCtFDLe.exe
  C:\Windows\System\FCtFDLe.exe
  2⤵
  PID:9580
- C:\Windows\System\LWOUAZf.exe
  C:\Windows\System\LWOUAZf.exe
  2⤵
  PID:9632
- C:\Windows\System\IwvSouD.exe
  C:\Windows\System\IwvSouD.exe
  2⤵
  PID:9744
- C:\Windows\System\QzWMpQg.exe
  C:\Windows\System\QzWMpQg.exe
  2⤵
  PID:9760
- C:\Windows\System\jSFBjUE.exe
  C:\Windows\System\jSFBjUE.exe
  2⤵
  PID:9776
- C:\Windows\System\FOyvckE.exe
  C:\Windows\System\FOyvckE.exe
  2⤵
  PID:9808
- C:\Windows\System\xQNAnnX.exe
  C:\Windows\System\xQNAnnX.exe
  2⤵
  PID:9840
- C:\Windows\System\EfTZZac.exe
  C:\Windows\System\EfTZZac.exe
  2⤵
  PID:9856
- C:\Windows\System\KWoZMDc.exe
  C:\Windows\System\KWoZMDc.exe
  2⤵
  PID:9872
- C:\Windows\System\rEeRUaX.exe
  C:\Windows\System\rEeRUaX.exe
  2⤵
  PID:9892
- C:\Windows\System\qtOAnxM.exe
  C:\Windows\System\qtOAnxM.exe
  2⤵
  PID:9908
- C:\Windows\System\iYzaLfZ.exe
  C:\Windows\System\iYzaLfZ.exe
  2⤵
  PID:9932
- C:\Windows\System\gAIvfvt.exe
  C:\Windows\System\gAIvfvt.exe
  2⤵
  PID:9956
- C:\Windows\System\rwJVmFB.exe
  C:\Windows\System\rwJVmFB.exe
  2⤵
  PID:9976
- C:\Windows\System\pusrkSC.exe
  C:\Windows\System\pusrkSC.exe
  2⤵
  PID:10096
- C:\Windows\System\etsFBFj.exe
  C:\Windows\System\etsFBFj.exe
  2⤵
  PID:10116
- C:\Windows\System\ZSFhEDK.exe
  C:\Windows\System\ZSFhEDK.exe
  2⤵
  PID:10160
- C:\Windows\System\GjEGfca.exe
  C:\Windows\System\GjEGfca.exe
  2⤵
  PID:10196
- C:\Windows\System\lMHkhvr.exe
  C:\Windows\System\lMHkhvr.exe
  2⤵
  PID:10212
- C:\Windows\System\qtPiQbA.exe
  C:\Windows\System\qtPiQbA.exe
  2⤵
  PID:10228
- C:\Windows\System\mtmoLlp.exe
  C:\Windows\System\mtmoLlp.exe
  2⤵
  PID:9236
- C:\Windows\System\ezRBQEB.exe
  C:\Windows\System\ezRBQEB.exe
  2⤵
  PID:9028
- C:\Windows\System\FsebGyY.exe
  C:\Windows\System\FsebGyY.exe
  2⤵
  PID:8628
- C:\Windows\System\Aedrudo.exe
  C:\Windows\System\Aedrudo.exe
  2⤵
  PID:8284
- C:\Windows\System\OvBVlks.exe
  C:\Windows\System\OvBVlks.exe
  2⤵
  PID:9304
- C:\Windows\System\PHqNsIv.exe
  C:\Windows\System\PHqNsIv.exe
  2⤵
  PID:9248
- C:\Windows\System\hussost.exe
  C:\Windows\System\hussost.exe
  2⤵
  PID:8348
- C:\Windows\System\VGYymEd.exe
  C:\Windows\System\VGYymEd.exe
  2⤵
  PID:8528
- C:\Windows\System\cGJWqts.exe
  C:\Windows\System\cGJWqts.exe
  2⤵
  PID:8644
- C:\Windows\System\uhkPzFJ.exe
  C:\Windows\System\uhkPzFJ.exe
  2⤵
  PID:7124
- C:\Windows\System\jqUASiU.exe
  C:\Windows\System\jqUASiU.exe
  2⤵
  PID:8872
- C:\Windows\System\jJgPOzM.exe
  C:\Windows\System\jJgPOzM.exe
  2⤵
  PID:9220
- C:\Windows\System\HUsAyWO.exe
  C:\Windows\System\HUsAyWO.exe
  2⤵
  PID:9588
- C:\Windows\System\evHikvH.exe
  C:\Windows\System\evHikvH.exe
  2⤵
  PID:9488
- C:\Windows\System\DUlialI.exe
  C:\Windows\System\DUlialI.exe
  2⤵
  PID:9600
- C:\Windows\System\AhQGAEW.exe
  C:\Windows\System\AhQGAEW.exe
  2⤵
  PID:9616
- C:\Windows\System\IthQdIf.exe
  C:\Windows\System\IthQdIf.exe
  2⤵
  PID:9284
- C:\Windows\System\QMtQmhw.exe
  C:\Windows\System\QMtQmhw.exe
  2⤵
  PID:9368
- C:\Windows\System\CjqdEcB.exe
  C:\Windows\System\CjqdEcB.exe
  2⤵
  PID:9420
- C:\Windows\System\JdTUAlT.exe
  C:\Windows\System\JdTUAlT.exe
  2⤵
  PID:9444
- C:\Windows\System\DGAqhUN.exe
  C:\Windows\System\DGAqhUN.exe
  2⤵
  PID:9460
- C:\Windows\System\bLunsPh.exe
  C:\Windows\System\bLunsPh.exe
  2⤵
  PID:9568
- C:\Windows\System\UMEskOu.exe
  C:\Windows\System\UMEskOu.exe
  2⤵
  PID:9548
- C:\Windows\System\daeEnkf.exe
  C:\Windows\System\daeEnkf.exe
  2⤵
  PID:9852
- C:\Windows\System\KLuDCVN.exe
  C:\Windows\System\KLuDCVN.exe
  2⤵
  PID:9688
- C:\Windows\System\oWpVXjn.exe
  C:\Windows\System\oWpVXjn.exe
  2⤵
  PID:9728
- C:\Windows\System\iTNQLnL.exe
  C:\Windows\System\iTNQLnL.exe
  2⤵
  PID:9692
- C:\Windows\System\JSbZykm.exe
  C:\Windows\System\JSbZykm.exe
  2⤵
  PID:9724
- C:\Windows\System\jJYjyLL.exe
  C:\Windows\System\jJYjyLL.exe
  2⤵
  PID:9772
- C:\Windows\System\TNcsetH.exe
  C:\Windows\System\TNcsetH.exe
  2⤵
  PID:9828
- C:\Windows\System\NUWsRdY.exe
  C:\Windows\System\NUWsRdY.exe
  2⤵
  PID:9868
- C:\Windows\System\gjIZdiU.exe
  C:\Windows\System\gjIZdiU.exe
  2⤵
  PID:9928
- C:\Windows\System\MGQRnzp.exe
  C:\Windows\System\MGQRnzp.exe
  2⤵
  PID:9972
- C:\Windows\System\rIaCcsM.exe
  C:\Windows\System\rIaCcsM.exe
  2⤵
  PID:9948
- C:\Windows\System\bfFwcWD.exe
  C:\Windows\System\bfFwcWD.exe
  2⤵
  PID:8600
- C:\Windows\System\VmIRSuw.exe
  C:\Windows\System\VmIRSuw.exe
  2⤵
  PID:10008
- C:\Windows\System\oVZZzpc.exe
  C:\Windows\System\oVZZzpc.exe
  2⤵
  PID:10108
- C:\Windows\System\eiKmnIH.exe
  C:\Windows\System\eiKmnIH.exe
  2⤵
  PID:10172
- C:\Windows\System\JzHncbr.exe
  C:\Windows\System\JzHncbr.exe
  2⤵
  PID:10180
- C:\Windows\System\GgnRZdm.exe
  C:\Windows\System\GgnRZdm.exe
  2⤵
  PID:10156
- C:\Windows\System\QFhtKOx.exe
  C:\Windows\System\QFhtKOx.exe
  2⤵
  PID:10040
- C:\Windows\System\gRFGRLi.exe
  C:\Windows\System\gRFGRLi.exe
  2⤵
  PID:9268
- C:\Windows\System\IzioxTU.exe
  C:\Windows\System\IzioxTU.exe
  2⤵
  PID:10044
- C:\Windows\System\coJeBTO.exe
  C:\Windows\System\coJeBTO.exe
  2⤵
  PID:10064
- C:\Windows\System\soYfWOT.exe
  C:\Windows\System\soYfWOT.exe
  2⤵
  PID:10088
- C:\Windows\System\bwZCPfH.exe
  C:\Windows\System\bwZCPfH.exe
  2⤵
  PID:10136
- C:\Windows\System\BpyMwvd.exe
  C:\Windows\System\BpyMwvd.exe
  2⤵
  PID:10152
- C:\Windows\System\EniZoRw.exe
  C:\Windows\System\EniZoRw.exe
  2⤵
  PID:10236
- C:\Windows\System\uTlyeuf.exe
  C:\Windows\System\uTlyeuf.exe
  2⤵
  PID:9300
- C:\Windows\System\NclYrwJ.exe
  C:\Windows\System\NclYrwJ.exe
  2⤵
  PID:9356
- C:\Windows\System\yfFvedC.exe
  C:\Windows\System\yfFvedC.exe
  2⤵
  PID:10184
- C:\Windows\System\mIDuYIP.exe
  C:\Windows\System\mIDuYIP.exe
  2⤵
  PID:9376
- C:\Windows\System\AAsXGZr.exe
  C:\Windows\System\AAsXGZr.exe
  2⤵
  PID:9628
- C:\Windows\System\AxhnEVC.exe
  C:\Windows\System\AxhnEVC.exe
  2⤵
  PID:9536
- C:\Windows\System\aoazWAF.exe
  C:\Windows\System\aoazWAF.exe
  2⤵
  PID:9524
- C:\Windows\System\FnNFeiv.exe
  C:\Windows\System\FnNFeiv.exe
  2⤵
  PID:9572
- C:\Windows\System\ypcRvRu.exe
  C:\Windows\System\ypcRvRu.exe
  2⤵
  PID:9664
- C:\Windows\System\bjeKsFp.exe
  C:\Windows\System\bjeKsFp.exe
  2⤵
  PID:9540
- C:\Windows\System\TmpNUpI.exe
  C:\Windows\System\TmpNUpI.exe
  2⤵
  PID:9792
- C:\Windows\System\VFytkiy.exe
  C:\Windows\System\VFytkiy.exe
  2⤵
  PID:9848
- C:\Windows\System\RxpnBSL.exe
  C:\Windows\System\RxpnBSL.exe
  2⤵
  PID:9716
- C:\Windows\System\PsnxkOf.exe
  C:\Windows\System\PsnxkOf.exe
  2⤵
  PID:9344
- C:\Windows\System\vyXducW.exe
  C:\Windows\System\vyXducW.exe
  2⤵
  PID:10004
- C:\Windows\System\ryLUZLB.exe
  C:\Windows\System\ryLUZLB.exe
  2⤵
  PID:9836
- C:\Windows\System\iBGHImO.exe
  C:\Windows\System\iBGHImO.exe
  2⤵
  PID:9984
- C:\Windows\System\cOtCYsW.exe
  C:\Windows\System\cOtCYsW.exe
  2⤵
  PID:9920
- C:\Windows\System\fJBDRFG.exe
  C:\Windows\System\fJBDRFG.exe
  2⤵
  PID:10012
- C:\Windows\System\HoAjvnr.exe
  C:\Windows\System\HoAjvnr.exe
  2⤵
  PID:10072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CwZwQDo.exe

Filesize
1.9MB

MD5
ea1c7ad802b2751e5eb6b10eeaf03ac7

SHA1
77e900dd2f18ad26f77465bf708b20a59fda937f

SHA256
eaa627968cf933ff7eb19300bc37f23d1050bb8d09bf0c8053a28719b7e984c8

SHA512
6d8667e05400014d74540a2de57935a630045daebb0476b3a8b855f811b759c57c567b5bb849614ba29a9e1559b469e04039095e5ecaa6e3e505f4b4334596b0

Download Submit
C:\Windows\system\DGamKOu.exe

Filesize
1.9MB

MD5
fd685ea098d129b6ed10d87a5a5e3c9e

SHA1
19d6f9e9a84a2d8242e982a00c39b6192f013f2e

SHA256
3c86115838432302123e2cf10a563892d6a2c13d83c046fc8e9a681ddc68a74c

SHA512
b6d15303892ed464ec792348c87b14deeaedfaa55ed1d1d590fcb998301a656510ae3d4035a78174343a09ef5ab908ffc038662f4b7849f4f23349066d026092

Download Submit
C:\Windows\system\EhXBtZV.exe

Filesize
1.9MB

MD5
668ab32d80d71f194ceb264c056a185e

SHA1
8e5f7162679456d697fe042b0355fd2600535398

SHA256
68812cf6e5f15a8a173398d96a4aa30d53780fa865940979c119d8b5f816f8ae

SHA512
e4be0309bdae4f76d64350d58d6cead2e959b041455b015a0d4b25cd9699a0178f8aa64d3f33f6faf65d0ece09c8ccb89806b3bb0a9b19b0c7a0421adcc6ac9f

Download Submit
C:\Windows\system\ExBuhLB.exe

Filesize
1.9MB

MD5
453822cbe5f838410fcb259dd3dbe942

SHA1
3991a7d25179c02f26da577bed9e136c19f0d7df

SHA256
20a394a5e53611a7f62611777b823e1622adacd37b6fe28ad1cfffd986b40c7d

SHA512
99d59ab0ddb8c8b3f013949590bc4e9067c9c5037977c1fca58aacb83af5638b50f16b66a50537dcd66354bbd83a65d482df791a9e521a551242e2d6383013c9

Download Submit
C:\Windows\system\FZVAooL.exe

Filesize
1.9MB

MD5
84164060f32e275cf949e8e33c5abeed

SHA1
4a39d9b6478cf224c59e41ae7416c5a8171320ff

SHA256
f0ab6f8dea9d4ef8d02a9a7fa14b5ef0f549a8dcb4386dd2ba8a7d2a8340f2c7

SHA512
f57471915cd90d5e12e80ed974f44a0fd28392fa0f2249c02475b98d2416cd1b7f2904a0bcbb9aab3b1286e649cf4cea8cf112f10a1812a713b9240fd0d1e47c

Download Submit
C:\Windows\system\IegsqLK.exe

Filesize
1.9MB

MD5
183840204df67ae1e6fd5666f8eee223

SHA1
7a1fe49ae537150ec74ce5f2903f4ac0cebd428e

SHA256
7bf8f2f90cafedf518c0afa84f4cb4d6f91cfe7bf1a58cffb49d025b7778fd65

SHA512
51ad14a16a458cc1b8762ca6f788e82d9898cce153b6d08d2edcc10d88cd7b58e3fa3f2160ba1fd2d024c7f58efc03ab2d996b0b2680f97579b45fe1003bfc5b

Download Submit
C:\Windows\system\IggTDVI.exe

Filesize
1.9MB

MD5
5750d78778d689112ad19771c50df77b

SHA1
7e0b084fb55ffa91a23852a85637d7f8fa5212be

SHA256
a6100d8421d805f981aa1047dc3c1226996085f80f21b75fe35898d857573827

SHA512
a6d31e5641b104e8542cf18cc15ab1c995a20d7474f84a95b3b347b459ce23ddb39dd9a574a01b6a508090031098bf872112bbd88697587b8e332101fff06c23

Download Submit
C:\Windows\system\IjzMXnW.exe

Filesize
1.9MB

MD5
d3d73ea3acfbbbd2f424663296dce989

SHA1
75013502a54e1dc73bc3ea8f431663aa13e1cd7d

SHA256
6249cbf5f9727942ececd2213f6cdee6e3bba11877226bd7ccb9e3b91b0dee21

SHA512
29ffb83cadd55ac282f961d9a5edb953d67e5ece90dc26d8ed2b76cc11c4de3e2ee6fd19b46324c82a83050735b7fa885c56698ac8b7212d826820adcdc3b64f

Download Submit
C:\Windows\system\IuDVhlO.exe

Filesize
1.9MB

MD5
7117617d149fae6edbd59a0982f28e83

SHA1
726c02845a7c8d180faa61d9857dd5494901268a

SHA256
9d69af323ebf875378d234dadb2f6c9d89317a5aa907eb4f5caad518cfa60793

SHA512
87d5c9f4e947d6c961220bd48ebf717a1b28c8e80dd54a6153d63157fe9c9ab673216cedf291b26d56b79372f7065070a9908e1d4d079e9bffd732faf05973cb

Download Submit
C:\Windows\system\JUJTMdC.exe

Filesize
1.9MB

MD5
357c550e477b66f5a81b482653684388

SHA1
aea273fadccae3083da5d4b1b4c257fdd8bca529

SHA256
111534faed634c2974d51f51479eca691d8b5798c1448142d642272ce0c7f396

SHA512
f88cc59022deac3cba5a057c90a38c751520d22c659f4d62136c837a49090ad33c13c2364d5e5dcc931903f1b73a9e0bab9397f52e14c6008cbe6655f824e67f

Download Submit
C:\Windows\system\LhqXsMv.exe

Filesize
1.9MB

MD5
a5a5d7e82f632a4cc4f05f6ee711d5f1

SHA1
c36fbaebe1329e55413e43fb0d9ac019de370822

SHA256
b77f2afe4601646cba4d5852b45c3734fa5a4d9ca4e48c14748f3e963ec75436

SHA512
5ef26f0d316c2f279032742802f20d3161b439f78036ef51b0f7c5308fae64d910514a058449b422f71105b26470757b7d3f7b5c976761d963785eeebf922718

Download Submit
C:\Windows\system\NTifZYS.exe

Filesize
1.9MB

MD5
ed6bb7b7dfe9da9ae643a394efcf139e

SHA1
da496f0d0f17d6aff10f5d384c0900308374f04a

SHA256
b940753e7c3fcc0fdf5276c2277c90dadbbc06e6e7f2053a2590d1c9026debdb

SHA512
b54289d0198873a3ef7f14e799661d94a8c7ee5b26138f5dea06c497c30cc63634c4474a85d8b1ef2f315ebea3eea0da4cdd4d63d8aa775fcd4f4e1f6db07226

Download Submit
C:\Windows\system\OZawVGO.exe

Filesize
1.9MB

MD5
03d2006b191962f92c32df3da48d27c3

SHA1
0cba72b02013b26abed4586ee50ed09725975d53

SHA256
d4890b4f8a53809d635b903f00129fb87e5e9a693ff392e8ffbe9ff74bd8f049

SHA512
d5a25d38978c621781cf40b92ed05d06c73298a6d9d54005f144e1bdbb4bf2ee0636a861860cebecf9379187c14b6e131afb807683c4343169f1bb0e1a2bb0b6

Download Submit
C:\Windows\system\QPLekch.exe

Filesize
1.9MB

MD5
2493f35fb31bbe99c9cb330f0e8ba4c7

SHA1
c4865f2d85d33431022769c5d16c77a9aff4f1a3

SHA256
e8f3bbf29771e86faeee93c0189e2a5180f5280f2fa73171d8fcefcc1cdb0b2d

SHA512
1031a321ee621db3af6bf93ecf0d24214cca7f79f713c1cff19b1dae11c68ba2be568a968f8e636eaf0fb5d11698e60fc14ec09360516306fc0cace266b3be52

Download Submit
C:\Windows\system\UCZGJsX.exe

Filesize
1.9MB

MD5
0c5aa73d349d5e96c1956f4d8f567bed

SHA1
2d4162cee0722fd48f81b31781510282ef0fafe4

SHA256
0ec64b79022999c1113dbc8fc3afbb233ec216f97a3562225924ab5338b2b274

SHA512
f7d6675902663cecfd779220cb18f0f40f7d58e253c94e4af590793b5c30d4dd0b4dc82b59724446e4094595e3d0090a8ef745467613499c54af36d808b54598

Download Submit
C:\Windows\system\ULGTAKK.exe

Filesize
1.9MB

MD5
0e1b422396c8d6f6a0227c9ff9d8bfa8

SHA1
82caa599fccaea81a5ebfd27036ab89939ff6ef4

SHA256
997370cdaa012fdd6f1ed2f8f8f208c035fb529a47f8989b9207031cadb2e388

SHA512
d04cf890a0909fd26a524c3046adbd280d7f53030ca2dbf8c6a3f867eb92c6f6ea13c5ce8701e42c2071af3c46abb827dac6842fd9e7844eab8b2e45a7ae2541

Download Submit
C:\Windows\system\VJTsqyV.exe

Filesize
1.9MB

MD5
6e7e76cd2677bfdd995f2a5d650a56f2

SHA1
34808bca3b389545befc419718e69fd0e6845bbe

SHA256
c743ca020026a8aa3c5c907195f1e728caeb63fdfd7fa7e0371092d284c92bcf

SHA512
deecc1e3fb5993ff120362f2f7348068c770db47edf473f0591a45fe5d8389f8b4a48fa009abef813b40292a1cd9d47c6d05109164471b7a11b029b45b0e9196

Download Submit
C:\Windows\system\YwKjxGd.exe

Filesize
1.9MB

MD5
379e07d3df538e00ab94cf202be40070

SHA1
d870de1e6840ba131af78813babd57fbc173a5de

SHA256
add7921f71f5d93be864c6c77463b8c8002486b925aef3dde0d5a76db46a8a42

SHA512
c3525273d999fcc27a535205fd0e67011babd0cdf5af27c7b98e35ebc15a923075297b6d200b5cf8b738f835e4a32a133bbe14f23869d15b8d503ef1bf0abe9f

Download Submit
C:\Windows\system\aduCeJi.exe

Filesize
1.9MB

MD5
627f394e8c275fa9fcc6fb30ff680abb

SHA1
dc665035f73bf376a9657abcd0396b1f3b5f2d57

SHA256
17943b8b346f19dce6e5fec4cd1a3beb1fa91e803e1af2c9895936c91780936b

SHA512
629b76d42577a9514ab1f36dafd29263e2cb5de7c428e3dd3c7206f023196fdb418ff26a8ce5cdc7c20fbe9b1730cc8a14e9d0e82adecb3b9d6a0db4843b1292

Download Submit
C:\Windows\system\bkyUAje.exe

Filesize
1.9MB

MD5
2605a654b16f078e4f1f60c86e2e1a05

SHA1
03b336e0c56256c2f9f4b2aaaea758f759a606f0

SHA256
5ac6010e10c1d3f8c2c91e7ac48e67dcbb4ffa8c1643a90cb85597eff0727e9f

SHA512
e25fb429827e3240cbd49d0fa123c088b97a537ce83dc885f353c75d8d10b28af4ce776fbae0103e4a079a064dac29032bf714646d6a3cf201f9ae04e849fd62

Download Submit
C:\Windows\system\cUNgrvZ.exe

Filesize
1.9MB

MD5
0132201bfffa856c1930a215b6c6a0f4

SHA1
5f57f8b19398ee23a43e8d9800311dc8677fbedb

SHA256
3f77ebdf05582e77a3dfb0566955d52498990cf370468374d83cc5a0d1eb6caf

SHA512
6f524557fc90df10278b8fe7bbced7c0475ee68b398d3d929f8c5303965f1547c970d522bdee8d2aa76d21669ecefba7a65c0b464e87301cb5598377442139b4

Download Submit
C:\Windows\system\cnxMaZx.exe

Filesize
1.9MB

MD5
5ace215bed9f1330e4e5c2af3a2151ff

SHA1
8caa536305941bb1e4432bb760df60066d021338

SHA256
70fa203a2bbbc134ceb07fce3448ccee8bc4cd44f9427e0f6a4634294ce1f503

SHA512
d85aa3434d58a1e576d4a69abacf2eede5707d4e7c378cdb4db4fc9af17c32bc6aa9abf87021e13824923582b59dbf367b5a15eb6e6a00180b3fcd79479f8001

Download Submit
C:\Windows\system\fsIyFSu.exe

Filesize
1.9MB

MD5
7892cbe0fac1d9a66993e703d702a5d5

SHA1
7ffae1bd0475dd2dfa55a5c0fd127cbb7071da63

SHA256
0f723d248ab52e36183f8b13f48fd554c79db9afb7102c7a81243314920fb148

SHA512
f25b68c159d46e941f8fa07ff67b4d70d5953add1a5558f04b00195b9f0deb10142f57a4d6a39f9dc2be46c80a59b4715408af906b798dd010a10d9e4118c362

Download Submit
C:\Windows\system\intOWeQ.exe

Filesize
1.9MB

MD5
109bddae255637e97eda25f3336eb8a0

SHA1
1dc5e6c2d73b930e02424c51541f1a889c65d4d3

SHA256
20ecf7c8616d1f1a0a26d913ea7becd4fff8271c792564d4561f3736de83398c

SHA512
6f0a28f3ad0228dc6b50bd8e32ff3c9297535ff9f4e2da94d9a87bc4ce47baf787adfdb71d91ff4234625407cbd8688069a0c54d270bf2ca38d8ebf2668c5318

Download Submit
C:\Windows\system\jkUxIKH.exe

Filesize
1.9MB

MD5
e269b6332556d92158d541e96a779b31

SHA1
1e5ac0394e80c191813806db2c900909c3cdcbf3

SHA256
507706bdce99c5d14e048deec194eed6b170e321de522786c8b33cf432e69bd7

SHA512
4eee1a16a2958e5c41ebf0ab4161db5f4949675f2c7808f94b34a12f148c477f070b9e96f0bd9863cde3ec1bbf5c8a782a62979d13fe3075879ffc9ef8d66fc2

Download Submit
C:\Windows\system\ktPZHjs.exe

Filesize
1.9MB

MD5
d420fb9164ac34757daecdd3e358c769

SHA1
4fce8133b8aa2f61a53321b1ff14e8c7fa6c61fe

SHA256
4303f8997b14d48dbd7eb21fc0526f6504aceba6269ddf875fc06bfa9acb0c94

SHA512
155b12e1804e9734f704901ff31607fce3f0fd724f74283b45ee467a2f2270849ab2a14478e9aa0b07441f4e2187495d91caf6f6c7783426e99058908dc759cd

Download Submit
C:\Windows\system\lOWrpqH.exe

Filesize
1.9MB

MD5
ac60b9677ed7d6ce788291f05c514a6a

SHA1
26dcae765cd3b87e63e55a8b3e9af350e9a734e0

SHA256
3aaf2c62f77c43bf02fa88a6c73f8b4c5672bb63632039b25e74f9ea0dc8245e

SHA512
4ecdf1b312b6673613fa75c9320adfd5e3a1ef1fa78b6cb38827c0715733a843718bc7c0db6dd3ed3bd605fbf129539c256a6733ce7f39d81e52f88a70a94e1f

Download Submit
C:\Windows\system\lcHvPhz.exe

Filesize
1.9MB

MD5
a22d516c261bc7a79bc96279255f06be

SHA1
e12f314ab31facb07713b14cf4c5447c4ecff5fe

SHA256
16d9731281e5a8bd0ff8c43d8457a27fc1e1a58052bca9f63f76538668b7797b

SHA512
430fef171afc996559e9f442cd8ad5ed7f18953e47c1e210bb480479d6c4b784b12f7be33121d941283987cc68964d319fd0ced177d886a1a2cfa59bdc394302

Download Submit
C:\Windows\system\ofwbTTi.exe

Filesize
1.9MB

MD5
f348c5a3cc5a6948edb561babdae985a

SHA1
2b33162d0f39d9e7f23f7a65fd619ceb4e09004b

SHA256
9722dbb70e931850f64698cde5c9d7d18796c335cc8ef5b8a3ce3cf80877009b

SHA512
a671d7cd916bc327d56fa64dd83c338d88dc7010624b7a805d69a6a7f69efe8f43a9bf576567e309e77c2f09714cc546a76110530d4f5191cb2d8d57a158820d

Download Submit
C:\Windows\system\xOpejxG.exe

Filesize
1.9MB

MD5
91ab592215b753e162503e74e3fbe7a7

SHA1
d7dcee35c99969a98bb492fdd311c9f84a9d7a67

SHA256
6e6861aed75b2cab355b94d4958e19677265fcf1b142d91d74687d87a2ae4c15

SHA512
83e0828e0ce6c0d80da78b71dde1bc3204e1c1877a9bf8e7e2788f9af1a9393f8d86e3e530a1aebf5096bba7dc1344c35fb1aa3a3df765ac47620d9236646e71

Download Submit
C:\Windows\system\zDWPNrX.exe

Filesize
1.9MB

MD5
2c4c8768bca653ff4dff2ee8e7daf70a

SHA1
ee5c39fc9890f801e58d97ce6aaa8971d4beff6a

SHA256
8485cbc1fe2d8ee3e0c46b3d66b9c2d910c0dcaa7bfa8aa0d20ec6bf6a685787

SHA512
21831c8026a4e758123662fc264a78a764f5cb4786c7aa952cbb5ce437692a8c5264a19bada70cf79173c985bfae0548f85f4f078da4e4bdf45f4c684c43edf7

Download Submit
\Windows\system\mnWWMOn.exe

Filesize
1.9MB

MD5
f3beba7cec820feb13e1b56b40cc0652

SHA1
0294245a718620cda8e952d76995f64eaaa6c429

SHA256
f40d246da4de5175fdda1cf79822fe4b23a3c641c17adbc08f2944dd325b6d06

SHA512
714040934a7643fc9f09e59718fab0171da308f2831ad0ce79d0518bee6ffb065af4aac5814e9aab49b43e86d5a2316527a4fc53e91215c363a20a7a11249127

Download Submit
memory/752-253-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/840-254-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/1068-255-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1396-9-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1396-1538-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-80-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2172-75-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-82-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2172-67-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2172-71-0x0000000002C80000-0x0000000003072000-memory.dmp

Filesize
3.9MB

Download
memory/2172-8-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-13-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2172-73-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-0-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2172-69-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-77-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2172-242-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2192-250-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2192-1836-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2192-78-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2276-79-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/2276-65-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/2276-66-0x00000000022B0000-0x0000000002330000-memory.dmp

Filesize
512KB

Download
memory/2276-64-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2276-128-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2276-50-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/2276-83-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

Filesize
9.6MB

Download
memory/2276-51-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2292-252-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2512-72-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-1839-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-76-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1838-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-15-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2540-244-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2540-1829-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2568-1828-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-70-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-68-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-1837-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-256-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2724-1885-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-74-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-1830-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2832-81-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2832-251-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download