xmrig | 70c70bd0e620952f5a9b4c523a811105299077d925c2bd001a282668a9a8ed11

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
Size

2.2MB
MD5

07e533d6b7bbb4046dac6ab7df6d01db
SHA1

2666d6dc72cb7d7b7e880d7d28e86d508b5d2164
SHA256

70c70bd0e620952f5a9b4c523a811105299077d925c2bd001a282668a9a8ed11
SHA512

f0bc2dd3eb4fab9d0788da5f132af4dd482c8f649674c80feabccc04d4ff579cafc8be48870ec35a1245c00ccc27eeaee6b9f6ae1f5b3fe37778b622c3749173
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr8+PN:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral1/memory/2392-15-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2148-178-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/604-13-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/1360-184-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2088-183-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2812-182-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2792-181-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2392-180-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/604-179-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2496-185-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2424-210-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2476-209-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2584-207-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2564-206-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2596-204-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2900-203-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2684-201-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2420-198-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2560-193-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2656-190-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2792-1800-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/604-1808-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2496-1803-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2564-1802-0x000000013F770000-0x000000013FB62000-memory.dmp	xmrig
behavioral1/memory/2088-1820-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2392-1821-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2900-1822-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/1360-1826-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2812-1825-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
604	lIGubYL.exe
2392	RyfcHLF.exe
2792	XFEJLhJ.exe
2812	NOwcuPW.exe
2088	IkuNoDW.exe
1360	wGObNfV.exe
2496	XPGwbag.exe
2900	YJCJyKc.exe
2564	lhAjBXt.exe
2656	vMloHzT.exe
2560	PNVUARy.exe
2420	xtKXXwT.exe
2684	oxuHRRS.exe
2596	DtyDaJV.exe
2584	RMkqplG.exe
2476	OSLQhNk.exe
2424	wsqmzgq.exe
2492	OWpTTup.exe
2964	GDhERjv.exe
1704	oQNUGmr.exe
1260	CuoCktr.exe
2208	JrFWNPK.exe
844	SsvdlLZ.exe
2372	UYRbhIq.exe
1216	MQSuaPk.exe
2316	qBePXVk.exe
1976	BbwTBGZ.exe
624	uMBVKXq.exe
1612	qEhfBqx.exe
1340	NYMgeQv.exe
1660	SIcKPyf.exe
2160	VYzOAGo.exe
1804	qjrHtHJ.exe
2368	AsUKucZ.exe
1156	dmAbEwy.exe
2740	oYvrirx.exe
2344	CNVCIaJ.exe
1828	qfMNuKC.exe
908	acmtDMJ.exe
1796	JewFEky.exe
2152	fUqCwTU.exe
1336	AWRQspQ.exe
388	JuUJeDG.exe
3032	jEGYraQ.exe
2092	DBIMCWR.exe
1568	JMVvWEe.exe
1572	WOGEzGi.exe
324	qgLBtJV.exe
1108	PMHbgfa.exe
2800	ZKfNwWO.exe
2940	IEVNZhR.exe
3004	xglGbEm.exe
2880	tSXzYdQ.exe
2568	iaexTbg.exe
2764	MpNekTI.exe
2436	sXpJlDy.exe
2616	fUMGRNh.exe
2280	vmrHtfI.exe
2076	bMbjpEx.exe
1496	SeiTalf.exe
1960	rdZuqGF.exe
2056	IZTXFFu.exe
1944	XtbxvvU.exe
2192	yXprqbA.exe

Loads dropped DLL 64 IoCs

pid	Process
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2148-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x000d0000000122b8-3.dat	upx
behavioral1/files/0x0009000000014aec-7.dat	upx
behavioral1/memory/2392-15-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x0009000000014ec4-9.dat	upx
behavioral1/files/0x000f0000000006fd-29.dat	upx
behavioral1/files/0x0008000000015264-34.dat	upx
behavioral1/files/0x0007000000015364-38.dat	upx
behavioral1/files/0x0006000000016d11-58.dat	upx
behavioral1/files/0x0006000000016d24-63.dat	upx
behavioral1/files/0x0006000000016d36-68.dat	upx
behavioral1/files/0x0006000000017090-113.dat	upx
behavioral1/files/0x0005000000018698-123.dat	upx
behavioral1/files/0x0006000000018b6a-170.dat	upx
behavioral1/files/0x0006000000018b33-147.dat	upx
behavioral1/files/0x0006000000018b4a-165.dat	upx
behavioral1/files/0x0006000000018b37-154.dat	upx
behavioral1/files/0x0006000000018ae8-138.dat	upx
behavioral1/files/0x00050000000186a0-128.dat	upx
behavioral1/files/0x0006000000018b15-143.dat	upx
behavioral1/files/0x0006000000018ae2-133.dat	upx
behavioral1/files/0x000500000001868c-118.dat	upx
behavioral1/files/0x000600000001704f-108.dat	upx
behavioral1/files/0x0006000000016e56-103.dat	upx
behavioral1/files/0x0006000000016d89-98.dat	upx
behavioral1/files/0x0006000000016d84-93.dat	upx
behavioral1/files/0x0006000000016d55-88.dat	upx
behavioral1/files/0x0006000000016d4a-78.dat	upx
behavioral1/files/0x0006000000016d4f-83.dat	upx
behavioral1/files/0x0006000000016d41-73.dat	upx
behavioral1/files/0x0006000000016d01-53.dat	upx
behavioral1/files/0x0006000000016cf0-48.dat	upx
behavioral1/files/0x00070000000155d4-43.dat	upx
behavioral1/memory/2148-178-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000018b42-160.dat	upx
behavioral1/memory/604-13-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/1360-184-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2088-183-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2812-182-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2792-181-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2392-180-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/604-179-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2496-185-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2424-210-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2476-209-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2584-207-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2564-206-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2596-204-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2900-203-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2684-201-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/memory/2420-198-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2560-193-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2656-190-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2792-1800-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/604-1808-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2496-1803-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2564-1802-0x000000013F770000-0x000000013FB62000-memory.dmp	upx
behavioral1/memory/2088-1820-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2392-1821-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2900-1822-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/1360-1826-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2812-1825-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xhrKfQY.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\iOBvnTc.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\bWQcKYR.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\OfEfuSL.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\NVYdcON.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ZujPpfS.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\CxFIvwd.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\NZABCyz.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\NswoIfn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\VWnOcbX.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\txEeWUX.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\GBQoXno.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\JEipwmG.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\lIGubYL.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\vXbbSdY.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\UpEqWOn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\pDoLXNn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\usOGgdg.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\kohwMlu.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\vSSAKSh.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\faDaCII.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ULBXLTU.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\baxRXme.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\CgyOskf.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\qLvFvua.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\cOqGQeh.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\UbsbvrN.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xMNzyPn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\pNWsASp.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xRuNQti.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\SksHEQs.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\XcsoWUt.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\LHEkJRz.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\lfiyyEP.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\XtbxvvU.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\yvYynur.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\lVxYSUe.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xiVWPjd.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\aQkDmcA.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\SJRlqrn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\mMhUESn.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\GUppFol.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\XqHazaK.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\iqWcEva.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\XFDovWM.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\OoncQYh.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\XFSVkSS.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\ZHgentE.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\mmZWSGl.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\BtmYpoj.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\stsnBvS.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\xscdvKA.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\EImGDuX.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\wSkClQU.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\FsGnPZl.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\wrBjrGx.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\IYucvdi.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\RVurVPu.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\SmAAhQM.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\yzDgTyG.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\HORijXJ.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\vnkWDMZ.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\RmyLPvS.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
File created	C:\Windows\System\vLNXsdF.exe	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
592	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeLockMemoryPrivilege	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 592	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	29
PID 2148 wrote to memory of 592	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	29
PID 2148 wrote to memory of 592	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	29
PID 2148 wrote to memory of 604	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	30
PID 2148 wrote to memory of 604	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	30
PID 2148 wrote to memory of 604	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	30
PID 2148 wrote to memory of 2392	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2392	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2392	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2792	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2792	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2792	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	32
PID 2148 wrote to memory of 2812	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	33
PID 2148 wrote to memory of 2812	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	33
PID 2148 wrote to memory of 2812	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	33
PID 2148 wrote to memory of 2088	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	34
PID 2148 wrote to memory of 2088	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	34
PID 2148 wrote to memory of 2088	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	34
PID 2148 wrote to memory of 1360	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	35
PID 2148 wrote to memory of 1360	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	35
PID 2148 wrote to memory of 1360	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	35
PID 2148 wrote to memory of 2496	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	36
PID 2148 wrote to memory of 2496	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	36
PID 2148 wrote to memory of 2496	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	36
PID 2148 wrote to memory of 2900	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	37
PID 2148 wrote to memory of 2900	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	37
PID 2148 wrote to memory of 2900	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	37
PID 2148 wrote to memory of 2564	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	38
PID 2148 wrote to memory of 2564	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	38
PID 2148 wrote to memory of 2564	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	38
PID 2148 wrote to memory of 2656	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	39
PID 2148 wrote to memory of 2656	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	39
PID 2148 wrote to memory of 2656	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	39
PID 2148 wrote to memory of 2560	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	40
PID 2148 wrote to memory of 2560	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	40
PID 2148 wrote to memory of 2560	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	40
PID 2148 wrote to memory of 2420	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	41
PID 2148 wrote to memory of 2420	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	41
PID 2148 wrote to memory of 2420	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	41
PID 2148 wrote to memory of 2684	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	42
PID 2148 wrote to memory of 2684	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	42
PID 2148 wrote to memory of 2684	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	42
PID 2148 wrote to memory of 2596	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	43
PID 2148 wrote to memory of 2596	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	43
PID 2148 wrote to memory of 2596	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	43
PID 2148 wrote to memory of 2584	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	44
PID 2148 wrote to memory of 2584	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	44
PID 2148 wrote to memory of 2584	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	44
PID 2148 wrote to memory of 2476	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	45
PID 2148 wrote to memory of 2476	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	45
PID 2148 wrote to memory of 2476	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	45
PID 2148 wrote to memory of 2424	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	46
PID 2148 wrote to memory of 2424	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	46
PID 2148 wrote to memory of 2424	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	46
PID 2148 wrote to memory of 2492	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	47
PID 2148 wrote to memory of 2492	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	47
PID 2148 wrote to memory of 2492	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	47
PID 2148 wrote to memory of 2964	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	48
PID 2148 wrote to memory of 2964	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	48
PID 2148 wrote to memory of 2964	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	48
PID 2148 wrote to memory of 1704	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	49
PID 2148 wrote to memory of 1704	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	49
PID 2148 wrote to memory of 1704	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	49
PID 2148 wrote to memory of 1260	2148	07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e533d6b7bbb4046dac6ab7df6d01db_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:592
- C:\Windows\System\lIGubYL.exe
  C:\Windows\System\lIGubYL.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\RyfcHLF.exe
  C:\Windows\System\RyfcHLF.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\XFEJLhJ.exe
  C:\Windows\System\XFEJLhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\NOwcuPW.exe
  C:\Windows\System\NOwcuPW.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\IkuNoDW.exe
  C:\Windows\System\IkuNoDW.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\wGObNfV.exe
  C:\Windows\System\wGObNfV.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\XPGwbag.exe
  C:\Windows\System\XPGwbag.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\YJCJyKc.exe
  C:\Windows\System\YJCJyKc.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\lhAjBXt.exe
  C:\Windows\System\lhAjBXt.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\vMloHzT.exe
  C:\Windows\System\vMloHzT.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\PNVUARy.exe
  C:\Windows\System\PNVUARy.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\xtKXXwT.exe
  C:\Windows\System\xtKXXwT.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\oxuHRRS.exe
  C:\Windows\System\oxuHRRS.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\DtyDaJV.exe
  C:\Windows\System\DtyDaJV.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\RMkqplG.exe
  C:\Windows\System\RMkqplG.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\OSLQhNk.exe
  C:\Windows\System\OSLQhNk.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\wsqmzgq.exe
  C:\Windows\System\wsqmzgq.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OWpTTup.exe
  C:\Windows\System\OWpTTup.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\GDhERjv.exe
  C:\Windows\System\GDhERjv.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\oQNUGmr.exe
  C:\Windows\System\oQNUGmr.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\CuoCktr.exe
  C:\Windows\System\CuoCktr.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\JrFWNPK.exe
  C:\Windows\System\JrFWNPK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\SsvdlLZ.exe
  C:\Windows\System\SsvdlLZ.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\UYRbhIq.exe
  C:\Windows\System\UYRbhIq.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\MQSuaPk.exe
  C:\Windows\System\MQSuaPk.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\qBePXVk.exe
  C:\Windows\System\qBePXVk.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\BbwTBGZ.exe
  C:\Windows\System\BbwTBGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\uMBVKXq.exe
  C:\Windows\System\uMBVKXq.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\qEhfBqx.exe
  C:\Windows\System\qEhfBqx.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NYMgeQv.exe
  C:\Windows\System\NYMgeQv.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\SIcKPyf.exe
  C:\Windows\System\SIcKPyf.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\VYzOAGo.exe
  C:\Windows\System\VYzOAGo.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\AsUKucZ.exe
  C:\Windows\System\AsUKucZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\qjrHtHJ.exe
  C:\Windows\System\qjrHtHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\CNVCIaJ.exe
  C:\Windows\System\CNVCIaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\dmAbEwy.exe
  C:\Windows\System\dmAbEwy.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\qfMNuKC.exe
  C:\Windows\System\qfMNuKC.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\oYvrirx.exe
  C:\Windows\System\oYvrirx.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\acmtDMJ.exe
  C:\Windows\System\acmtDMJ.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\JewFEky.exe
  C:\Windows\System\JewFEky.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fUqCwTU.exe
  C:\Windows\System\fUqCwTU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\AWRQspQ.exe
  C:\Windows\System\AWRQspQ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\JuUJeDG.exe
  C:\Windows\System\JuUJeDG.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\jEGYraQ.exe
  C:\Windows\System\jEGYraQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\DBIMCWR.exe
  C:\Windows\System\DBIMCWR.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\JMVvWEe.exe
  C:\Windows\System\JMVvWEe.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\WOGEzGi.exe
  C:\Windows\System\WOGEzGi.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\qgLBtJV.exe
  C:\Windows\System\qgLBtJV.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\PMHbgfa.exe
  C:\Windows\System\PMHbgfa.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\ZKfNwWO.exe
  C:\Windows\System\ZKfNwWO.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\IEVNZhR.exe
  C:\Windows\System\IEVNZhR.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\xglGbEm.exe
  C:\Windows\System\xglGbEm.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\tSXzYdQ.exe
  C:\Windows\System\tSXzYdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\MpNekTI.exe
  C:\Windows\System\MpNekTI.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\iaexTbg.exe
  C:\Windows\System\iaexTbg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\fUMGRNh.exe
  C:\Windows\System\fUMGRNh.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\sXpJlDy.exe
  C:\Windows\System\sXpJlDy.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\vmrHtfI.exe
  C:\Windows\System\vmrHtfI.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\bMbjpEx.exe
  C:\Windows\System\bMbjpEx.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\SeiTalf.exe
  C:\Windows\System\SeiTalf.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\rdZuqGF.exe
  C:\Windows\System\rdZuqGF.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\IZTXFFu.exe
  C:\Windows\System\IZTXFFu.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XtbxvvU.exe
  C:\Windows\System\XtbxvvU.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\yXprqbA.exe
  C:\Windows\System\yXprqbA.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\gARoirb.exe
  C:\Windows\System\gARoirb.exe
  2⤵
  PID:1648
- C:\Windows\System\wzPVHoE.exe
  C:\Windows\System\wzPVHoE.exe
  2⤵
  PID:2896
- C:\Windows\System\WdjazEv.exe
  C:\Windows\System\WdjazEv.exe
  2⤵
  PID:1428
- C:\Windows\System\SBOSKKi.exe
  C:\Windows\System\SBOSKKi.exe
  2⤵
  PID:2044
- C:\Windows\System\TKWUWQn.exe
  C:\Windows\System\TKWUWQn.exe
  2⤵
  PID:1548
- C:\Windows\System\RvCRMfe.exe
  C:\Windows\System\RvCRMfe.exe
  2⤵
  PID:904
- C:\Windows\System\evHgHJR.exe
  C:\Windows\System\evHgHJR.exe
  2⤵
  PID:2020
- C:\Windows\System\DdsWGsp.exe
  C:\Windows\System\DdsWGsp.exe
  2⤵
  PID:2216
- C:\Windows\System\gUuonFD.exe
  C:\Windows\System\gUuonFD.exe
  2⤵
  PID:2520
- C:\Windows\System\OVHWQME.exe
  C:\Windows\System\OVHWQME.exe
  2⤵
  PID:1624
- C:\Windows\System\myagVIN.exe
  C:\Windows\System\myagVIN.exe
  2⤵
  PID:2736
- C:\Windows\System\VFTuSzl.exe
  C:\Windows\System\VFTuSzl.exe
  2⤵
  PID:2912
- C:\Windows\System\SeTLuSE.exe
  C:\Windows\System\SeTLuSE.exe
  2⤵
  PID:2212
- C:\Windows\System\FUoOYwp.exe
  C:\Windows\System\FUoOYwp.exe
  2⤵
  PID:1808
- C:\Windows\System\mdGuDZX.exe
  C:\Windows\System\mdGuDZX.exe
  2⤵
  PID:2452
- C:\Windows\System\fApCIWN.exe
  C:\Windows\System\fApCIWN.exe
  2⤵
  PID:2332
- C:\Windows\System\iZHcnwX.exe
  C:\Windows\System\iZHcnwX.exe
  2⤵
  PID:1272
- C:\Windows\System\OYnkWBg.exe
  C:\Windows\System\OYnkWBg.exe
  2⤵
  PID:1988
- C:\Windows\System\cSQfaVT.exe
  C:\Windows\System\cSQfaVT.exe
  2⤵
  PID:1720
- C:\Windows\System\BhgJJXK.exe
  C:\Windows\System\BhgJJXK.exe
  2⤵
  PID:1232
- C:\Windows\System\tbAkgnE.exe
  C:\Windows\System\tbAkgnE.exe
  2⤵
  PID:1584
- C:\Windows\System\floDtEt.exe
  C:\Windows\System\floDtEt.exe
  2⤵
  PID:1984
- C:\Windows\System\xhrKfQY.exe
  C:\Windows\System\xhrKfQY.exe
  2⤵
  PID:2968
- C:\Windows\System\NswoIfn.exe
  C:\Windows\System\NswoIfn.exe
  2⤵
  PID:528
- C:\Windows\System\VBgTzHk.exe
  C:\Windows\System\VBgTzHk.exe
  2⤵
  PID:2272
- C:\Windows\System\LrjOhAG.exe
  C:\Windows\System\LrjOhAG.exe
  2⤵
  PID:2868
- C:\Windows\System\KavMzkN.exe
  C:\Windows\System\KavMzkN.exe
  2⤵
  PID:1008
- C:\Windows\System\NNusnYN.exe
  C:\Windows\System\NNusnYN.exe
  2⤵
  PID:2628
- C:\Windows\System\tnsXXgj.exe
  C:\Windows\System\tnsXXgj.exe
  2⤵
  PID:2760
- C:\Windows\System\bNuwSho.exe
  C:\Windows\System\bNuwSho.exe
  2⤵
  PID:1588
- C:\Windows\System\BqUzGnF.exe
  C:\Windows\System\BqUzGnF.exe
  2⤵
  PID:2756
- C:\Windows\System\yuNPFov.exe
  C:\Windows\System\yuNPFov.exe
  2⤵
  PID:2552
- C:\Windows\System\eQvxpqt.exe
  C:\Windows\System\eQvxpqt.exe
  2⤵
  PID:2200
- C:\Windows\System\pEvuDGC.exe
  C:\Windows\System\pEvuDGC.exe
  2⤵
  PID:1252
- C:\Windows\System\axcCJRw.exe
  C:\Windows\System\axcCJRw.exe
  2⤵
  PID:2716
- C:\Windows\System\dLyLcHa.exe
  C:\Windows\System\dLyLcHa.exe
  2⤵
  PID:1528
- C:\Windows\System\HbHUXeX.exe
  C:\Windows\System\HbHUXeX.exe
  2⤵
  PID:3012
- C:\Windows\System\zsOBNHs.exe
  C:\Windows\System\zsOBNHs.exe
  2⤵
  PID:924
- C:\Windows\System\PoxhxoM.exe
  C:\Windows\System\PoxhxoM.exe
  2⤵
  PID:1924
- C:\Windows\System\ANucJTl.exe
  C:\Windows\System\ANucJTl.exe
  2⤵
  PID:944
- C:\Windows\System\zdyyAPY.exe
  C:\Windows\System\zdyyAPY.exe
  2⤵
  PID:2892
- C:\Windows\System\VoHLAxU.exe
  C:\Windows\System\VoHLAxU.exe
  2⤵
  PID:1812
- C:\Windows\System\WVzNOpR.exe
  C:\Windows\System\WVzNOpR.exe
  2⤵
  PID:1332
- C:\Windows\System\TAkCYvk.exe
  C:\Windows\System\TAkCYvk.exe
  2⤵
  PID:2988
- C:\Windows\System\dqWNpDV.exe
  C:\Windows\System\dqWNpDV.exe
  2⤵
  PID:3064
- C:\Windows\System\YQBJDBY.exe
  C:\Windows\System\YQBJDBY.exe
  2⤵
  PID:1996
- C:\Windows\System\yObyySj.exe
  C:\Windows\System\yObyySj.exe
  2⤵
  PID:1140
- C:\Windows\System\hEXLPRZ.exe
  C:\Windows\System\hEXLPRZ.exe
  2⤵
  PID:1164
- C:\Windows\System\IzsuwWn.exe
  C:\Windows\System\IzsuwWn.exe
  2⤵
  PID:2948
- C:\Windows\System\RAxphKG.exe
  C:\Windows\System\RAxphKG.exe
  2⤵
  PID:2500
- C:\Windows\System\izoDUTG.exe
  C:\Windows\System\izoDUTG.exe
  2⤵
  PID:932
- C:\Windows\System\ZEfkFJJ.exe
  C:\Windows\System\ZEfkFJJ.exe
  2⤵
  PID:1536
- C:\Windows\System\ONGFQOb.exe
  C:\Windows\System\ONGFQOb.exe
  2⤵
  PID:2504
- C:\Windows\System\yuPgAoE.exe
  C:\Windows\System\yuPgAoE.exe
  2⤵
  PID:1744
- C:\Windows\System\uEYqPRJ.exe
  C:\Windows\System\uEYqPRJ.exe
  2⤵
  PID:2260
- C:\Windows\System\XkABNWc.exe
  C:\Windows\System\XkABNWc.exe
  2⤵
  PID:1844
- C:\Windows\System\rNoCERh.exe
  C:\Windows\System\rNoCERh.exe
  2⤵
  PID:2448
- C:\Windows\System\yjqrSht.exe
  C:\Windows\System\yjqrSht.exe
  2⤵
  PID:2204
- C:\Windows\System\ONhoZNU.exe
  C:\Windows\System\ONhoZNU.exe
  2⤵
  PID:2464
- C:\Windows\System\GUppFol.exe
  C:\Windows\System\GUppFol.exe
  2⤵
  PID:1448
- C:\Windows\System\dKUQAlQ.exe
  C:\Windows\System\dKUQAlQ.exe
  2⤵
  PID:556
- C:\Windows\System\Gyeivgq.exe
  C:\Windows\System\Gyeivgq.exe
  2⤵
  PID:2460
- C:\Windows\System\xNrvCwC.exe
  C:\Windows\System\xNrvCwC.exe
  2⤵
  PID:1872
- C:\Windows\System\NnBUCgr.exe
  C:\Windows\System\NnBUCgr.exe
  2⤵
  PID:1708
- C:\Windows\System\xTHwEGz.exe
  C:\Windows\System\xTHwEGz.exe
  2⤵
  PID:2840
- C:\Windows\System\zEEuBnq.exe
  C:\Windows\System\zEEuBnq.exe
  2⤵
  PID:1640
- C:\Windows\System\VBDcWgo.exe
  C:\Windows\System\VBDcWgo.exe
  2⤵
  PID:1800
- C:\Windows\System\NKgzBon.exe
  C:\Windows\System\NKgzBon.exe
  2⤵
  PID:2336
- C:\Windows\System\qfLPOLI.exe
  C:\Windows\System\qfLPOLI.exe
  2⤵
  PID:1840
- C:\Windows\System\bNdBXXd.exe
  C:\Windows\System\bNdBXXd.exe
  2⤵
  PID:1876
- C:\Windows\System\kYnLvjG.exe
  C:\Windows\System\kYnLvjG.exe
  2⤵
  PID:1304
- C:\Windows\System\fUGkkQZ.exe
  C:\Windows\System\fUGkkQZ.exe
  2⤵
  PID:1012
- C:\Windows\System\ExPDWXS.exe
  C:\Windows\System\ExPDWXS.exe
  2⤵
  PID:1060
- C:\Windows\System\dxrogvQ.exe
  C:\Windows\System\dxrogvQ.exe
  2⤵
  PID:796
- C:\Windows\System\tvwEwtP.exe
  C:\Windows\System\tvwEwtP.exe
  2⤵
  PID:2396
- C:\Windows\System\CGnwKKD.exe
  C:\Windows\System\CGnwKKD.exe
  2⤵
  PID:1756
- C:\Windows\System\cvpPGVM.exe
  C:\Windows\System\cvpPGVM.exe
  2⤵
  PID:2220
- C:\Windows\System\ldFkuqd.exe
  C:\Windows\System\ldFkuqd.exe
  2⤵
  PID:2580
- C:\Windows\System\lEfymQl.exe
  C:\Windows\System\lEfymQl.exe
  2⤵
  PID:1296
- C:\Windows\System\ctPYBFY.exe
  C:\Windows\System\ctPYBFY.exe
  2⤵
  PID:2836
- C:\Windows\System\mfUMbDJ.exe
  C:\Windows\System\mfUMbDJ.exe
  2⤵
  PID:2444
- C:\Windows\System\eOJuMNa.exe
  C:\Windows\System\eOJuMNa.exe
  2⤵
  PID:900
- C:\Windows\System\DJDUici.exe
  C:\Windows\System\DJDUici.exe
  2⤵
  PID:1776
- C:\Windows\System\hpCYwtu.exe
  C:\Windows\System\hpCYwtu.exe
  2⤵
  PID:2752
- C:\Windows\System\EImGDuX.exe
  C:\Windows\System\EImGDuX.exe
  2⤵
  PID:1464
- C:\Windows\System\EgajFip.exe
  C:\Windows\System\EgajFip.exe
  2⤵
  PID:1204
- C:\Windows\System\CcrZZsM.exe
  C:\Windows\System\CcrZZsM.exe
  2⤵
  PID:2660
- C:\Windows\System\RIsWlRL.exe
  C:\Windows\System\RIsWlRL.exe
  2⤵
  PID:2676
- C:\Windows\System\BUxHkSR.exe
  C:\Windows\System\BUxHkSR.exe
  2⤵
  PID:1576
- C:\Windows\System\ctxSRti.exe
  C:\Windows\System\ctxSRti.exe
  2⤵
  PID:2696
- C:\Windows\System\fksFHrX.exe
  C:\Windows\System\fksFHrX.exe
  2⤵
  PID:2360
- C:\Windows\System\qsmaJtC.exe
  C:\Windows\System\qsmaJtC.exe
  2⤵
  PID:2904
- C:\Windows\System\MkTjOkb.exe
  C:\Windows\System\MkTjOkb.exe
  2⤵
  PID:2312
- C:\Windows\System\XzHKPJj.exe
  C:\Windows\System\XzHKPJj.exe
  2⤵
  PID:1616
- C:\Windows\System\aMcGSIE.exe
  C:\Windows\System\aMcGSIE.exe
  2⤵
  PID:1672
- C:\Windows\System\rDYIFDl.exe
  C:\Windows\System\rDYIFDl.exe
  2⤵
  PID:2164
- C:\Windows\System\LNMboFW.exe
  C:\Windows\System\LNMboFW.exe
  2⤵
  PID:892
- C:\Windows\System\sYlKOaK.exe
  C:\Windows\System\sYlKOaK.exe
  2⤵
  PID:2828
- C:\Windows\System\VFZiAuv.exe
  C:\Windows\System\VFZiAuv.exe
  2⤵
  PID:3040
- C:\Windows\System\XjPWztX.exe
  C:\Windows\System\XjPWztX.exe
  2⤵
  PID:280
- C:\Windows\System\YizHavX.exe
  C:\Windows\System\YizHavX.exe
  2⤵
  PID:1628
- C:\Windows\System\Qulnprr.exe
  C:\Windows\System\Qulnprr.exe
  2⤵
  PID:2240
- C:\Windows\System\pfOXfsE.exe
  C:\Windows\System\pfOXfsE.exe
  2⤵
  PID:3080
- C:\Windows\System\osVYAHL.exe
  C:\Windows\System\osVYAHL.exe
  2⤵
  PID:3096
- C:\Windows\System\EqoABru.exe
  C:\Windows\System\EqoABru.exe
  2⤵
  PID:3112
- C:\Windows\System\nyJavWI.exe
  C:\Windows\System\nyJavWI.exe
  2⤵
  PID:3128
- C:\Windows\System\vXwZMUK.exe
  C:\Windows\System\vXwZMUK.exe
  2⤵
  PID:3144
- C:\Windows\System\eSiraEd.exe
  C:\Windows\System\eSiraEd.exe
  2⤵
  PID:3160
- C:\Windows\System\fXFYyrX.exe
  C:\Windows\System\fXFYyrX.exe
  2⤵
  PID:3176
- C:\Windows\System\teQGjlz.exe
  C:\Windows\System\teQGjlz.exe
  2⤵
  PID:3192
- C:\Windows\System\zvILghV.exe
  C:\Windows\System\zvILghV.exe
  2⤵
  PID:3208
- C:\Windows\System\gMsZbqE.exe
  C:\Windows\System\gMsZbqE.exe
  2⤵
  PID:3224
- C:\Windows\System\ntcjkSS.exe
  C:\Windows\System\ntcjkSS.exe
  2⤵
  PID:3240
- C:\Windows\System\liYZjPK.exe
  C:\Windows\System\liYZjPK.exe
  2⤵
  PID:3324
- C:\Windows\System\higltrm.exe
  C:\Windows\System\higltrm.exe
  2⤵
  PID:3340
- C:\Windows\System\EmJAMqi.exe
  C:\Windows\System\EmJAMqi.exe
  2⤵
  PID:3356
- C:\Windows\System\bASTxLO.exe
  C:\Windows\System\bASTxLO.exe
  2⤵
  PID:3372
- C:\Windows\System\qctWkdB.exe
  C:\Windows\System\qctWkdB.exe
  2⤵
  PID:3388
- C:\Windows\System\sIhMzIv.exe
  C:\Windows\System\sIhMzIv.exe
  2⤵
  PID:3404
- C:\Windows\System\UYAKQEC.exe
  C:\Windows\System\UYAKQEC.exe
  2⤵
  PID:3420
- C:\Windows\System\MYepPTB.exe
  C:\Windows\System\MYepPTB.exe
  2⤵
  PID:3436
- C:\Windows\System\xerriMm.exe
  C:\Windows\System\xerriMm.exe
  2⤵
  PID:3452
- C:\Windows\System\ZVAKEbv.exe
  C:\Windows\System\ZVAKEbv.exe
  2⤵
  PID:3468
- C:\Windows\System\EUivxOY.exe
  C:\Windows\System\EUivxOY.exe
  2⤵
  PID:3484
- C:\Windows\System\ckEHRuz.exe
  C:\Windows\System\ckEHRuz.exe
  2⤵
  PID:3500
- C:\Windows\System\vdNoWCb.exe
  C:\Windows\System\vdNoWCb.exe
  2⤵
  PID:3728
- C:\Windows\System\VTnTaEW.exe
  C:\Windows\System\VTnTaEW.exe
  2⤵
  PID:3744
- C:\Windows\System\gqqixWR.exe
  C:\Windows\System\gqqixWR.exe
  2⤵
  PID:3768
- C:\Windows\System\ROUAfgB.exe
  C:\Windows\System\ROUAfgB.exe
  2⤵
  PID:3796
- C:\Windows\System\WRqpZow.exe
  C:\Windows\System\WRqpZow.exe
  2⤵
  PID:3880
- C:\Windows\System\dhcLuVw.exe
  C:\Windows\System\dhcLuVw.exe
  2⤵
  PID:3896
- C:\Windows\System\qQoTVCk.exe
  C:\Windows\System\qQoTVCk.exe
  2⤵
  PID:3912
- C:\Windows\System\hfymojc.exe
  C:\Windows\System\hfymojc.exe
  2⤵
  PID:3928
- C:\Windows\System\ferDuHR.exe
  C:\Windows\System\ferDuHR.exe
  2⤵
  PID:3944
- C:\Windows\System\gHGpnlI.exe
  C:\Windows\System\gHGpnlI.exe
  2⤵
  PID:3960
- C:\Windows\System\bCaOQpF.exe
  C:\Windows\System\bCaOQpF.exe
  2⤵
  PID:3976
- C:\Windows\System\jEQZZYH.exe
  C:\Windows\System\jEQZZYH.exe
  2⤵
  PID:4072
- C:\Windows\System\FYUPyTs.exe
  C:\Windows\System\FYUPyTs.exe
  2⤵
  PID:1676
- C:\Windows\System\BfbNqvI.exe
  C:\Windows\System\BfbNqvI.exe
  2⤵
  PID:2480
- C:\Windows\System\qxaTBlT.exe
  C:\Windows\System\qxaTBlT.exe
  2⤵
  PID:284
- C:\Windows\System\CTggwRA.exe
  C:\Windows\System\CTggwRA.exe
  2⤵
  PID:3092
- C:\Windows\System\sXVExYC.exe
  C:\Windows\System\sXVExYC.exe
  2⤵
  PID:3124
- C:\Windows\System\pIoEEUo.exe
  C:\Windows\System\pIoEEUo.exe
  2⤵
  PID:3152
- C:\Windows\System\dnXzUtb.exe
  C:\Windows\System\dnXzUtb.exe
  2⤵
  PID:3188
- C:\Windows\System\cIQbimQ.exe
  C:\Windows\System\cIQbimQ.exe
  2⤵
  PID:3172
- C:\Windows\System\WHtNInT.exe
  C:\Windows\System\WHtNInT.exe
  2⤵
  PID:3268
- C:\Windows\System\lAEgQNc.exe
  C:\Windows\System\lAEgQNc.exe
  2⤵
  PID:3280
- C:\Windows\System\CRUtLtP.exe
  C:\Windows\System\CRUtLtP.exe
  2⤵
  PID:3644
- C:\Windows\System\rtIkrCp.exe
  C:\Windows\System\rtIkrCp.exe
  2⤵
  PID:3308
- C:\Windows\System\fpHpBaT.exe
  C:\Windows\System\fpHpBaT.exe
  2⤵
  PID:3352
- C:\Windows\System\JBqzbIE.exe
  C:\Windows\System\JBqzbIE.exe
  2⤵
  PID:3416
- C:\Windows\System\SHhxJfX.exe
  C:\Windows\System\SHhxJfX.exe
  2⤵
  PID:3532
- C:\Windows\System\UAtllqQ.exe
  C:\Windows\System\UAtllqQ.exe
  2⤵
  PID:3548
- C:\Windows\System\leEGYne.exe
  C:\Windows\System\leEGYne.exe
  2⤵
  PID:3572
- C:\Windows\System\JrFzlcx.exe
  C:\Windows\System\JrFzlcx.exe
  2⤵
  PID:3588
- C:\Windows\System\xkJbqho.exe
  C:\Windows\System\xkJbqho.exe
  2⤵
  PID:3604
- C:\Windows\System\rGoIMGP.exe
  C:\Windows\System\rGoIMGP.exe
  2⤵
  PID:3624
- C:\Windows\System\pDoLXNn.exe
  C:\Windows\System\pDoLXNn.exe
  2⤵
  PID:3640
- C:\Windows\System\ulPAVAE.exe
  C:\Windows\System\ulPAVAE.exe
  2⤵
  PID:3664
- C:\Windows\System\ZoIaKIn.exe
  C:\Windows\System\ZoIaKIn.exe
  2⤵
  PID:3684
- C:\Windows\System\dPBXurI.exe
  C:\Windows\System\dPBXurI.exe
  2⤵
  PID:2348
- C:\Windows\System\PFkjzXR.exe
  C:\Windows\System\PFkjzXR.exe
  2⤵
  PID:2680
- C:\Windows\System\ltHrSkg.exe
  C:\Windows\System\ltHrSkg.exe
  2⤵
  PID:3428
- C:\Windows\System\vAXznna.exe
  C:\Windows\System\vAXznna.exe
  2⤵
  PID:3740
- C:\Windows\System\BwwfLeK.exe
  C:\Windows\System\BwwfLeK.exe
  2⤵
  PID:3784
- C:\Windows\System\ElzXIfw.exe
  C:\Windows\System\ElzXIfw.exe
  2⤵
  PID:3820
- C:\Windows\System\ijLoRMF.exe
  C:\Windows\System\ijLoRMF.exe
  2⤵
  PID:3828
- C:\Windows\System\PWJdFRE.exe
  C:\Windows\System\PWJdFRE.exe
  2⤵
  PID:3848
- C:\Windows\System\Emudqql.exe
  C:\Windows\System\Emudqql.exe
  2⤵
  PID:3860
- C:\Windows\System\wrgNsxz.exe
  C:\Windows\System\wrgNsxz.exe
  2⤵
  PID:3904
- C:\Windows\System\FyuPNqX.exe
  C:\Windows\System\FyuPNqX.exe
  2⤵
  PID:3972
- C:\Windows\System\SOzysJw.exe
  C:\Windows\System\SOzysJw.exe
  2⤵
  PID:4092
- C:\Windows\System\trkfFwo.exe
  C:\Windows\System\trkfFwo.exe
  2⤵
  PID:3984
- C:\Windows\System\VNCCAlb.exe
  C:\Windows\System\VNCCAlb.exe
  2⤵
  PID:4000
- C:\Windows\System\faDaCII.exe
  C:\Windows\System\faDaCII.exe
  2⤵
  PID:4016
- C:\Windows\System\sTWQVVe.exe
  C:\Windows\System\sTWQVVe.exe
  2⤵
  PID:4036
- C:\Windows\System\JYEjvxV.exe
  C:\Windows\System\JYEjvxV.exe
  2⤵
  PID:3988
- C:\Windows\System\NvcKwyZ.exe
  C:\Windows\System\NvcKwyZ.exe
  2⤵
  PID:4064
- C:\Windows\System\UsthEdy.exe
  C:\Windows\System\UsthEdy.exe
  2⤵
  PID:2640
- C:\Windows\System\AuSfvbb.exe
  C:\Windows\System\AuSfvbb.exe
  2⤵
  PID:2536
- C:\Windows\System\lKzGVLE.exe
  C:\Windows\System\lKzGVLE.exe
  2⤵
  PID:828
- C:\Windows\System\ovZpYVT.exe
  C:\Windows\System\ovZpYVT.exe
  2⤵
  PID:3168
- C:\Windows\System\BlZuIdT.exe
  C:\Windows\System\BlZuIdT.exe
  2⤵
  PID:968
- C:\Windows\System\EHaDVnq.exe
  C:\Windows\System\EHaDVnq.exe
  2⤵
  PID:1324
- C:\Windows\System\zZgPice.exe
  C:\Windows\System\zZgPice.exe
  2⤵
  PID:3076
- C:\Windows\System\xpcDnit.exe
  C:\Windows\System\xpcDnit.exe
  2⤵
  PID:3252
- C:\Windows\System\VpctJKU.exe
  C:\Windows\System\VpctJKU.exe
  2⤵
  PID:3524
- C:\Windows\System\NJvHphV.exe
  C:\Windows\System\NJvHphV.exe
  2⤵
  PID:3560
- C:\Windows\System\AhRmLgI.exe
  C:\Windows\System\AhRmLgI.exe
  2⤵
  PID:3300
- C:\Windows\System\CqfUkLW.exe
  C:\Windows\System\CqfUkLW.exe
  2⤵
  PID:3636
- C:\Windows\System\YSpmxoK.exe
  C:\Windows\System\YSpmxoK.exe
  2⤵
  PID:3536
- C:\Windows\System\gxAMdNO.exe
  C:\Windows\System\gxAMdNO.exe
  2⤵
  PID:3620
- C:\Windows\System\Hgommeg.exe
  C:\Windows\System\Hgommeg.exe
  2⤵
  PID:3584
- C:\Windows\System\pNWsASp.exe
  C:\Windows\System\pNWsASp.exe
  2⤵
  PID:3788
- C:\Windows\System\RsqOEEP.exe
  C:\Windows\System\RsqOEEP.exe
  2⤵
  PID:3716
- C:\Windows\System\VIQWNbD.exe
  C:\Windows\System\VIQWNbD.exe
  2⤵
  PID:3364
- C:\Windows\System\AoNmEFP.exe
  C:\Windows\System\AoNmEFP.exe
  2⤵
  PID:3492
- C:\Windows\System\uMBxqbm.exe
  C:\Windows\System\uMBxqbm.exe
  2⤵
  PID:3872
- C:\Windows\System\mgAJbPE.exe
  C:\Windows\System\mgAJbPE.exe
  2⤵
  PID:3776
- C:\Windows\System\yNLBKks.exe
  C:\Windows\System\yNLBKks.exe
  2⤵
  PID:2732
- C:\Windows\System\zEjlhlE.exe
  C:\Windows\System\zEjlhlE.exe
  2⤵
  PID:3936
- C:\Windows\System\wTqPuYi.exe
  C:\Windows\System\wTqPuYi.exe
  2⤵
  PID:3992
- C:\Windows\System\oLrztTQ.exe
  C:\Windows\System\oLrztTQ.exe
  2⤵
  PID:1492
- C:\Windows\System\vxgytbM.exe
  C:\Windows\System\vxgytbM.exe
  2⤵
  PID:3888
- C:\Windows\System\kDxZhnz.exe
  C:\Windows\System\kDxZhnz.exe
  2⤵
  PID:1856
- C:\Windows\System\oHZzbSN.exe
  C:\Windows\System\oHZzbSN.exe
  2⤵
  PID:3292
- C:\Windows\System\ECvkLjw.exe
  C:\Windows\System\ECvkLjw.exe
  2⤵
  PID:3348
- C:\Windows\System\rsbaZrZ.exe
  C:\Windows\System\rsbaZrZ.exe
  2⤵
  PID:4044
- C:\Windows\System\kdbMSZJ.exe
  C:\Windows\System\kdbMSZJ.exe
  2⤵
  PID:696
- C:\Windows\System\aYagSrw.exe
  C:\Windows\System\aYagSrw.exe
  2⤵
  PID:3248
- C:\Windows\System\USBmEvx.exe
  C:\Windows\System\USBmEvx.exe
  2⤵
  PID:3556
- C:\Windows\System\qYAhSih.exe
  C:\Windows\System\qYAhSih.exe
  2⤵
  PID:3384
- C:\Windows\System\PxwEaRv.exe
  C:\Windows\System\PxwEaRv.exe
  2⤵
  PID:3696
- C:\Windows\System\IfXCavV.exe
  C:\Windows\System\IfXCavV.exe
  2⤵
  PID:3840
- C:\Windows\System\vDAcNgq.exe
  C:\Windows\System\vDAcNgq.exe
  2⤵
  PID:3296
- C:\Windows\System\rvDgTwd.exe
  C:\Windows\System\rvDgTwd.exe
  2⤵
  PID:4080
- C:\Windows\System\kaYGexr.exe
  C:\Windows\System\kaYGexr.exe
  2⤵
  PID:3736
- C:\Windows\System\PkQfcTG.exe
  C:\Windows\System\PkQfcTG.exe
  2⤵
  PID:4056
- C:\Windows\System\GJICVeH.exe
  C:\Windows\System\GJICVeH.exe
  2⤵
  PID:3140
- C:\Windows\System\yubSIdb.exe
  C:\Windows\System\yubSIdb.exe
  2⤵
  PID:3088
- C:\Windows\System\KmJhAVa.exe
  C:\Windows\System\KmJhAVa.exe
  2⤵
  PID:3412
- C:\Windows\System\lIXrYhY.exe
  C:\Windows\System\lIXrYhY.exe
  2⤵
  PID:3760
- C:\Windows\System\PPNIhkx.exe
  C:\Windows\System\PPNIhkx.exe
  2⤵
  PID:3812
- C:\Windows\System\udJtqiX.exe
  C:\Windows\System\udJtqiX.exe
  2⤵
  PID:3752
- C:\Windows\System\WIJvRZg.exe
  C:\Windows\System\WIJvRZg.exe
  2⤵
  PID:3968
- C:\Windows\System\mEsELer.exe
  C:\Windows\System\mEsELer.exe
  2⤵
  PID:3496
- C:\Windows\System\NgGJtwB.exe
  C:\Windows\System\NgGJtwB.exe
  2⤵
  PID:3204
- C:\Windows\System\NjKDLMR.exe
  C:\Windows\System\NjKDLMR.exe
  2⤵
  PID:3108
- C:\Windows\System\nOKbmHp.exe
  C:\Windows\System\nOKbmHp.exe
  2⤵
  PID:3780
- C:\Windows\System\VaESDel.exe
  C:\Windows\System\VaESDel.exe
  2⤵
  PID:3952
- C:\Windows\System\JAaHAkX.exe
  C:\Windows\System\JAaHAkX.exe
  2⤵
  PID:3480
- C:\Windows\System\vkPSYtI.exe
  C:\Windows\System\vkPSYtI.exe
  2⤵
  PID:4088
- C:\Windows\System\BLTRYhx.exe
  C:\Windows\System\BLTRYhx.exe
  2⤵
  PID:3612
- C:\Windows\System\BYAlPpx.exe
  C:\Windows\System\BYAlPpx.exe
  2⤵
  PID:2608
- C:\Windows\System\mgoVDUX.exe
  C:\Windows\System\mgoVDUX.exe
  2⤵
  PID:936
- C:\Windows\System\lLjYtln.exe
  C:\Windows\System\lLjYtln.exe
  2⤵
  PID:3520
- C:\Windows\System\vDtznuh.exe
  C:\Windows\System\vDtznuh.exe
  2⤵
  PID:3448
- C:\Windows\System\qGzsoUg.exe
  C:\Windows\System\qGzsoUg.exe
  2⤵
  PID:3864
- C:\Windows\System\lDWoxnN.exe
  C:\Windows\System\lDWoxnN.exe
  2⤵
  PID:3508
- C:\Windows\System\rqGoZKf.exe
  C:\Windows\System\rqGoZKf.exe
  2⤵
  PID:3816
- C:\Windows\System\MxyGLLy.exe
  C:\Windows\System\MxyGLLy.exe
  2⤵
  PID:3476
- C:\Windows\System\dghDDKr.exe
  C:\Windows\System\dghDDKr.exe
  2⤵
  PID:3920
- C:\Windows\System\SmAAhQM.exe
  C:\Windows\System\SmAAhQM.exe
  2⤵
  PID:4104
- C:\Windows\System\fbOEKTm.exe
  C:\Windows\System\fbOEKTm.exe
  2⤵
  PID:4124
- C:\Windows\System\moyeDYG.exe
  C:\Windows\System\moyeDYG.exe
  2⤵
  PID:4148
- C:\Windows\System\EBtsxeW.exe
  C:\Windows\System\EBtsxeW.exe
  2⤵
  PID:4188
- C:\Windows\System\LENWsTL.exe
  C:\Windows\System\LENWsTL.exe
  2⤵
  PID:4232
- C:\Windows\System\xWgIHQK.exe
  C:\Windows\System\xWgIHQK.exe
  2⤵
  PID:4252
- C:\Windows\System\pUxHVJw.exe
  C:\Windows\System\pUxHVJw.exe
  2⤵
  PID:4268
- C:\Windows\System\oMvxXtA.exe
  C:\Windows\System\oMvxXtA.exe
  2⤵
  PID:4292
- C:\Windows\System\MNVAkUt.exe
  C:\Windows\System\MNVAkUt.exe
  2⤵
  PID:4308
- C:\Windows\System\LXqNgfL.exe
  C:\Windows\System\LXqNgfL.exe
  2⤵
  PID:4324
- C:\Windows\System\HaHOIAc.exe
  C:\Windows\System\HaHOIAc.exe
  2⤵
  PID:4340
- C:\Windows\System\XUQffdB.exe
  C:\Windows\System\XUQffdB.exe
  2⤵
  PID:4356
- C:\Windows\System\wDjQRTU.exe
  C:\Windows\System\wDjQRTU.exe
  2⤵
  PID:4372
- C:\Windows\System\PYwfIua.exe
  C:\Windows\System\PYwfIua.exe
  2⤵
  PID:4400
- C:\Windows\System\TvrKxvI.exe
  C:\Windows\System\TvrKxvI.exe
  2⤵
  PID:4416
- C:\Windows\System\oQiMAqQ.exe
  C:\Windows\System\oQiMAqQ.exe
  2⤵
  PID:4432
- C:\Windows\System\RTGSJZi.exe
  C:\Windows\System\RTGSJZi.exe
  2⤵
  PID:4456
- C:\Windows\System\nBDjFIT.exe
  C:\Windows\System\nBDjFIT.exe
  2⤵
  PID:4492
- C:\Windows\System\gMiTKYt.exe
  C:\Windows\System\gMiTKYt.exe
  2⤵
  PID:4508
- C:\Windows\System\uABpxWt.exe
  C:\Windows\System\uABpxWt.exe
  2⤵
  PID:4524
- C:\Windows\System\GXZPwwx.exe
  C:\Windows\System\GXZPwwx.exe
  2⤵
  PID:4544
- C:\Windows\System\yatBiJJ.exe
  C:\Windows\System\yatBiJJ.exe
  2⤵
  PID:4564
- C:\Windows\System\eyCoAyn.exe
  C:\Windows\System\eyCoAyn.exe
  2⤵
  PID:4580
- C:\Windows\System\QqRwwsP.exe
  C:\Windows\System\QqRwwsP.exe
  2⤵
  PID:4596
- C:\Windows\System\wrJdrFw.exe
  C:\Windows\System\wrJdrFw.exe
  2⤵
  PID:4612
- C:\Windows\System\znGHxdO.exe
  C:\Windows\System\znGHxdO.exe
  2⤵
  PID:4628
- C:\Windows\System\vTmvbOt.exe
  C:\Windows\System\vTmvbOt.exe
  2⤵
  PID:4644
- C:\Windows\System\DlctOvV.exe
  C:\Windows\System\DlctOvV.exe
  2⤵
  PID:4664
- C:\Windows\System\dZFoBlp.exe
  C:\Windows\System\dZFoBlp.exe
  2⤵
  PID:4688
- C:\Windows\System\ZspCICK.exe
  C:\Windows\System\ZspCICK.exe
  2⤵
  PID:4704
- C:\Windows\System\flptqnW.exe
  C:\Windows\System\flptqnW.exe
  2⤵
  PID:4724
- C:\Windows\System\bdnIaIT.exe
  C:\Windows\System\bdnIaIT.exe
  2⤵
  PID:4740
- C:\Windows\System\XcsoWUt.exe
  C:\Windows\System\XcsoWUt.exe
  2⤵
  PID:4756
- C:\Windows\System\gcgIBKl.exe
  C:\Windows\System\gcgIBKl.exe
  2⤵
  PID:4776
- C:\Windows\System\ONNkfNQ.exe
  C:\Windows\System\ONNkfNQ.exe
  2⤵
  PID:4792
- C:\Windows\System\TrDqSTF.exe
  C:\Windows\System\TrDqSTF.exe
  2⤵
  PID:4808
- C:\Windows\System\qzFbQLJ.exe
  C:\Windows\System\qzFbQLJ.exe
  2⤵
  PID:4824
- C:\Windows\System\QxqsriT.exe
  C:\Windows\System\QxqsriT.exe
  2⤵
  PID:4844
- C:\Windows\System\GNGGDLg.exe
  C:\Windows\System\GNGGDLg.exe
  2⤵
  PID:4860
- C:\Windows\System\EgVpPJU.exe
  C:\Windows\System\EgVpPJU.exe
  2⤵
  PID:4876
- C:\Windows\System\kOHOTyD.exe
  C:\Windows\System\kOHOTyD.exe
  2⤵
  PID:4892
- C:\Windows\System\GJMEONn.exe
  C:\Windows\System\GJMEONn.exe
  2⤵
  PID:4908
- C:\Windows\System\FTIIZOP.exe
  C:\Windows\System\FTIIZOP.exe
  2⤵
  PID:4928
- C:\Windows\System\njlxJgm.exe
  C:\Windows\System\njlxJgm.exe
  2⤵
  PID:4948
- C:\Windows\System\XDajtHk.exe
  C:\Windows\System\XDajtHk.exe
  2⤵
  PID:4964
- C:\Windows\System\MyfAsaf.exe
  C:\Windows\System\MyfAsaf.exe
  2⤵
  PID:4980
- C:\Windows\System\ZtAIsOR.exe
  C:\Windows\System\ZtAIsOR.exe
  2⤵
  PID:5000
- C:\Windows\System\OUNWknQ.exe
  C:\Windows\System\OUNWknQ.exe
  2⤵
  PID:5016
- C:\Windows\System\tTGXnyd.exe
  C:\Windows\System\tTGXnyd.exe
  2⤵
  PID:5032
- C:\Windows\System\KjtdUdS.exe
  C:\Windows\System\KjtdUdS.exe
  2⤵
  PID:5048
- C:\Windows\System\kohwMlu.exe
  C:\Windows\System\kohwMlu.exe
  2⤵
  PID:5064
- C:\Windows\System\dVknTZs.exe
  C:\Windows\System\dVknTZs.exe
  2⤵
  PID:5084
- C:\Windows\System\eIdtajq.exe
  C:\Windows\System\eIdtajq.exe
  2⤵
  PID:5112
- C:\Windows\System\XqVphjM.exe
  C:\Windows\System\XqVphjM.exe
  2⤵
  PID:3200
- C:\Windows\System\ZujPpfS.exe
  C:\Windows\System\ZujPpfS.exe
  2⤵
  PID:4116
- C:\Windows\System\PNWyQUu.exe
  C:\Windows\System\PNWyQUu.exe
  2⤵
  PID:4144
- C:\Windows\System\EtwDgpq.exe
  C:\Windows\System\EtwDgpq.exe
  2⤵
  PID:4172
- C:\Windows\System\mWeoDQH.exe
  C:\Windows\System\mWeoDQH.exe
  2⤵
  PID:4180
- C:\Windows\System\ObHzyvB.exe
  C:\Windows\System\ObHzyvB.exe
  2⤵
  PID:4208
- C:\Windows\System\eUjdJHG.exe
  C:\Windows\System\eUjdJHG.exe
  2⤵
  PID:4240
- C:\Windows\System\BVMUsFX.exe
  C:\Windows\System\BVMUsFX.exe
  2⤵
  PID:4280
- C:\Windows\System\bIWwPkc.exe
  C:\Windows\System\bIWwPkc.exe
  2⤵
  PID:4284
- C:\Windows\System\trwMHVQ.exe
  C:\Windows\System\trwMHVQ.exe
  2⤵
  PID:4300
- C:\Windows\System\mUoxcFA.exe
  C:\Windows\System\mUoxcFA.exe
  2⤵
  PID:4384
- C:\Windows\System\xwTpQRO.exe
  C:\Windows\System\xwTpQRO.exe
  2⤵
  PID:4424
- C:\Windows\System\sedEFbK.exe
  C:\Windows\System\sedEFbK.exe
  2⤵
  PID:4412
- C:\Windows\System\cOxqPjW.exe
  C:\Windows\System\cOxqPjW.exe
  2⤵
  PID:4440
- C:\Windows\System\aIkllNK.exe
  C:\Windows\System\aIkllNK.exe
  2⤵
  PID:4476
- C:\Windows\System\ANoYdIx.exe
  C:\Windows\System\ANoYdIx.exe
  2⤵
  PID:4484
- C:\Windows\System\itIuYDm.exe
  C:\Windows\System\itIuYDm.exe
  2⤵
  PID:4556
- C:\Windows\System\wYwidFM.exe
  C:\Windows\System\wYwidFM.exe
  2⤵
  PID:4552
- C:\Windows\System\YnDTgxK.exe
  C:\Windows\System\YnDTgxK.exe
  2⤵
  PID:4652
- C:\Windows\System\AdXUBit.exe
  C:\Windows\System\AdXUBit.exe
  2⤵
  PID:4588
- C:\Windows\System\jXlKoQl.exe
  C:\Windows\System\jXlKoQl.exe
  2⤵
  PID:4636
- C:\Windows\System\mSHuXyU.exe
  C:\Windows\System\mSHuXyU.exe
  2⤵
  PID:4712
- C:\Windows\System\HUElGWa.exe
  C:\Windows\System\HUElGWa.exe
  2⤵
  PID:4604
- C:\Windows\System\TqsQgzP.exe
  C:\Windows\System\TqsQgzP.exe
  2⤵
  PID:4772
- C:\Windows\System\nOFXZVa.exe
  C:\Windows\System\nOFXZVa.exe
  2⤵
  PID:4832
- C:\Windows\System\FDOFQoJ.exe
  C:\Windows\System\FDOFQoJ.exe
  2⤵
  PID:4872
- C:\Windows\System\rnMkPUz.exe
  C:\Windows\System\rnMkPUz.exe
  2⤵
  PID:4888
- C:\Windows\System\xquDYTH.exe
  C:\Windows\System\xquDYTH.exe
  2⤵
  PID:4820
- C:\Windows\System\uJFrmpJ.exe
  C:\Windows\System\uJFrmpJ.exe
  2⤵
  PID:4904
- C:\Windows\System\gfoczFa.exe
  C:\Windows\System\gfoczFa.exe
  2⤵
  PID:4920
- C:\Windows\System\dFxvhUI.exe
  C:\Windows\System\dFxvhUI.exe
  2⤵
  PID:4960
- C:\Windows\System\gPqBcRr.exe
  C:\Windows\System\gPqBcRr.exe
  2⤵
  PID:5044
- C:\Windows\System\aQUlZTC.exe
  C:\Windows\System\aQUlZTC.exe
  2⤵
  PID:4996
- C:\Windows\System\XqHazaK.exe
  C:\Windows\System\XqHazaK.exe
  2⤵
  PID:5060
- C:\Windows\System\ntdtMRs.exe
  C:\Windows\System\ntdtMRs.exe
  2⤵
  PID:5100
- C:\Windows\System\zWjkPIS.exe
  C:\Windows\System\zWjkPIS.exe
  2⤵
  PID:3856
- C:\Windows\System\VbabxfV.exe
  C:\Windows\System\VbabxfV.exe
  2⤵
  PID:4136
- C:\Windows\System\BqxGMIP.exe
  C:\Windows\System\BqxGMIP.exe
  2⤵
  PID:4220
- C:\Windows\System\vwxNBYN.exe
  C:\Windows\System\vwxNBYN.exe
  2⤵
  PID:4212
- C:\Windows\System\VWnOcbX.exe
  C:\Windows\System\VWnOcbX.exe
  2⤵
  PID:4288
- C:\Windows\System\igUHqbe.exe
  C:\Windows\System\igUHqbe.exe
  2⤵
  PID:4264
- C:\Windows\System\biWrDlV.exe
  C:\Windows\System\biWrDlV.exe
  2⤵
  PID:4464
- C:\Windows\System\DRPcUTi.exe
  C:\Windows\System\DRPcUTi.exe
  2⤵
  PID:4472
- C:\Windows\System\iykjWdc.exe
  C:\Windows\System\iykjWdc.exe
  2⤵
  PID:4364
- C:\Windows\System\sheeUGd.exe
  C:\Windows\System\sheeUGd.exe
  2⤵
  PID:4660
- C:\Windows\System\ikXoiig.exe
  C:\Windows\System\ikXoiig.exe
  2⤵
  PID:4732
- C:\Windows\System\klJcbyB.exe
  C:\Windows\System\klJcbyB.exe
  2⤵
  PID:4572
- C:\Windows\System\ooxhyJB.exe
  C:\Windows\System\ooxhyJB.exe
  2⤵
  PID:4804
- C:\Windows\System\RAuUFlr.exe
  C:\Windows\System\RAuUFlr.exe
  2⤵
  PID:4900
- C:\Windows\System\nKwQVBu.exe
  C:\Windows\System\nKwQVBu.exe
  2⤵
  PID:4972
- C:\Windows\System\WhMrztV.exe
  C:\Windows\System\WhMrztV.exe
  2⤵
  PID:4976
- C:\Windows\System\JIQSDAe.exe
  C:\Windows\System\JIQSDAe.exe
  2⤵
  PID:5076
- C:\Windows\System\TWhEIcx.exe
  C:\Windows\System\TWhEIcx.exe
  2⤵
  PID:4924
- C:\Windows\System\ZLkSVIE.exe
  C:\Windows\System\ZLkSVIE.exe
  2⤵
  PID:5056
- C:\Windows\System\jsnyqTp.exe
  C:\Windows\System\jsnyqTp.exe
  2⤵
  PID:4160
- C:\Windows\System\UofEcuD.exe
  C:\Windows\System\UofEcuD.exe
  2⤵
  PID:4332
- C:\Windows\System\iqWcEva.exe
  C:\Windows\System\iqWcEva.exe
  2⤵
  PID:3460
- C:\Windows\System\SFGJAPi.exe
  C:\Windows\System\SFGJAPi.exe
  2⤵
  PID:4248
- C:\Windows\System\FbbZstx.exe
  C:\Windows\System\FbbZstx.exe
  2⤵
  PID:4536
- C:\Windows\System\tBTyvxE.exe
  C:\Windows\System\tBTyvxE.exe
  2⤵
  PID:4620
- C:\Windows\System\kxuPYqw.exe
  C:\Windows\System\kxuPYqw.exe
  2⤵
  PID:4764
- C:\Windows\System\SVRKLpP.exe
  C:\Windows\System\SVRKLpP.exe
  2⤵
  PID:4576
- C:\Windows\System\HFznask.exe
  C:\Windows\System\HFznask.exe
  2⤵
  PID:4684
- C:\Windows\System\yQDCZyy.exe
  C:\Windows\System\yQDCZyy.exe
  2⤵
  PID:4836
- C:\Windows\System\vLBzBOi.exe
  C:\Windows\System\vLBzBOi.exe
  2⤵
  PID:4276
- C:\Windows\System\TeWwOuE.exe
  C:\Windows\System\TeWwOuE.exe
  2⤵
  PID:4408
- C:\Windows\System\lpRwrrq.exe
  C:\Windows\System\lpRwrrq.exe
  2⤵
  PID:5108
- C:\Windows\System\iOBvnTc.exe
  C:\Windows\System\iOBvnTc.exe
  2⤵
  PID:4956
- C:\Windows\System\paUrpQF.exe
  C:\Windows\System\paUrpQF.exe
  2⤵
  PID:4396
- C:\Windows\System\YCzkQNr.exe
  C:\Windows\System\YCzkQNr.exe
  2⤵
  PID:4540
- C:\Windows\System\UcqxuKa.exe
  C:\Windows\System\UcqxuKa.exe
  2⤵
  PID:4784
- C:\Windows\System\Lcxkjvx.exe
  C:\Windows\System\Lcxkjvx.exe
  2⤵
  PID:5132
- C:\Windows\System\riAFUoj.exe
  C:\Windows\System\riAFUoj.exe
  2⤵
  PID:5148
- C:\Windows\System\hvJAIPH.exe
  C:\Windows\System\hvJAIPH.exe
  2⤵
  PID:5164
- C:\Windows\System\OoncQYh.exe
  C:\Windows\System\OoncQYh.exe
  2⤵
  PID:5180
- C:\Windows\System\cFDuRMH.exe
  C:\Windows\System\cFDuRMH.exe
  2⤵
  PID:5200
- C:\Windows\System\vyjjFir.exe
  C:\Windows\System\vyjjFir.exe
  2⤵
  PID:5216
- C:\Windows\System\lberhzl.exe
  C:\Windows\System\lberhzl.exe
  2⤵
  PID:5284
- C:\Windows\System\CkmsCln.exe
  C:\Windows\System\CkmsCln.exe
  2⤵
  PID:5312
- C:\Windows\System\qLZOFUr.exe
  C:\Windows\System\qLZOFUr.exe
  2⤵
  PID:5368
- C:\Windows\System\PfFlbYc.exe
  C:\Windows\System\PfFlbYc.exe
  2⤵
  PID:5384
- C:\Windows\System\GOTEAlo.exe
  C:\Windows\System\GOTEAlo.exe
  2⤵
  PID:5400
- C:\Windows\System\QFsNknu.exe
  C:\Windows\System\QFsNknu.exe
  2⤵
  PID:5416
- C:\Windows\System\UcmEdrQ.exe
  C:\Windows\System\UcmEdrQ.exe
  2⤵
  PID:5436
- C:\Windows\System\OxnixKB.exe
  C:\Windows\System\OxnixKB.exe
  2⤵
  PID:5452
- C:\Windows\System\uursUlu.exe
  C:\Windows\System\uursUlu.exe
  2⤵
  PID:5468
- C:\Windows\System\oSThlCH.exe
  C:\Windows\System\oSThlCH.exe
  2⤵
  PID:5488
- C:\Windows\System\TywDshj.exe
  C:\Windows\System\TywDshj.exe
  2⤵
  PID:5504
- C:\Windows\System\noyrYZw.exe
  C:\Windows\System\noyrYZw.exe
  2⤵
  PID:5520
- C:\Windows\System\ZGPXHdw.exe
  C:\Windows\System\ZGPXHdw.exe
  2⤵
  PID:5540
- C:\Windows\System\PKTxMDh.exe
  C:\Windows\System\PKTxMDh.exe
  2⤵
  PID:5556
- C:\Windows\System\VUIktPA.exe
  C:\Windows\System\VUIktPA.exe
  2⤵
  PID:5572
- C:\Windows\System\UZqJaOj.exe
  C:\Windows\System\UZqJaOj.exe
  2⤵
  PID:5596
- C:\Windows\System\bjiOVYK.exe
  C:\Windows\System\bjiOVYK.exe
  2⤵
  PID:5624
- C:\Windows\System\SIPtEHR.exe
  C:\Windows\System\SIPtEHR.exe
  2⤵
  PID:5644
- C:\Windows\System\wcxplte.exe
  C:\Windows\System\wcxplte.exe
  2⤵
  PID:5704
- C:\Windows\System\GNwqFDW.exe
  C:\Windows\System\GNwqFDW.exe
  2⤵
  PID:5720
- C:\Windows\System\yvYynur.exe
  C:\Windows\System\yvYynur.exe
  2⤵
  PID:5736
- C:\Windows\System\XbiHObY.exe
  C:\Windows\System\XbiHObY.exe
  2⤵
  PID:5756
- C:\Windows\System\jpvLkVE.exe
  C:\Windows\System\jpvLkVE.exe
  2⤵
  PID:5772
- C:\Windows\System\JoiShIh.exe
  C:\Windows\System\JoiShIh.exe
  2⤵
  PID:5792
- C:\Windows\System\gVNlmmX.exe
  C:\Windows\System\gVNlmmX.exe
  2⤵
  PID:5808
- C:\Windows\System\qduQIJT.exe
  C:\Windows\System\qduQIJT.exe
  2⤵
  PID:5824
- C:\Windows\System\SobyPRG.exe
  C:\Windows\System\SobyPRG.exe
  2⤵
  PID:5840
- C:\Windows\System\EYckpGR.exe
  C:\Windows\System\EYckpGR.exe
  2⤵
  PID:5920
- C:\Windows\System\eJvNrng.exe
  C:\Windows\System\eJvNrng.exe
  2⤵
  PID:5936
- C:\Windows\System\YpvhoUo.exe
  C:\Windows\System\YpvhoUo.exe
  2⤵
  PID:5952
- C:\Windows\System\JXlaZBm.exe
  C:\Windows\System\JXlaZBm.exe
  2⤵
  PID:5972
- C:\Windows\System\awACjJz.exe
  C:\Windows\System\awACjJz.exe
  2⤵
  PID:5988
- C:\Windows\System\GvGVndD.exe
  C:\Windows\System\GvGVndD.exe
  2⤵
  PID:6004
- C:\Windows\System\sAaRIZH.exe
  C:\Windows\System\sAaRIZH.exe
  2⤵
  PID:6024
- C:\Windows\System\QHIyZEn.exe
  C:\Windows\System\QHIyZEn.exe
  2⤵
  PID:6040
- C:\Windows\System\qiAdlWX.exe
  C:\Windows\System\qiAdlWX.exe
  2⤵
  PID:6064
- C:\Windows\System\VpYxKXd.exe
  C:\Windows\System\VpYxKXd.exe
  2⤵
  PID:6080
- C:\Windows\System\oBXWOOy.exe
  C:\Windows\System\oBXWOOy.exe
  2⤵
  PID:6096
- C:\Windows\System\fseOOTd.exe
  C:\Windows\System\fseOOTd.exe
  2⤵
  PID:6116
- C:\Windows\System\jtcnukj.exe
  C:\Windows\System\jtcnukj.exe
  2⤵
  PID:6132
- C:\Windows\System\MHtSkkt.exe
  C:\Windows\System\MHtSkkt.exe
  2⤵
  PID:5080
- C:\Windows\System\FuPazJB.exe
  C:\Windows\System\FuPazJB.exe
  2⤵
  PID:5144
- C:\Windows\System\oLCAYlI.exe
  C:\Windows\System\oLCAYlI.exe
  2⤵
  PID:4444
- C:\Windows\System\suOAOnE.exe
  C:\Windows\System\suOAOnE.exe
  2⤵
  PID:5160
- C:\Windows\System\FibkbbB.exe
  C:\Windows\System\FibkbbB.exe
  2⤵
  PID:5192
- C:\Windows\System\NejEuJx.exe
  C:\Windows\System\NejEuJx.exe
  2⤵
  PID:5212
- C:\Windows\System\JXaBFiS.exe
  C:\Windows\System\JXaBFiS.exe
  2⤵
  PID:5096
- C:\Windows\System\BVPeQyW.exe
  C:\Windows\System\BVPeQyW.exe
  2⤵
  PID:5240
- C:\Windows\System\gLzElzb.exe
  C:\Windows\System\gLzElzb.exe
  2⤵
  PID:5276
- C:\Windows\System\PeBJiKZ.exe
  C:\Windows\System\PeBJiKZ.exe
  2⤵
  PID:5304
- C:\Windows\System\PDkZwsk.exe
  C:\Windows\System\PDkZwsk.exe
  2⤵
  PID:5408
- C:\Windows\System\zsqSGao.exe
  C:\Windows\System\zsqSGao.exe
  2⤵
  PID:5480
- C:\Windows\System\UdwAoTH.exe
  C:\Windows\System\UdwAoTH.exe
  2⤵
  PID:5552
- C:\Windows\System\XhNKtxJ.exe
  C:\Windows\System\XhNKtxJ.exe
  2⤵
  PID:5396
- C:\Windows\System\IzQrIHB.exe
  C:\Windows\System\IzQrIHB.exe
  2⤵
  PID:5336
- C:\Windows\System\qpZBEDk.exe
  C:\Windows\System\qpZBEDk.exe
  2⤵
  PID:5496
- C:\Windows\System\fFPWjcF.exe
  C:\Windows\System\fFPWjcF.exe
  2⤵
  PID:5564
- C:\Windows\System\YSVjroK.exe
  C:\Windows\System\YSVjroK.exe
  2⤵
  PID:5460
- C:\Windows\System\oCZBWdR.exe
  C:\Windows\System\oCZBWdR.exe
  2⤵
  PID:5612
- C:\Windows\System\bsSbjuy.exe
  C:\Windows\System\bsSbjuy.exe
  2⤵
  PID:5360
- C:\Windows\System\OYwmYBz.exe
  C:\Windows\System\OYwmYBz.exe
  2⤵
  PID:5608
- C:\Windows\System\LTwjFGU.exe
  C:\Windows\System\LTwjFGU.exe
  2⤵
  PID:5668
- C:\Windows\System\sClMNwH.exe
  C:\Windows\System\sClMNwH.exe
  2⤵
  PID:5652
- C:\Windows\System\QUZVAJV.exe
  C:\Windows\System\QUZVAJV.exe
  2⤵
  PID:5688
- C:\Windows\System\vcTYBdE.exe
  C:\Windows\System\vcTYBdE.exe
  2⤵
  PID:5716
- C:\Windows\System\xqfGPcC.exe
  C:\Windows\System\xqfGPcC.exe
  2⤵
  PID:5780
- C:\Windows\System\zreOmcP.exe
  C:\Windows\System\zreOmcP.exe
  2⤵
  PID:5700
- C:\Windows\System\NxDRoel.exe
  C:\Windows\System\NxDRoel.exe
  2⤵
  PID:5732
- C:\Windows\System\huJogpm.exe
  C:\Windows\System\huJogpm.exe
  2⤵
  PID:5804
- C:\Windows\System\MzSMavq.exe
  C:\Windows\System\MzSMavq.exe
  2⤵
  PID:5864
- C:\Windows\System\QSnVelK.exe
  C:\Windows\System\QSnVelK.exe
  2⤵
  PID:5880
- C:\Windows\System\vpwYVOq.exe
  C:\Windows\System\vpwYVOq.exe
  2⤵
  PID:5900
- C:\Windows\System\ByllzWA.exe
  C:\Windows\System\ByllzWA.exe
  2⤵
  PID:5944
- C:\Windows\System\XBxMILu.exe
  C:\Windows\System\XBxMILu.exe
  2⤵
  PID:5928
- C:\Windows\System\GUjRgYx.exe
  C:\Windows\System\GUjRgYx.exe
  2⤵
  PID:5932
- C:\Windows\System\TShEtrp.exe
  C:\Windows\System\TShEtrp.exe
  2⤵
  PID:6056
- C:\Windows\System\zuIbbZf.exe
  C:\Windows\System\zuIbbZf.exe
  2⤵
  PID:5996
- C:\Windows\System\TVreawK.exe
  C:\Windows\System\TVreawK.exe
  2⤵
  PID:6108
- C:\Windows\System\BWreXdz.exe
  C:\Windows\System\BWreXdz.exe
  2⤵
  PID:6076
- C:\Windows\System\rgOKnSG.exe
  C:\Windows\System\rgOKnSG.exe
  2⤵
  PID:4304
- C:\Windows\System\vxqxKpR.exe
  C:\Windows\System\vxqxKpR.exe
  2⤵
  PID:4260
- C:\Windows\System\FExFMJC.exe
  C:\Windows\System\FExFMJC.exe
  2⤵
  PID:5196
- C:\Windows\System\yQEHqpS.exe
  C:\Windows\System\yQEHqpS.exe
  2⤵
  PID:5292
- C:\Windows\System\jWNssQy.exe
  C:\Windows\System\jWNssQy.exe
  2⤵
  PID:5248
- C:\Windows\System\HWIpKCd.exe
  C:\Windows\System\HWIpKCd.exe
  2⤵
  PID:5228
- C:\Windows\System\jksVzsi.exe
  C:\Windows\System\jksVzsi.exe
  2⤵
  PID:5356
- C:\Windows\System\zwgkYQN.exe
  C:\Windows\System\zwgkYQN.exe
  2⤵
  PID:5428
- C:\Windows\System\cPFHVYe.exe
  C:\Windows\System\cPFHVYe.exe
  2⤵
  PID:5548
- C:\Windows\System\moddvLb.exe
  C:\Windows\System\moddvLb.exe
  2⤵
  PID:5320
- C:\Windows\System\PvaFHBu.exe
  C:\Windows\System\PvaFHBu.exe
  2⤵
  PID:5656
- C:\Windows\System\tJflKqb.exe
  C:\Windows\System\tJflKqb.exe
  2⤵
  PID:5680
- C:\Windows\System\eIxKDfD.exe
  C:\Windows\System\eIxKDfD.exe
  2⤵
  PID:5820
- C:\Windows\System\nFKhzox.exe
  C:\Windows\System\nFKhzox.exe
  2⤵
  PID:5696
- C:\Windows\System\EsYzDiF.exe
  C:\Windows\System\EsYzDiF.exe
  2⤵
  PID:5892
- C:\Windows\System\UMbmdio.exe
  C:\Windows\System\UMbmdio.exe
  2⤵
  PID:5980
- C:\Windows\System\CxFIvwd.exe
  C:\Windows\System\CxFIvwd.exe
  2⤵
  PID:5876
- C:\Windows\System\KmmvGmx.exe
  C:\Windows\System\KmmvGmx.exe
  2⤵
  PID:6016
- C:\Windows\System\JJvZMIi.exe
  C:\Windows\System\JJvZMIi.exe
  2⤵
  PID:6088
- C:\Windows\System\KEbBMGh.exe
  C:\Windows\System\KEbBMGh.exe
  2⤵
  PID:6000
- C:\Windows\System\HDynvZu.exe
  C:\Windows\System\HDynvZu.exe
  2⤵
  PID:5140
- C:\Windows\System\utAtUht.exe
  C:\Windows\System\utAtUht.exe
  2⤵
  PID:5236
- C:\Windows\System\KkkNvwx.exe
  C:\Windows\System\KkkNvwx.exe
  2⤵
  PID:5380
- C:\Windows\System\lVxYSUe.exe
  C:\Windows\System\lVxYSUe.exe
  2⤵
  PID:5272
- C:\Windows\System\lNHVIyz.exe
  C:\Windows\System\lNHVIyz.exe
  2⤵
  PID:5604
- C:\Windows\System\szbOMyk.exe
  C:\Windows\System\szbOMyk.exe
  2⤵
  PID:5856
- C:\Windows\System\Ourgcvm.exe
  C:\Windows\System\Ourgcvm.exe
  2⤵
  PID:5592
- C:\Windows\System\GsRrIbK.exe
  C:\Windows\System\GsRrIbK.exe
  2⤵
  PID:6052
- C:\Windows\System\ipspKzB.exe
  C:\Windows\System\ipspKzB.exe
  2⤵
  PID:5532
- C:\Windows\System\CxjeqrJ.exe
  C:\Windows\System\CxjeqrJ.exe
  2⤵
  PID:5904
- C:\Windows\System\lwnUqPT.exe
  C:\Windows\System\lwnUqPT.exe
  2⤵
  PID:5340
- C:\Windows\System\lNRytEz.exe
  C:\Windows\System\lNRytEz.exe
  2⤵
  PID:5176
- C:\Windows\System\ImbJluq.exe
  C:\Windows\System\ImbJluq.exe
  2⤵
  PID:5156
- C:\Windows\System\qXBfNiK.exe
  C:\Windows\System\qXBfNiK.exe
  2⤵
  PID:5728
- C:\Windows\System\dOnrivM.exe
  C:\Windows\System\dOnrivM.exe
  2⤵
  PID:5816
- C:\Windows\System\OfEfuSL.exe
  C:\Windows\System\OfEfuSL.exe
  2⤵
  PID:5800
- C:\Windows\System\EpDyKkE.exe
  C:\Windows\System\EpDyKkE.exe
  2⤵
  PID:6152
- C:\Windows\System\qEimeJc.exe
  C:\Windows\System\qEimeJc.exe
  2⤵
  PID:6172
- C:\Windows\System\FxNkUsn.exe
  C:\Windows\System\FxNkUsn.exe
  2⤵
  PID:6240
- C:\Windows\System\KTLHPQu.exe
  C:\Windows\System\KTLHPQu.exe
  2⤵
  PID:6260
- C:\Windows\System\JgdCqZI.exe
  C:\Windows\System\JgdCqZI.exe
  2⤵
  PID:6280
- C:\Windows\System\mPckBBO.exe
  C:\Windows\System\mPckBBO.exe
  2⤵
  PID:6300
- C:\Windows\System\GFCTQig.exe
  C:\Windows\System\GFCTQig.exe
  2⤵
  PID:6344
- C:\Windows\System\GdNehWe.exe
  C:\Windows\System\GdNehWe.exe
  2⤵
  PID:6360
- C:\Windows\System\bVqVThk.exe
  C:\Windows\System\bVqVThk.exe
  2⤵
  PID:6376
- C:\Windows\System\KTYwNql.exe
  C:\Windows\System\KTYwNql.exe
  2⤵
  PID:6392
- C:\Windows\System\cHenZdS.exe
  C:\Windows\System\cHenZdS.exe
  2⤵
  PID:6408
- C:\Windows\System\zrsOCeG.exe
  C:\Windows\System\zrsOCeG.exe
  2⤵
  PID:6428
- C:\Windows\System\LEVxQMU.exe
  C:\Windows\System\LEVxQMU.exe
  2⤵
  PID:6444
- C:\Windows\System\lFaarRK.exe
  C:\Windows\System\lFaarRK.exe
  2⤵
  PID:6460
- C:\Windows\System\NCbHYrd.exe
  C:\Windows\System\NCbHYrd.exe
  2⤵
  PID:6476
- C:\Windows\System\mpWULgM.exe
  C:\Windows\System\mpWULgM.exe
  2⤵
  PID:6492
- C:\Windows\System\eieFUhO.exe
  C:\Windows\System\eieFUhO.exe
  2⤵
  PID:6508
- C:\Windows\System\nnHXAAw.exe
  C:\Windows\System\nnHXAAw.exe
  2⤵
  PID:6524
- C:\Windows\System\QstEKNS.exe
  C:\Windows\System\QstEKNS.exe
  2⤵
  PID:6540
- C:\Windows\System\UlJzOVL.exe
  C:\Windows\System\UlJzOVL.exe
  2⤵
  PID:6556
- C:\Windows\System\JSMqVnA.exe
  C:\Windows\System\JSMqVnA.exe
  2⤵
  PID:6572
- C:\Windows\System\xdAUFNp.exe
  C:\Windows\System\xdAUFNp.exe
  2⤵
  PID:6588
- C:\Windows\System\RhmNjGq.exe
  C:\Windows\System\RhmNjGq.exe
  2⤵
  PID:6604
- C:\Windows\System\HfpxlSX.exe
  C:\Windows\System\HfpxlSX.exe
  2⤵
  PID:6620
- C:\Windows\System\DHFJQna.exe
  C:\Windows\System\DHFJQna.exe
  2⤵
  PID:6648
- C:\Windows\System\fHwyGlQ.exe
  C:\Windows\System\fHwyGlQ.exe
  2⤵
  PID:6664
- C:\Windows\System\GjgQQiH.exe
  C:\Windows\System\GjgQQiH.exe
  2⤵
  PID:6684
- C:\Windows\System\pIrsxUW.exe
  C:\Windows\System\pIrsxUW.exe
  2⤵
  PID:6704
- C:\Windows\System\hwlizZX.exe
  C:\Windows\System\hwlizZX.exe
  2⤵
  PID:6728
- C:\Windows\System\HszYdHg.exe
  C:\Windows\System\HszYdHg.exe
  2⤵
  PID:6744
- C:\Windows\System\mTKzUeR.exe
  C:\Windows\System\mTKzUeR.exe
  2⤵
  PID:6760
- C:\Windows\System\DxiUCRX.exe
  C:\Windows\System\DxiUCRX.exe
  2⤵
  PID:6776
- C:\Windows\System\bKUOlTo.exe
  C:\Windows\System\bKUOlTo.exe
  2⤵
  PID:6892
- C:\Windows\System\vXbbSdY.exe
  C:\Windows\System\vXbbSdY.exe
  2⤵
  PID:6916
- C:\Windows\System\DGMMdlk.exe
  C:\Windows\System\DGMMdlk.exe
  2⤵
  PID:6976
- C:\Windows\System\bGyozcN.exe
  C:\Windows\System\bGyozcN.exe
  2⤵
  PID:6996
- C:\Windows\System\QEvWCZE.exe
  C:\Windows\System\QEvWCZE.exe
  2⤵
  PID:7012
- C:\Windows\System\ZiPSulB.exe
  C:\Windows\System\ZiPSulB.exe
  2⤵
  PID:7028
- C:\Windows\System\ufdpOsr.exe
  C:\Windows\System\ufdpOsr.exe
  2⤵
  PID:7108
- C:\Windows\System\zvOzVDw.exe
  C:\Windows\System\zvOzVDw.exe
  2⤵
  PID:6020
- C:\Windows\System\snctrdB.exe
  C:\Windows\System\snctrdB.exe
  2⤵
  PID:4452
- C:\Windows\System\FrZjAhf.exe
  C:\Windows\System\FrZjAhf.exe
  2⤵
  PID:5888
- C:\Windows\System\JLepnOd.exe
  C:\Windows\System\JLepnOd.exe
  2⤵
  PID:6188
- C:\Windows\System\cAvHcss.exe
  C:\Windows\System\cAvHcss.exe
  2⤵
  PID:6204
- C:\Windows\System\QwxBPep.exe
  C:\Windows\System\QwxBPep.exe
  2⤵
  PID:6220
- C:\Windows\System\GdfxkFa.exe
  C:\Windows\System\GdfxkFa.exe
  2⤵
  PID:6276
- C:\Windows\System\tsrvdfW.exe
  C:\Windows\System\tsrvdfW.exe
  2⤵
  PID:6324
- C:\Windows\System\OGwXDcY.exe
  C:\Windows\System\OGwXDcY.exe
  2⤵
  PID:6340
- C:\Windows\System\NhuCvig.exe
  C:\Windows\System\NhuCvig.exe
  2⤵
  PID:6436
- C:\Windows\System\lLqfWen.exe
  C:\Windows\System\lLqfWen.exe
  2⤵
  PID:6384
- C:\Windows\System\EryBOlo.exe
  C:\Windows\System\EryBOlo.exe
  2⤵
  PID:6468
- C:\Windows\System\olFWlPH.exe
  C:\Windows\System\olFWlPH.exe
  2⤵
  PID:6484
- C:\Windows\System\FXUankH.exe
  C:\Windows\System\FXUankH.exe
  2⤵
  PID:6532
- C:\Windows\System\wSWzGCW.exe
  C:\Windows\System\wSWzGCW.exe
  2⤵
  PID:6568
- C:\Windows\System\dfCoJVF.exe
  C:\Windows\System\dfCoJVF.exe
  2⤵
  PID:6612
- C:\Windows\System\iOutlFs.exe
  C:\Windows\System\iOutlFs.exe
  2⤵
  PID:6600
- C:\Windows\System\ogmLYGp.exe
  C:\Windows\System\ogmLYGp.exe
  2⤵
  PID:6696
- C:\Windows\System\edeiKHb.exe
  C:\Windows\System\edeiKHb.exe
  2⤵
  PID:6784
- C:\Windows\System\EulMoOF.exe
  C:\Windows\System\EulMoOF.exe
  2⤵
  PID:6804
- C:\Windows\System\JyOmnsk.exe
  C:\Windows\System\JyOmnsk.exe
  2⤵
  PID:6832
- C:\Windows\System\AZFRSZH.exe
  C:\Windows\System\AZFRSZH.exe
  2⤵
  PID:6848
- C:\Windows\System\ULBXLTU.exe
  C:\Windows\System\ULBXLTU.exe
  2⤵
  PID:6864
- C:\Windows\System\lzTaGFT.exe
  C:\Windows\System\lzTaGFT.exe
  2⤵
  PID:6880
- C:\Windows\System\stsnBvS.exe
  C:\Windows\System\stsnBvS.exe
  2⤵
  PID:6900
- C:\Windows\System\sdCzIYg.exe
  C:\Windows\System\sdCzIYg.exe
  2⤵
  PID:6924
- C:\Windows\System\CaWjwGN.exe
  C:\Windows\System\CaWjwGN.exe
  2⤵
  PID:6816
- C:\Windows\System\XoIgeIF.exe
  C:\Windows\System\XoIgeIF.exe
  2⤵
  PID:7116
- C:\Windows\System\EPXQwnd.exe
  C:\Windows\System\EPXQwnd.exe
  2⤵
  PID:6236
- C:\Windows\System\LGtlIDd.exe
  C:\Windows\System\LGtlIDd.exe
  2⤵
  PID:6516
- C:\Windows\System\EVjnNwL.exe
  C:\Windows\System\EVjnNwL.exe
  2⤵
  PID:6656
- C:\Windows\System\aebPCoH.exe
  C:\Windows\System\aebPCoH.exe
  2⤵
  PID:6356
- C:\Windows\System\bavVceJ.exe
  C:\Windows\System\bavVceJ.exe
  2⤵
  PID:6628
- C:\Windows\System\PyfEeyZ.exe
  C:\Windows\System\PyfEeyZ.exe
  2⤵
  PID:6440
- C:\Windows\System\kMioluj.exe
  C:\Windows\System\kMioluj.exe
  2⤵
  PID:6712
- C:\Windows\System\BaVAOVA.exe
  C:\Windows\System\BaVAOVA.exe
  2⤵
  PID:6844
- C:\Windows\System\mvkpKFI.exe
  C:\Windows\System\mvkpKFI.exe
  2⤵
  PID:6908
- C:\Windows\System\lFBfLzV.exe
  C:\Windows\System\lFBfLzV.exe
  2⤵
  PID:6644
- C:\Windows\System\XFSVkSS.exe
  C:\Windows\System\XFSVkSS.exe
  2⤵
  PID:7020
- C:\Windows\System\InuHlRK.exe
  C:\Windows\System\InuHlRK.exe
  2⤵
  PID:5964
- C:\Windows\System\rYFhMoi.exe
  C:\Windows\System\rYFhMoi.exe
  2⤵
  PID:6856
- C:\Windows\System\DHGqZTF.exe
  C:\Windows\System\DHGqZTF.exe
  2⤵
  PID:6752
- C:\Windows\System\PlrNbDM.exe
  C:\Windows\System\PlrNbDM.exe
  2⤵
  PID:7060
- C:\Windows\System\ENeNEEo.exe
  C:\Windows\System\ENeNEEo.exe
  2⤵
  PID:5752
- C:\Windows\System\seTVbOX.exe
  C:\Windows\System\seTVbOX.exe
  2⤵
  PID:7064
- C:\Windows\System\uVTVGPA.exe
  C:\Windows\System\uVTVGPA.exe
  2⤵
  PID:7088
- C:\Windows\System\FYHjcZl.exe
  C:\Windows\System\FYHjcZl.exe
  2⤵
  PID:6988
- C:\Windows\System\NsPdieX.exe
  C:\Windows\System\NsPdieX.exe
  2⤵
  PID:6308
- C:\Windows\System\LIyzZgC.exe
  C:\Windows\System\LIyzZgC.exe
  2⤵
  PID:6504
- C:\Windows\System\XQPDGsK.exe
  C:\Windows\System\XQPDGsK.exe
  2⤵
  PID:6404
- C:\Windows\System\iSbAmxG.exe
  C:\Windows\System\iSbAmxG.exe
  2⤵
  PID:6500
- C:\Windows\System\WhGHvKO.exe
  C:\Windows\System\WhGHvKO.exe
  2⤵
  PID:6800
- C:\Windows\System\aVAUQNk.exe
  C:\Windows\System\aVAUQNk.exe
  2⤵
  PID:7044
- C:\Windows\System\NaoEwVs.exe
  C:\Windows\System\NaoEwVs.exe
  2⤵
  PID:7008
- C:\Windows\System\vSSAKSh.exe
  C:\Windows\System\vSSAKSh.exe
  2⤵
  PID:7140
- C:\Windows\System\BWaUEfh.exe
  C:\Windows\System\BWaUEfh.exe
  2⤵
  PID:7100
- C:\Windows\System\mbewXdx.exe
  C:\Windows\System\mbewXdx.exe
  2⤵
  PID:5968
- C:\Windows\System\UWvFAMB.exe
  C:\Windows\System\UWvFAMB.exe
  2⤵
  PID:6200
- C:\Windows\System\EldzqAI.exe
  C:\Windows\System\EldzqAI.exe
  2⤵
  PID:6928
- C:\Windows\System\zTxPWFt.exe
  C:\Windows\System\zTxPWFt.exe
  2⤵
  PID:6876
- C:\Windows\System\wEReDOI.exe
  C:\Windows\System\wEReDOI.exe
  2⤵
  PID:7092
- C:\Windows\System\OygtetY.exe
  C:\Windows\System\OygtetY.exe
  2⤵
  PID:6312
- C:\Windows\System\oQmbTAj.exe
  C:\Windows\System\oQmbTAj.exe
  2⤵
  PID:6796
- C:\Windows\System\wFAAqkw.exe
  C:\Windows\System\wFAAqkw.exe
  2⤵
  PID:7160
- C:\Windows\System\veYYZYr.exe
  C:\Windows\System\veYYZYr.exe
  2⤵
  PID:7048
- C:\Windows\System\PhzEtUp.exe
  C:\Windows\System\PhzEtUp.exe
  2⤵
  PID:6756
- C:\Windows\System\SrelcuW.exe
  C:\Windows\System\SrelcuW.exe
  2⤵
  PID:7052
- C:\Windows\System\eaeguDI.exe
  C:\Windows\System\eaeguDI.exe
  2⤵
  PID:6812
- C:\Windows\System\XUjIIxw.exe
  C:\Windows\System\XUjIIxw.exe
  2⤵
  PID:6824
- C:\Windows\System\pAJtSpO.exe
  C:\Windows\System\pAJtSpO.exe
  2⤵
  PID:7136
- C:\Windows\System\WjeQbBf.exe
  C:\Windows\System\WjeQbBf.exe
  2⤵
  PID:5392
- C:\Windows\System\vguPfVQ.exe
  C:\Windows\System\vguPfVQ.exe
  2⤵
  PID:6292
- C:\Windows\System\MaFfqNt.exe
  C:\Windows\System\MaFfqNt.exe
  2⤵
  PID:6792
- C:\Windows\System\Cdntakt.exe
  C:\Windows\System\Cdntakt.exe
  2⤵
  PID:7128
- C:\Windows\System\amkoEDp.exe
  C:\Windows\System\amkoEDp.exe
  2⤵
  PID:7152
- C:\Windows\System\GKxqLiG.exe
  C:\Windows\System\GKxqLiG.exe
  2⤵
  PID:6424
- C:\Windows\System\GZjcSLv.exe
  C:\Windows\System\GZjcSLv.exe
  2⤵
  PID:6248
- C:\Windows\System\aHlhBGJ.exe
  C:\Windows\System\aHlhBGJ.exe
  2⤵
  PID:6596
- C:\Windows\System\wsPczCs.exe
  C:\Windows\System\wsPczCs.exe
  2⤵
  PID:6160
- C:\Windows\System\FqQETis.exe
  C:\Windows\System\FqQETis.exe
  2⤵
  PID:7156
- C:\Windows\System\AqrRdKQ.exe
  C:\Windows\System\AqrRdKQ.exe
  2⤵
  PID:7184
- C:\Windows\System\WKCFFuU.exe
  C:\Windows\System\WKCFFuU.exe
  2⤵
  PID:7200
- C:\Windows\System\TbxFuvh.exe
  C:\Windows\System\TbxFuvh.exe
  2⤵
  PID:7216
- C:\Windows\System\IzchUXq.exe
  C:\Windows\System\IzchUXq.exe
  2⤵
  PID:7232
- C:\Windows\System\GLvULaz.exe
  C:\Windows\System\GLvULaz.exe
  2⤵
  PID:7248
- C:\Windows\System\POLNiES.exe
  C:\Windows\System\POLNiES.exe
  2⤵
  PID:7264
- C:\Windows\System\afeLzxl.exe
  C:\Windows\System\afeLzxl.exe
  2⤵
  PID:7280
- C:\Windows\System\vpvtayM.exe
  C:\Windows\System\vpvtayM.exe
  2⤵
  PID:7296
- C:\Windows\System\gwCnZVz.exe
  C:\Windows\System\gwCnZVz.exe
  2⤵
  PID:7312
- C:\Windows\System\lRnEUmP.exe
  C:\Windows\System\lRnEUmP.exe
  2⤵
  PID:7528
- C:\Windows\System\NterGeA.exe
  C:\Windows\System\NterGeA.exe
  2⤵
  PID:7544
- C:\Windows\System\tffkZXO.exe
  C:\Windows\System\tffkZXO.exe
  2⤵
  PID:7576
- C:\Windows\System\CjVqrUY.exe
  C:\Windows\System\CjVqrUY.exe
  2⤵
  PID:7592
- C:\Windows\System\OVfavZH.exe
  C:\Windows\System\OVfavZH.exe
  2⤵
  PID:7608
- C:\Windows\System\PGKuHVC.exe
  C:\Windows\System\PGKuHVC.exe
  2⤵
  PID:7636
- C:\Windows\System\cpDBLtP.exe
  C:\Windows\System\cpDBLtP.exe
  2⤵
  PID:7652
- C:\Windows\System\CMRLzXU.exe
  C:\Windows\System\CMRLzXU.exe
  2⤵
  PID:7668
- C:\Windows\System\HytMLUB.exe
  C:\Windows\System\HytMLUB.exe
  2⤵
  PID:7684
- C:\Windows\System\AjfKmHH.exe
  C:\Windows\System\AjfKmHH.exe
  2⤵
  PID:7700
- C:\Windows\System\mMJxqDR.exe
  C:\Windows\System\mMJxqDR.exe
  2⤵
  PID:7716
- C:\Windows\System\CTlEQSJ.exe
  C:\Windows\System\CTlEQSJ.exe
  2⤵
  PID:7732
- C:\Windows\System\wAQATRe.exe
  C:\Windows\System\wAQATRe.exe
  2⤵
  PID:7912
- C:\Windows\System\OhvsiRO.exe
  C:\Windows\System\OhvsiRO.exe
  2⤵
  PID:7936
- C:\Windows\System\tKlVyTM.exe
  C:\Windows\System\tKlVyTM.exe
  2⤵
  PID:7984
- C:\Windows\System\nVXFRHd.exe
  C:\Windows\System\nVXFRHd.exe
  2⤵
  PID:8000
- C:\Windows\System\ZoMHNtw.exe
  C:\Windows\System\ZoMHNtw.exe
  2⤵
  PID:8020
- C:\Windows\System\RmmprVR.exe
  C:\Windows\System\RmmprVR.exe
  2⤵
  PID:8036
- C:\Windows\System\cKTCEoN.exe
  C:\Windows\System\cKTCEoN.exe
  2⤵
  PID:8052
- C:\Windows\System\cUjkfFL.exe
  C:\Windows\System\cUjkfFL.exe
  2⤵
  PID:8068
- C:\Windows\System\JFKMWzM.exe
  C:\Windows\System\JFKMWzM.exe
  2⤵
  PID:8084
- C:\Windows\System\pfEuKTI.exe
  C:\Windows\System\pfEuKTI.exe
  2⤵
  PID:8100
- C:\Windows\System\PcWYWJx.exe
  C:\Windows\System\PcWYWJx.exe
  2⤵
  PID:8120
- C:\Windows\System\gHClZJL.exe
  C:\Windows\System\gHClZJL.exe
  2⤵
  PID:8136
- C:\Windows\System\AoBadTp.exe
  C:\Windows\System\AoBadTp.exe
  2⤵
  PID:8152
- C:\Windows\System\iDtsSMg.exe
  C:\Windows\System\iDtsSMg.exe
  2⤵
  PID:8168
- C:\Windows\System\WyynEEB.exe
  C:\Windows\System\WyynEEB.exe
  2⤵
  PID:8184
- C:\Windows\System\KFvPlvt.exe
  C:\Windows\System\KFvPlvt.exe
  2⤵
  PID:6564
- C:\Windows\System\npZJpAr.exe
  C:\Windows\System\npZJpAr.exe
  2⤵
  PID:7256
- C:\Windows\System\AEZERgW.exe
  C:\Windows\System\AEZERgW.exe
  2⤵
  PID:6968
- C:\Windows\System\roycUYm.exe
  C:\Windows\System\roycUYm.exe
  2⤵
  PID:6320
- C:\Windows\System\ujPnBUh.exe
  C:\Windows\System\ujPnBUh.exe
  2⤵
  PID:5872
- C:\Windows\System\IGUkVCW.exe
  C:\Windows\System\IGUkVCW.exe
  2⤵
  PID:5512
- C:\Windows\System\ANWKOeV.exe
  C:\Windows\System\ANWKOeV.exe
  2⤵
  PID:7176
- C:\Windows\System\kzKktOu.exe
  C:\Windows\System\kzKktOu.exe
  2⤵
  PID:6288
- C:\Windows\System\UNpYBBq.exe
  C:\Windows\System\UNpYBBq.exe
  2⤵
  PID:7208
- C:\Windows\System\HuQmTId.exe
  C:\Windows\System\HuQmTId.exe
  2⤵
  PID:7328
- C:\Windows\System\bFXNCtU.exe
  C:\Windows\System\bFXNCtU.exe
  2⤵
  PID:6828
- C:\Windows\System\bMRdRvG.exe
  C:\Windows\System\bMRdRvG.exe
  2⤵
  PID:7360
- C:\Windows\System\wTVHgoz.exe
  C:\Windows\System\wTVHgoz.exe
  2⤵
  PID:7376
- C:\Windows\System\dkgINiR.exe
  C:\Windows\System\dkgINiR.exe
  2⤵
  PID:7392
- C:\Windows\System\FMbBxmS.exe
  C:\Windows\System\FMbBxmS.exe
  2⤵
  PID:7408
- C:\Windows\System\XEykDym.exe
  C:\Windows\System\XEykDym.exe
  2⤵
  PID:7424
- C:\Windows\System\HEpGLOP.exe
  C:\Windows\System\HEpGLOP.exe
  2⤵
  PID:7440
- C:\Windows\System\zKjkCSA.exe
  C:\Windows\System\zKjkCSA.exe
  2⤵
  PID:7472
- C:\Windows\System\CUGoFKG.exe
  C:\Windows\System\CUGoFKG.exe
  2⤵
  PID:7476
- C:\Windows\System\TaQfQLu.exe
  C:\Windows\System\TaQfQLu.exe
  2⤵
  PID:7492
- C:\Windows\System\AwlzdKL.exe
  C:\Windows\System\AwlzdKL.exe
  2⤵
  PID:7536
- C:\Windows\System\ImRguAi.exe
  C:\Windows\System\ImRguAi.exe
  2⤵
  PID:7520
- C:\Windows\System\ZsFICjg.exe
  C:\Windows\System\ZsFICjg.exe
  2⤵
  PID:7568
- C:\Windows\System\RZdQfaP.exe
  C:\Windows\System\RZdQfaP.exe
  2⤵
  PID:2400
- C:\Windows\System\QIFwsFq.exe
  C:\Windows\System\QIFwsFq.exe
  2⤵
  PID:2972
- C:\Windows\System\HEFCgsw.exe
  C:\Windows\System\HEFCgsw.exe
  2⤵
  PID:7648
- C:\Windows\System\IfcWVtQ.exe
  C:\Windows\System\IfcWVtQ.exe
  2⤵
  PID:7964
- C:\Windows\System\wXhKUDN.exe
  C:\Windows\System\wXhKUDN.exe
  2⤵
  PID:7980
- C:\Windows\System\JoLLdzC.exe
  C:\Windows\System\JoLLdzC.exe
  2⤵
  PID:7992
- C:\Windows\System\JFLkrbr.exe
  C:\Windows\System\JFLkrbr.exe
  2⤵
  PID:8064
- C:\Windows\System\TLniBiY.exe
  C:\Windows\System\TLniBiY.exe
  2⤵
  PID:8176
- C:\Windows\System\QNoHmlW.exe
  C:\Windows\System\QNoHmlW.exe
  2⤵
  PID:8160
- C:\Windows\System\HEOeepK.exe
  C:\Windows\System\HEOeepK.exe
  2⤵
  PID:6888
- C:\Windows\System\pMVHLbB.exe
  C:\Windows\System\pMVHLbB.exe
  2⤵
  PID:5684
- C:\Windows\System\gHgcxlp.exe
  C:\Windows\System\gHgcxlp.exe
  2⤵
  PID:6196
- C:\Windows\System\kOaGbeJ.exe
  C:\Windows\System\kOaGbeJ.exe
  2⤵
  PID:7416
- C:\Windows\System\qlUMYZl.exe
  C:\Windows\System\qlUMYZl.exe
  2⤵
  PID:7432
- C:\Windows\System\mMMSSBF.exe
  C:\Windows\System\mMMSSBF.exe
  2⤵
  PID:7404
- C:\Windows\System\pFpZMbI.exe
  C:\Windows\System\pFpZMbI.exe
  2⤵
  PID:7368
- C:\Windows\System\LtzELXl.exe
  C:\Windows\System\LtzELXl.exe
  2⤵
  PID:7552
- C:\Windows\System\RSkoluK.exe
  C:\Windows\System\RSkoluK.exe
  2⤵
  PID:7584
- C:\Windows\System\UJlTWjS.exe
  C:\Windows\System\UJlTWjS.exe
  2⤵
  PID:7604
- C:\Windows\System\OATqPXQ.exe
  C:\Windows\System\OATqPXQ.exe
  2⤵
  PID:7972
- C:\Windows\System\JtKaJWk.exe
  C:\Windows\System\JtKaJWk.exe
  2⤵
  PID:8180
- C:\Windows\System\zsyvzng.exe
  C:\Windows\System\zsyvzng.exe
  2⤵
  PID:7320
- C:\Windows\System\kScwmoM.exe
  C:\Windows\System\kScwmoM.exe
  2⤵
  PID:7512
- C:\Windows\System\GTnUvLX.exe
  C:\Windows\System\GTnUvLX.exe
  2⤵
  PID:7748
- C:\Windows\System\naSjcjV.exe
  C:\Windows\System\naSjcjV.exe
  2⤵
  PID:7676
- C:\Windows\System\yKvhYFm.exe
  C:\Windows\System\yKvhYFm.exe
  2⤵
  PID:7388
- C:\Windows\System\ahywjCN.exe
  C:\Windows\System\ahywjCN.exe
  2⤵
  PID:7740
- C:\Windows\System\YcFobxF.exe
  C:\Windows\System\YcFobxF.exe
  2⤵
  PID:7924
- C:\Windows\System\gvOSrkO.exe
  C:\Windows\System\gvOSrkO.exe
  2⤵
  PID:7808
- C:\Windows\System\krRYyOe.exe
  C:\Windows\System\krRYyOe.exe
  2⤵
  PID:7872
- C:\Windows\System\ncuxKiS.exe
  C:\Windows\System\ncuxKiS.exe
  2⤵
  PID:7956
- C:\Windows\System\lkRsIbv.exe
  C:\Windows\System\lkRsIbv.exe
  2⤵
  PID:8076
- C:\Windows\System\ACCgnjC.exe
  C:\Windows\System\ACCgnjC.exe
  2⤵
  PID:7660
- C:\Windows\System\RFUHlOB.exe
  C:\Windows\System\RFUHlOB.exe
  2⤵
  PID:7340
- C:\Windows\System\yzDgTyG.exe
  C:\Windows\System\yzDgTyG.exe
  2⤵
  PID:7752
- C:\Windows\System\RRqTNyi.exe
  C:\Windows\System\RRqTNyi.exe
  2⤵
  PID:7756
- C:\Windows\System\nRRZpcQ.exe
  C:\Windows\System\nRRZpcQ.exe
  2⤵
  PID:7868
- C:\Windows\System\vnqtCSV.exe
  C:\Windows\System\vnqtCSV.exe
  2⤵
  PID:7952
- C:\Windows\System\AYMRHTP.exe
  C:\Windows\System\AYMRHTP.exe
  2⤵
  PID:8108
- C:\Windows\System\pimbFDg.exe
  C:\Windows\System\pimbFDg.exe
  2⤵
  PID:7228
- C:\Windows\System\XfOjLfq.exe
  C:\Windows\System\XfOjLfq.exe
  2⤵
  PID:8028
- C:\Windows\System\HyyIxLx.exe
  C:\Windows\System\HyyIxLx.exe
  2⤵
  PID:7456
- C:\Windows\System\HaSoOmH.exe
  C:\Windows\System\HaSoOmH.exe
  2⤵
  PID:7976
- C:\Windows\System\gpNhCSW.exe
  C:\Windows\System\gpNhCSW.exe
  2⤵
  PID:7960
- C:\Windows\System\KTEOZpA.exe
  C:\Windows\System\KTEOZpA.exe
  2⤵
  PID:7324
- C:\Windows\System\RRWgaeZ.exe
  C:\Windows\System\RRWgaeZ.exe
  2⤵
  PID:960
- C:\Windows\System\VtGdEWG.exe
  C:\Windows\System\VtGdEWG.exe
  2⤵
  PID:2100
- C:\Windows\System\hOqfSgr.exe
  C:\Windows\System\hOqfSgr.exe
  2⤵
  PID:7900
- C:\Windows\System\QINpuJx.exe
  C:\Windows\System\QINpuJx.exe
  2⤵
  PID:7624
- C:\Windows\System\oeijaiD.exe
  C:\Windows\System\oeijaiD.exe
  2⤵
  PID:2824
- C:\Windows\System\azDxfID.exe
  C:\Windows\System\azDxfID.exe
  2⤵
  PID:7288
- C:\Windows\System\KKcDPAA.exe
  C:\Windows\System\KKcDPAA.exe
  2⤵
  PID:7352
- C:\Windows\System\pZOFZSy.exe
  C:\Windows\System\pZOFZSy.exe
  2⤵
  PID:7212
- C:\Windows\System\MWqUAEo.exe
  C:\Windows\System\MWqUAEo.exe
  2⤵
  PID:7856
- C:\Windows\System\gCxoPQo.exe
  C:\Windows\System\gCxoPQo.exe
  2⤵
  PID:7928
- C:\Windows\System\nfzrORf.exe
  C:\Windows\System\nfzrORf.exe
  2⤵
  PID:7832
- C:\Windows\System\UOsEuTw.exe
  C:\Windows\System\UOsEuTw.exe
  2⤵
  PID:7824
- C:\Windows\System\KjHQMuh.exe
  C:\Windows\System\KjHQMuh.exe
  2⤵
  PID:6232
- C:\Windows\System\MNEZecP.exe
  C:\Windows\System\MNEZecP.exe
  2⤵
  PID:7464
- C:\Windows\System\ThmsRax.exe
  C:\Windows\System\ThmsRax.exe
  2⤵
  PID:7556
- C:\Windows\System\JxZRxQx.exe
  C:\Windows\System\JxZRxQx.exe
  2⤵
  PID:2516
- C:\Windows\System\vfUggOS.exe
  C:\Windows\System\vfUggOS.exe
  2⤵
  PID:920
- C:\Windows\System\SyAddNR.exe
  C:\Windows\System\SyAddNR.exe
  2⤵
  PID:7948
- C:\Windows\System\GKJiUPB.exe
  C:\Windows\System\GKJiUPB.exe
  2⤵
  PID:7276
- C:\Windows\System\PHyWsrX.exe
  C:\Windows\System\PHyWsrX.exe
  2⤵
  PID:7452
- C:\Windows\System\rPxndoQ.exe
  C:\Windows\System\rPxndoQ.exe
  2⤵
  PID:7040
- C:\Windows\System\ZHgentE.exe
  C:\Windows\System\ZHgentE.exe
  2⤵
  PID:7828
- C:\Windows\System\gVfRuxg.exe
  C:\Windows\System\gVfRuxg.exe
  2⤵
  PID:7816
- C:\Windows\System\xqaSqHb.exe
  C:\Windows\System\xqaSqHb.exe
  2⤵
  PID:7436
- C:\Windows\System\LHmhqMo.exe
  C:\Windows\System\LHmhqMo.exe
  2⤵
  PID:7904
- C:\Windows\System\LmZoUfY.exe
  C:\Windows\System\LmZoUfY.exe
  2⤵
  PID:2592
- C:\Windows\System\UcbGdgZ.exe
  C:\Windows\System\UcbGdgZ.exe
  2⤵
  PID:5536
- C:\Windows\System\FlBFDFF.exe
  C:\Windows\System\FlBFDFF.exe
  2⤵
  PID:7876
- C:\Windows\System\TAuQeqY.exe
  C:\Windows\System\TAuQeqY.exe
  2⤵
  PID:7908
- C:\Windows\System\svRwQtx.exe
  C:\Windows\System\svRwQtx.exe
  2⤵
  PID:8080
- C:\Windows\System\XqfpBXw.exe
  C:\Windows\System\XqfpBXw.exe
  2⤵
  PID:8208
- C:\Windows\System\GPgmDnY.exe
  C:\Windows\System\GPgmDnY.exe
  2⤵
  PID:8224
- C:\Windows\System\xscdvKA.exe
  C:\Windows\System\xscdvKA.exe
  2⤵
  PID:8240
- C:\Windows\System\yLSMGur.exe
  C:\Windows\System\yLSMGur.exe
  2⤵
  PID:8268
- C:\Windows\System\UDDOOud.exe
  C:\Windows\System\UDDOOud.exe
  2⤵
  PID:8284
- C:\Windows\System\afhpHcQ.exe
  C:\Windows\System\afhpHcQ.exe
  2⤵
  PID:8304
- C:\Windows\System\vFQDMuT.exe
  C:\Windows\System\vFQDMuT.exe
  2⤵
  PID:8320
- C:\Windows\System\gTORYEO.exe
  C:\Windows\System\gTORYEO.exe
  2⤵
  PID:8336
- C:\Windows\System\aJNDtqK.exe
  C:\Windows\System\aJNDtqK.exe
  2⤵
  PID:8352
- C:\Windows\System\DqEluKi.exe
  C:\Windows\System\DqEluKi.exe
  2⤵
  PID:8368
- C:\Windows\System\tVlCWfG.exe
  C:\Windows\System\tVlCWfG.exe
  2⤵
  PID:8384
- C:\Windows\System\waYYwGb.exe
  C:\Windows\System\waYYwGb.exe
  2⤵
  PID:8400
- C:\Windows\System\PUvPMKt.exe
  C:\Windows\System\PUvPMKt.exe
  2⤵
  PID:8416
- C:\Windows\System\EwRGUZI.exe
  C:\Windows\System\EwRGUZI.exe
  2⤵
  PID:8440
- C:\Windows\System\ZaaNSlR.exe
  C:\Windows\System\ZaaNSlR.exe
  2⤵
  PID:8456
- C:\Windows\System\Onbvzzd.exe
  C:\Windows\System\Onbvzzd.exe
  2⤵
  PID:8472
- C:\Windows\System\mrxxebE.exe
  C:\Windows\System\mrxxebE.exe
  2⤵
  PID:8488
- C:\Windows\System\lxLhBZX.exe
  C:\Windows\System\lxLhBZX.exe
  2⤵
  PID:8512
- C:\Windows\System\wHZJgAX.exe
  C:\Windows\System\wHZJgAX.exe
  2⤵
  PID:8544
- C:\Windows\System\RgKbKYv.exe
  C:\Windows\System\RgKbKYv.exe
  2⤵
  PID:8560
- C:\Windows\System\EPnxghS.exe
  C:\Windows\System\EPnxghS.exe
  2⤵
  PID:8580
- C:\Windows\System\xiVWPjd.exe
  C:\Windows\System\xiVWPjd.exe
  2⤵
  PID:8596
- C:\Windows\System\ZaewBwX.exe
  C:\Windows\System\ZaewBwX.exe
  2⤵
  PID:8612
- C:\Windows\System\ijUQcNo.exe
  C:\Windows\System\ijUQcNo.exe
  2⤵
  PID:8628
- C:\Windows\System\dKyofHf.exe
  C:\Windows\System\dKyofHf.exe
  2⤵
  PID:8652
- C:\Windows\System\pcnpByR.exe
  C:\Windows\System\pcnpByR.exe
  2⤵
  PID:8672
- C:\Windows\System\BFJjyWj.exe
  C:\Windows\System\BFJjyWj.exe
  2⤵
  PID:8696
- C:\Windows\System\hwJxbmA.exe
  C:\Windows\System\hwJxbmA.exe
  2⤵
  PID:8716
- C:\Windows\System\eWeBdFl.exe
  C:\Windows\System\eWeBdFl.exe
  2⤵
  PID:8732
- C:\Windows\System\LwoXdQj.exe
  C:\Windows\System\LwoXdQj.exe
  2⤵
  PID:8752
- C:\Windows\System\QmapCNp.exe
  C:\Windows\System\QmapCNp.exe
  2⤵
  PID:8768
- C:\Windows\System\iAyaPgc.exe
  C:\Windows\System\iAyaPgc.exe
  2⤵
  PID:8784
- C:\Windows\System\sWPHdbl.exe
  C:\Windows\System\sWPHdbl.exe
  2⤵
  PID:8800
- C:\Windows\System\ETVTJhA.exe
  C:\Windows\System\ETVTJhA.exe
  2⤵
  PID:8820
- C:\Windows\System\eEsrbwT.exe
  C:\Windows\System\eEsrbwT.exe
  2⤵
  PID:8836
- C:\Windows\System\mYhFNIY.exe
  C:\Windows\System\mYhFNIY.exe
  2⤵
  PID:8852
- C:\Windows\System\JlWHOyn.exe
  C:\Windows\System\JlWHOyn.exe
  2⤵
  PID:8868
- C:\Windows\System\BTVadhj.exe
  C:\Windows\System\BTVadhj.exe
  2⤵
  PID:8888
- C:\Windows\System\pLYGUVs.exe
  C:\Windows\System\pLYGUVs.exe
  2⤵
  PID:8904
- C:\Windows\System\mOaLAip.exe
  C:\Windows\System\mOaLAip.exe
  2⤵
  PID:8920
- C:\Windows\System\VvruqFz.exe
  C:\Windows\System\VvruqFz.exe
  2⤵
  PID:8936
- C:\Windows\System\gUxIRMH.exe
  C:\Windows\System\gUxIRMH.exe
  2⤵
  PID:8952
- C:\Windows\System\KmZUPHu.exe
  C:\Windows\System\KmZUPHu.exe
  2⤵
  PID:8984
- C:\Windows\System\qPQJwlC.exe
  C:\Windows\System\qPQJwlC.exe
  2⤵
  PID:9000
- C:\Windows\System\CjSErFW.exe
  C:\Windows\System\CjSErFW.exe
  2⤵
  PID:9016
- C:\Windows\System\SYTdfJQ.exe
  C:\Windows\System\SYTdfJQ.exe
  2⤵
  PID:9032
- C:\Windows\System\WWXofru.exe
  C:\Windows\System\WWXofru.exe
  2⤵
  PID:9048
- C:\Windows\System\XyBlmxQ.exe
  C:\Windows\System\XyBlmxQ.exe
  2⤵
  PID:9064
- C:\Windows\System\zqopiiS.exe
  C:\Windows\System\zqopiiS.exe
  2⤵
  PID:9080
- C:\Windows\System\ByFqzBe.exe
  C:\Windows\System\ByFqzBe.exe
  2⤵
  PID:9096
- C:\Windows\System\PYWlszG.exe
  C:\Windows\System\PYWlszG.exe
  2⤵
  PID:9112
- C:\Windows\System\EukFWYg.exe
  C:\Windows\System\EukFWYg.exe
  2⤵
  PID:9132
- C:\Windows\System\SHFqaGH.exe
  C:\Windows\System\SHFqaGH.exe
  2⤵
  PID:9148
- C:\Windows\System\qlscESq.exe
  C:\Windows\System\qlscESq.exe
  2⤵
  PID:9164
- C:\Windows\System\FKNAlBF.exe
  C:\Windows\System\FKNAlBF.exe
  2⤵
  PID:9180
- C:\Windows\System\dPqpmuR.exe
  C:\Windows\System\dPqpmuR.exe
  2⤵
  PID:9196
- C:\Windows\System\YynYtTr.exe
  C:\Windows\System\YynYtTr.exe
  2⤵
  PID:9212
- C:\Windows\System\wSpyLYq.exe
  C:\Windows\System\wSpyLYq.exe
  2⤵
  PID:952
- C:\Windows\System\wwkNDFn.exe
  C:\Windows\System\wwkNDFn.exe
  2⤵
  PID:7448
- C:\Windows\System\aocQDEh.exe
  C:\Windows\System\aocQDEh.exe
  2⤵
  PID:7180
- C:\Windows\System\wTrJKXW.exe
  C:\Windows\System\wTrJKXW.exe
  2⤵
  PID:7504
- C:\Windows\System\hefMRTk.exe
  C:\Windows\System\hefMRTk.exe
  2⤵
  PID:8220
- C:\Windows\System\MobAptB.exe
  C:\Windows\System\MobAptB.exe
  2⤵
  PID:8204
- C:\Windows\System\pxUXtnf.exe
  C:\Windows\System\pxUXtnf.exe
  2⤵
  PID:8248
- C:\Windows\System\xFHDPCv.exe
  C:\Windows\System\xFHDPCv.exe
  2⤵
  PID:8260
- C:\Windows\System\bHRogLw.exe
  C:\Windows\System\bHRogLw.exe
  2⤵
  PID:8296
- C:\Windows\System\UoswjCF.exe
  C:\Windows\System\UoswjCF.exe
  2⤵
  PID:8360
- C:\Windows\System\bKufJgH.exe
  C:\Windows\System\bKufJgH.exe
  2⤵
  PID:8432
- C:\Windows\System\xPoNsWX.exe
  C:\Windows\System\xPoNsWX.exe
  2⤵
  PID:8276
- C:\Windows\System\AVrHVnO.exe
  C:\Windows\System\AVrHVnO.exe
  2⤵
  PID:8344
- C:\Windows\System\qQRzenb.exe
  C:\Windows\System\qQRzenb.exe
  2⤵
  PID:8380
- C:\Windows\System\qfKrPUU.exe
  C:\Windows\System\qfKrPUU.exe
  2⤵
  PID:8508
- C:\Windows\System\dFopiXf.exe
  C:\Windows\System\dFopiXf.exe
  2⤵
  PID:8552
- C:\Windows\System\waBvQKF.exe
  C:\Windows\System\waBvQKF.exe
  2⤵
  PID:8624
- C:\Windows\System\jJcUqWs.exe
  C:\Windows\System\jJcUqWs.exe
  2⤵
  PID:8748
- C:\Windows\System\tNWCLBA.exe
  C:\Windows\System\tNWCLBA.exe
  2⤵
  PID:8572
- C:\Windows\System\BLiOBVA.exe
  C:\Windows\System\BLiOBVA.exe
  2⤵
  PID:8844
- C:\Windows\System\lJIJuQO.exe
  C:\Windows\System\lJIJuQO.exe
  2⤵
  PID:8648
- C:\Windows\System\hwOPajY.exe
  C:\Windows\System\hwOPajY.exe
  2⤵
  PID:8876
- C:\Windows\System\sTbYckR.exe
  C:\Windows\System\sTbYckR.exe
  2⤵
  PID:8728
- C:\Windows\System\NyBKXjR.exe
  C:\Windows\System\NyBKXjR.exe
  2⤵
  PID:8884
- C:\Windows\System\cFXbCuw.exe
  C:\Windows\System\cFXbCuw.exe
  2⤵
  PID:8944
- C:\Windows\System\lFdwZCe.exe
  C:\Windows\System\lFdwZCe.exe
  2⤵
  PID:8828
- C:\Windows\System\bwHLokv.exe
  C:\Windows\System\bwHLokv.exe
  2⤵
  PID:8996
- C:\Windows\System\EpzZQrD.exe
  C:\Windows\System\EpzZQrD.exe
  2⤵
  PID:8896
- C:\Windows\System\eGuJCwI.exe
  C:\Windows\System\eGuJCwI.exe
  2⤵
  PID:9092
- C:\Windows\System\qWukrYY.exe
  C:\Windows\System\qWukrYY.exe
  2⤵
  PID:8968
- C:\Windows\System\HgkWhvI.exe
  C:\Windows\System\HgkWhvI.exe
  2⤵
  PID:9156
- C:\Windows\System\ikalHuc.exe
  C:\Windows\System\ikalHuc.exe
  2⤵
  PID:8980
- C:\Windows\System\RpQgdEu.exe
  C:\Windows\System\RpQgdEu.exe
  2⤵
  PID:9188
- C:\Windows\System\cFCZjnf.exe
  C:\Windows\System\cFCZjnf.exe
  2⤵
  PID:8148
- C:\Windows\System\uHWxBlw.exe
  C:\Windows\System\uHWxBlw.exe
  2⤵
  PID:9108
- C:\Windows\System\lDCNuoM.exe
  C:\Windows\System\lDCNuoM.exe
  2⤵
  PID:9204
- C:\Windows\System\PMLZNLz.exe
  C:\Windows\System\PMLZNLz.exe
  2⤵
  PID:7728
- C:\Windows\System\txEeWUX.exe
  C:\Windows\System\txEeWUX.exe
  2⤵
  PID:7776
- C:\Windows\System\qZgzUeK.exe
  C:\Windows\System\qZgzUeK.exe
  2⤵
  PID:8292
- C:\Windows\System\ZbqFbJv.exe
  C:\Windows\System\ZbqFbJv.exe
  2⤵
  PID:8196
- C:\Windows\System\HqGLmgc.exe
  C:\Windows\System\HqGLmgc.exe
  2⤵
  PID:8256
- C:\Windows\System\leRmpuW.exe
  C:\Windows\System\leRmpuW.exe
  2⤵
  PID:8312
- C:\Windows\System\TOxnxfa.exe
  C:\Windows\System\TOxnxfa.exe
  2⤵
  PID:8588
- C:\Windows\System\zmoKLHY.exe
  C:\Windows\System\zmoKLHY.exe
  2⤵
  PID:8412
- C:\Windows\System\VbKEqPp.exe
  C:\Windows\System\VbKEqPp.exe
  2⤵
  PID:7896
- C:\Windows\System\CTQeFFQ.exe
  C:\Windows\System\CTQeFFQ.exe
  2⤵
  PID:8532
- C:\Windows\System\JbjwhVJ.exe
  C:\Windows\System\JbjwhVJ.exe
  2⤵
  PID:8576
- C:\Windows\System\pjeucPJ.exe
  C:\Windows\System\pjeucPJ.exe
  2⤵
  PID:8660
- C:\Windows\System\uEAJxqh.exe
  C:\Windows\System\uEAJxqh.exe
  2⤵
  PID:9060
- C:\Windows\System\OIoDvmB.exe
  C:\Windows\System\OIoDvmB.exe
  2⤵
  PID:8644
- C:\Windows\System\xUwrOfH.exe
  C:\Windows\System\xUwrOfH.exe
  2⤵
  PID:8860
- C:\Windows\System\nhJocUV.exe
  C:\Windows\System\nhJocUV.exe
  2⤵
  PID:8912
- C:\Windows\System\bhbKWhY.exe
  C:\Windows\System\bhbKWhY.exe
  2⤵
  PID:8764
- C:\Windows\System\KZMfZGS.exe
  C:\Windows\System\KZMfZGS.exe
  2⤵
  PID:7308
- C:\Windows\System\wJZPnmd.exe
  C:\Windows\System\wJZPnmd.exe
  2⤵
  PID:8932
- C:\Windows\System\sXHLWZT.exe
  C:\Windows\System\sXHLWZT.exe
  2⤵
  PID:9124
- C:\Windows\System\XNhdMZg.exe
  C:\Windows\System\XNhdMZg.exe
  2⤵
  PID:9076
- C:\Windows\System\WmDAPuz.exe
  C:\Windows\System\WmDAPuz.exe
  2⤵
  PID:9140
- C:\Windows\System\qdZHxoN.exe
  C:\Windows\System\qdZHxoN.exe
  2⤵
  PID:9044
- C:\Windows\System\XhHaBaW.exe
  C:\Windows\System\XhHaBaW.exe
  2⤵
  PID:8328
- C:\Windows\System\EiQIKSQ.exe
  C:\Windows\System\EiQIKSQ.exe
  2⤵
  PID:8504
- C:\Windows\System\Ewbdycm.exe
  C:\Windows\System\Ewbdycm.exe
  2⤵
  PID:8408
- C:\Windows\System\YJEPRiM.exe
  C:\Windows\System\YJEPRiM.exe
  2⤵
  PID:8668
- C:\Windows\System\VfEgiTV.exe
  C:\Windows\System\VfEgiTV.exe
  2⤵
  PID:8664
- C:\Windows\System\eLQoFDy.exe
  C:\Windows\System\eLQoFDy.exe
  2⤵
  PID:8724
- C:\Windows\System\WGWjIdk.exe
  C:\Windows\System\WGWjIdk.exe
  2⤵
  PID:8640
- C:\Windows\System\NVYdcON.exe
  C:\Windows\System\NVYdcON.exe
  2⤵
  PID:9028
- C:\Windows\System\ibKbqoZ.exe
  C:\Windows\System\ibKbqoZ.exe
  2⤵
  PID:9008
- C:\Windows\System\NWKgOCF.exe
  C:\Windows\System\NWKgOCF.exe
  2⤵
  PID:8964
- C:\Windows\System\pbRAmBZ.exe
  C:\Windows\System\pbRAmBZ.exe
  2⤵
  PID:8500
- C:\Windows\System\BozWLtG.exe
  C:\Windows\System\BozWLtG.exe
  2⤵
  PID:9172
- C:\Windows\System\AXUikDV.exe
  C:\Windows\System\AXUikDV.exe
  2⤵
  PID:8376
- C:\Windows\System\WUBVsed.exe
  C:\Windows\System\WUBVsed.exe
  2⤵
  PID:8704
- C:\Windows\System\oGnZeei.exe
  C:\Windows\System\oGnZeei.exe
  2⤵
  PID:7632
- C:\Windows\System\IkaTFcS.exe
  C:\Windows\System\IkaTFcS.exe
  2⤵
  PID:8740
- C:\Windows\System\IdYrztu.exe
  C:\Windows\System\IdYrztu.exe
  2⤵
  PID:9232
- C:\Windows\System\jyrpKQL.exe
  C:\Windows\System\jyrpKQL.exe
  2⤵
  PID:9252
- C:\Windows\System\herDSqe.exe
  C:\Windows\System\herDSqe.exe
  2⤵
  PID:9268
- C:\Windows\System\eNxzKBG.exe
  C:\Windows\System\eNxzKBG.exe
  2⤵
  PID:9288
- C:\Windows\System\wtAHYeq.exe
  C:\Windows\System\wtAHYeq.exe
  2⤵
  PID:9308
- C:\Windows\System\Lnqfaud.exe
  C:\Windows\System\Lnqfaud.exe
  2⤵
  PID:9328
- C:\Windows\System\ydOAqBs.exe
  C:\Windows\System\ydOAqBs.exe
  2⤵
  PID:9348
- C:\Windows\System\qowkxOV.exe
  C:\Windows\System\qowkxOV.exe
  2⤵
  PID:9364
- C:\Windows\System\OsHTqcw.exe
  C:\Windows\System\OsHTqcw.exe
  2⤵
  PID:9384
- C:\Windows\System\HmZheNX.exe
  C:\Windows\System\HmZheNX.exe
  2⤵
  PID:9400
- C:\Windows\System\lPElUTW.exe
  C:\Windows\System\lPElUTW.exe
  2⤵
  PID:9416
- C:\Windows\System\gICnspX.exe
  C:\Windows\System\gICnspX.exe
  2⤵
  PID:9444
- C:\Windows\System\UkDYWgp.exe
  C:\Windows\System\UkDYWgp.exe
  2⤵
  PID:9460
- C:\Windows\System\ZXicMLW.exe
  C:\Windows\System\ZXicMLW.exe
  2⤵
  PID:9476
- C:\Windows\System\ZwoDboR.exe
  C:\Windows\System\ZwoDboR.exe
  2⤵
  PID:9492
- C:\Windows\System\xbZaYte.exe
  C:\Windows\System\xbZaYte.exe
  2⤵
  PID:9508
- C:\Windows\System\DvTgFUM.exe
  C:\Windows\System\DvTgFUM.exe
  2⤵
  PID:9524
- C:\Windows\System\GxEkHMK.exe
  C:\Windows\System\GxEkHMK.exe
  2⤵
  PID:9540
- C:\Windows\System\baeSgmM.exe
  C:\Windows\System\baeSgmM.exe
  2⤵
  PID:9556
- C:\Windows\System\jTnfGel.exe
  C:\Windows\System\jTnfGel.exe
  2⤵
  PID:9604
- C:\Windows\System\WxvjVqT.exe
  C:\Windows\System\WxvjVqT.exe
  2⤵
  PID:9620
- C:\Windows\System\HwcxVul.exe
  C:\Windows\System\HwcxVul.exe
  2⤵
  PID:9636
- C:\Windows\System\CaXJoGs.exe
  C:\Windows\System\CaXJoGs.exe
  2⤵
  PID:9652
- C:\Windows\System\eONTRjU.exe
  C:\Windows\System\eONTRjU.exe
  2⤵
  PID:9668
- C:\Windows\System\OHNrWZf.exe
  C:\Windows\System\OHNrWZf.exe
  2⤵
  PID:9684
- C:\Windows\System\womrejS.exe
  C:\Windows\System\womrejS.exe
  2⤵
  PID:9700
- C:\Windows\System\OpXwENF.exe
  C:\Windows\System\OpXwENF.exe
  2⤵
  PID:9720
- C:\Windows\System\VKiXtTe.exe
  C:\Windows\System\VKiXtTe.exe
  2⤵
  PID:9736
- C:\Windows\System\GLOgGJE.exe
  C:\Windows\System\GLOgGJE.exe
  2⤵
  PID:9752
- C:\Windows\System\xaqlfMO.exe
  C:\Windows\System\xaqlfMO.exe
  2⤵
  PID:9768
- C:\Windows\System\bMSHjwe.exe
  C:\Windows\System\bMSHjwe.exe
  2⤵
  PID:9784
- C:\Windows\System\EAyFSgH.exe
  C:\Windows\System\EAyFSgH.exe
  2⤵
  PID:9800
- C:\Windows\System\LkeHjYN.exe
  C:\Windows\System\LkeHjYN.exe
  2⤵
  PID:9816
- C:\Windows\System\WqlHBjh.exe
  C:\Windows\System\WqlHBjh.exe
  2⤵
  PID:9832
- C:\Windows\System\znhyYbO.exe
  C:\Windows\System\znhyYbO.exe
  2⤵
  PID:9848
- C:\Windows\System\CJwUCPf.exe
  C:\Windows\System\CJwUCPf.exe
  2⤵
  PID:9864
- C:\Windows\System\QvPerKm.exe
  C:\Windows\System\QvPerKm.exe
  2⤵
  PID:9880
- C:\Windows\System\GGSFhPL.exe
  C:\Windows\System\GGSFhPL.exe
  2⤵
  PID:9896
- C:\Windows\System\pcVNzJy.exe
  C:\Windows\System\pcVNzJy.exe
  2⤵
  PID:9912
- C:\Windows\System\MlhlrDT.exe
  C:\Windows\System\MlhlrDT.exe
  2⤵
  PID:9932
- C:\Windows\System\bJinOSi.exe
  C:\Windows\System\bJinOSi.exe
  2⤵
  PID:9948
- C:\Windows\System\htMYjDX.exe
  C:\Windows\System\htMYjDX.exe
  2⤵
  PID:9968
- C:\Windows\System\CDGcQKu.exe
  C:\Windows\System\CDGcQKu.exe
  2⤵
  PID:9984
- C:\Windows\System\XFDovWM.exe
  C:\Windows\System\XFDovWM.exe
  2⤵
  PID:10004
- C:\Windows\System\lTzppBr.exe
  C:\Windows\System\lTzppBr.exe
  2⤵
  PID:10020
- C:\Windows\System\DyjvOue.exe
  C:\Windows\System\DyjvOue.exe
  2⤵
  PID:10036
- C:\Windows\System\fCbhnal.exe
  C:\Windows\System\fCbhnal.exe
  2⤵
  PID:10052
- C:\Windows\System\cwklePG.exe
  C:\Windows\System\cwklePG.exe
  2⤵
  PID:10068
- C:\Windows\System\vMtAzku.exe
  C:\Windows\System\vMtAzku.exe
  2⤵
  PID:10104
- C:\Windows\System\jvgXtEq.exe
  C:\Windows\System\jvgXtEq.exe
  2⤵
  PID:10124
- C:\Windows\System\zqOvlhJ.exe
  C:\Windows\System\zqOvlhJ.exe
  2⤵
  PID:10148
- C:\Windows\System\INQjkSH.exe
  C:\Windows\System\INQjkSH.exe
  2⤵
  PID:10164
- C:\Windows\System\dwegNgW.exe
  C:\Windows\System\dwegNgW.exe
  2⤵
  PID:10184
- C:\Windows\System\NvtAzLD.exe
  C:\Windows\System\NvtAzLD.exe
  2⤵
  PID:10200
- C:\Windows\System\zGigZod.exe
  C:\Windows\System\zGigZod.exe
  2⤵
  PID:10216
- C:\Windows\System\TuGOryI.exe
  C:\Windows\System\TuGOryI.exe
  2⤵
  PID:10232
- C:\Windows\System\mpkzyCx.exe
  C:\Windows\System\mpkzyCx.exe
  2⤵
  PID:7792
- C:\Windows\System\myXgpvq.exe
  C:\Windows\System\myXgpvq.exe
  2⤵
  PID:8976
- C:\Windows\System\CCBkMPI.exe
  C:\Windows\System\CCBkMPI.exe
  2⤵
  PID:9264
- C:\Windows\System\qoIeMeG.exe
  C:\Windows\System\qoIeMeG.exe
  2⤵
  PID:9280
- C:\Windows\System\HFGVrKB.exe
  C:\Windows\System\HFGVrKB.exe
  2⤵
  PID:9320
- C:\Windows\System\LHEkJRz.exe
  C:\Windows\System\LHEkJRz.exe
  2⤵
  PID:9344
- C:\Windows\System\iJRaOBV.exe
  C:\Windows\System\iJRaOBV.exe
  2⤵
  PID:9380
- C:\Windows\System\iWcPEeJ.exe
  C:\Windows\System\iWcPEeJ.exe
  2⤵
  PID:9432
- C:\Windows\System\pIrspsO.exe
  C:\Windows\System\pIrspsO.exe
  2⤵
  PID:9456
- C:\Windows\System\efMhETA.exe
  C:\Windows\System\efMhETA.exe
  2⤵
  PID:9504
- C:\Windows\System\IIqIYPs.exe
  C:\Windows\System\IIqIYPs.exe
  2⤵
  PID:9488
- C:\Windows\System\osPyeUy.exe
  C:\Windows\System\osPyeUy.exe
  2⤵
  PID:9580
- C:\Windows\System\olWRhLR.exe
  C:\Windows\System\olWRhLR.exe
  2⤵
  PID:9644
- C:\Windows\System\MOReANf.exe
  C:\Windows\System\MOReANf.exe
  2⤵
  PID:9648
- C:\Windows\System\PcYbqjt.exe
  C:\Windows\System\PcYbqjt.exe
  2⤵
  PID:9676
- C:\Windows\System\PjQucdV.exe
  C:\Windows\System\PjQucdV.exe
  2⤵
  PID:9716
- C:\Windows\System\UbsbvrN.exe
  C:\Windows\System\UbsbvrN.exe
  2⤵
  PID:9840
- C:\Windows\System\NHyFhrI.exe
  C:\Windows\System\NHyFhrI.exe
  2⤵
  PID:9860
- C:\Windows\System\hpOEhEf.exe
  C:\Windows\System\hpOEhEf.exe
  2⤵
  PID:9876
- C:\Windows\System\CDQOcVf.exe
  C:\Windows\System\CDQOcVf.exe
  2⤵
  PID:9960
- C:\Windows\System\HORijXJ.exe
  C:\Windows\System\HORijXJ.exe
  2⤵
  PID:10032
- C:\Windows\System\lWUfCPN.exe
  C:\Windows\System\lWUfCPN.exe
  2⤵
  PID:10048
- C:\Windows\System\fNqwsVm.exe
  C:\Windows\System\fNqwsVm.exe
  2⤵
  PID:9964
- C:\Windows\System\XaETikF.exe
  C:\Windows\System\XaETikF.exe
  2⤵
  PID:9596
- C:\Windows\System\TsWhlkr.exe
  C:\Windows\System\TsWhlkr.exe
  2⤵
  PID:10084
- C:\Windows\System\fwPBaUX.exe
  C:\Windows\System\fwPBaUX.exe
  2⤵
  PID:10140
- C:\Windows\System\sGvcWpr.exe
  C:\Windows\System\sGvcWpr.exe
  2⤵
  PID:10228
- C:\Windows\System\srxeTvf.exe
  C:\Windows\System\srxeTvf.exe
  2⤵
  PID:10080
- C:\Windows\System\XCeSJUS.exe
  C:\Windows\System\XCeSJUS.exe
  2⤵
  PID:9296
- C:\Windows\System\EMHlxTZ.exe
  C:\Windows\System\EMHlxTZ.exe
  2⤵
  PID:9336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BbwTBGZ.exe

Filesize
2.2MB

MD5
4a94f68e257e8a7c385648abf2b252c2

SHA1
3edf37e152084bbef6eca8dc56cd780de67ffe71

SHA256
1d794bdb550adaa918806e88692a911cd6ea12c4d1085ce25e727558d18e7f62

SHA512
bfb9b5f82e8b115d09e24089832ec085d31c524059cd8e20403dbffcae03b89ee5fdd2bb385ed95ad7270bb254685f4193032ed2985be81280a6facfdef36e6e

Download Submit
C:\Windows\system\CuoCktr.exe

Filesize
2.2MB

MD5
0a0650b474f2e717ebf5384c9cd34ab1

SHA1
81b4312ba06b1084092519f52a7bd064e6e93792

SHA256
f8471053bcf3ee021919cd13c0bdff39018da1f1c1722f58db6ce44f3f7892c2

SHA512
17540ece5d6cf1a14385c43fa726bbf4a634f578bce3c89bc307002e96cc7e51bf4c3d5cf41563c8f28b9d2ae7c70608836d124df73d95143b306c05855458b7

Download Submit
C:\Windows\system\DtyDaJV.exe

Filesize
2.2MB

MD5
61f3c0a4556260cc3e65c102e49ae8a0

SHA1
48ff1a31aeccb05e4262bababf3d500266013d0a

SHA256
93a8d81e9702538e560e753e1a7f469b2c8e1beba3fde877e8e120b37ca1285d

SHA512
ea74c6ce28cebb4807327f2ca808207c0091c6fdf5e30ca27a77c41b12de6398ac48791af6d9471f85099ba591d209e48e50ad64a961f26d663bf32719d3efd6

Download Submit
C:\Windows\system\GDhERjv.exe

Filesize
2.2MB

MD5
e4bfa20b5f0c776a2b4d8721f59b1158

SHA1
7b446326edaf0f1c197c69b5e8b1c80a05fe928f

SHA256
39e0fa9f104e363dc98e3df871480a29073d4198151263688921dccec1a4ab04

SHA512
f006564f2d32cfa60c904c03690291d5b13e4d6050199fdc656ff4420728150ab4dc00b1845cd958291f10f5dd4bd233ba2ebc9550d387b17fb58afee1f8f804

Download Submit
C:\Windows\system\IkuNoDW.exe

Filesize
2.2MB

MD5
fc872763387dd2602f4725c606b026da

SHA1
307eec67be458d536d9943a220201f7881c1caef

SHA256
d375c4e427773e28357bdb9f157a4bf6d498f55173d39e9de4f17143ef49bf3c

SHA512
84339e5d104378771d64a1d3c3522b623dfe8d1ee243752073b93fde3dcc8355c1065c60a2f79a21885d3c408578c9b593e6f4ed81666aeb24556e1a0c056e2a

Download Submit
C:\Windows\system\JrFWNPK.exe

Filesize
2.2MB

MD5
b3f4e0bfe1ffb7112873d842058e3ea4

SHA1
ef3b12a5452837a92262715148437a098561c83f

SHA256
7031ae9632b9ef97a93c3217021369bad1abd3b001e4b16ff12a60566bf595a8

SHA512
528555bd12fa272605fff6414414210f7ac733e634e25ec2cb15353e644ca3bcf5fd7dc27803312fe5b805bb2d9e889829c830ea86abbe146d6b6c9fd759e081

Download Submit
C:\Windows\system\MQSuaPk.exe

Filesize
2.2MB

MD5
9736be1f6c0f08da6feb93290eaeab83

SHA1
11c00bd35ba36532d1a661b578053d23bfb3452f

SHA256
657a8245caa65b206c3ab6b147a24d7551bdbe89eb161db1409833fb59dff3cd

SHA512
f402f9f3fee3e3ce0d124689a11940ae0560f591f3bfde855657353b9c1e35e05873be9274f5fb743176c4c0fc7325c99c7c47ce98d77a2c06413cfcc2d48b25

Download Submit
C:\Windows\system\NOwcuPW.exe

Filesize
2.2MB

MD5
a6f93db91c88bc2ce81b862604a633e7

SHA1
cc82d5cca74c5089c0c0d1e808180e572c3781e3

SHA256
94024ff48d3a1c1bc8a7fd8ddb6d47414eb5640d93178ad8fd59e1c8653ce174

SHA512
b3c696e782b71eb3fc4c698fd4f2e26ea6958c7f3498f0415f1b86331029ca2b43fbb780f06b271bcb554d7b0f8a1075a9c2b04edf086b761801c1ece487d3e6

Download Submit
C:\Windows\system\NYMgeQv.exe

Filesize
2.2MB

MD5
c7c6cf99e52d3aa59a0693fb9ce2d6b3

SHA1
340c39c53761e972fbb1f498fb7e3e6d0c52384d

SHA256
bc245234ff2b0bff43dd76554e9645da794f59c226e99a9fb463001e3e7ece35

SHA512
680e7e4e3c1a739613a72031df1709c0bffdf6bca896abdca837242674d9704759192c241d1c2589d358f09600e24759e56bb15d0bd01124d773f372858fe959

Download Submit
C:\Windows\system\OSLQhNk.exe

Filesize
2.2MB

MD5
f7fbf0536caa9ecf9836a6fb973a9d9b

SHA1
0554cccf93b237db528d0ae8a669e9e031fedf60

SHA256
06420e1aefbce82eec20f902ee0b1abb4b862587175c28bb53fdef8b14f8bc9d

SHA512
66a13f0b755a16a424ce78060a9e3526a3f007e59ec0b0d93a03e1764e29b60061e4f196950d2041f23bf0b77265c3576f1912e4f0039ab118a9a4d95e37f589

Download Submit
C:\Windows\system\OWpTTup.exe

Filesize
2.2MB

MD5
256222cc05cf687830a6496b734c64b4

SHA1
3e1728c0bdbc424f194cf2850451056bff5cbf9a

SHA256
125de53a97135f1767e972c7570b748d8b3031db59ee54b6c62f3f4ec0318c34

SHA512
d4d13851abfa208b20730352a6640ca4cede8b2fc1427b7b7ac47f568c73de6bf2d6d629b7df29b1d5ac135c994004cffa90cb6219f928762c14feb6b1c9a385

Download Submit
C:\Windows\system\PNVUARy.exe

Filesize
2.2MB

MD5
25ac62def3c620dd3d55ad13dc1a92e8

SHA1
96a542923873403323168a887004423cb16c441b

SHA256
4bc4b8678ceb1e61cc89361bce5d0a6f07ff14283ecf28531ed51f732d48088b

SHA512
20bf8e4bd76944378e6fc8ca86c956feb17426d5dd074c2c915d6b4220bf254ac6760ea295a94c411ae57dcc78e7bb2046d111c28225d3f813d233498a95c0b4

Download Submit
C:\Windows\system\RMkqplG.exe

Filesize
2.2MB

MD5
2cd323d9a96f0b5d575a1c8a645f3961

SHA1
41312c377aeb2366bac5c8e076aec08547c7ecef

SHA256
3e38c009c609bbb4c54aa9d69a1d334e88624d68b1c20c8d7b28bf1e807fd3ce

SHA512
d840407cc0dc9e2c52be6d27238542e0e7271d5975439f4b8a89c680367c2864963991c7a33530ae6fde511e145fe0713f843925031c7693812290550e3bc064

Download Submit
C:\Windows\system\SIcKPyf.exe

Filesize
2.2MB

MD5
149f12d31b0a4992e9b5ac39dc870d25

SHA1
3478bb2df2f5c5c43955b867283058b4d1ea1f37

SHA256
56aedd255f659b331e51387338208a75a4ca32033897748150e20b26ecf91c70

SHA512
7dd7b8829ee37fd219d28ddf0ca61f05ce9f1aad1a3c23f0a9f915a374705c4e5f494ae8c3f857510a90b4c9486c139ecce4361aa4ab13db30de286b1f66eac2

Download Submit
C:\Windows\system\SsvdlLZ.exe

Filesize
2.2MB

MD5
65df15fd75c8f10c3c463ee221c7690b

SHA1
26974148d7eb003a2ed2011ad55c9c37edacb23f

SHA256
38da7c39a317bfd720d95a295a0f0677fdecbf3fa98ef4082b4ab5d7d49d8145

SHA512
745e6b00c9bd5fc2458d740924058f098139d2b17e785b6609cd671a34fc92c25566bf35744213c1867ea1bcb60c5dd0a04ef5975285f0e7a8fda25c7f661f6d

Download Submit
C:\Windows\system\UYRbhIq.exe

Filesize
2.2MB

MD5
8708f2da2474606e2871d080d03a916c

SHA1
84dc1c08360f78485707c2962c938d9fe693c04e

SHA256
04e4137a3798fb0b6335036d7699e3ba27ab2f63f644adb1a050b05d91c28535

SHA512
9ea746f6b494185cd267967b9317f649b0d15fec682ff792f9ad2a00ed225865e1628866095b31eb01aa642b186dda5f7c1de3796c7079f454a4059cc084f67d

Download Submit
C:\Windows\system\VYzOAGo.exe

Filesize
2.2MB

MD5
766a497b7e6d3650846003929e41cf59

SHA1
d4402f84862bb0997e799e139d4b8a6b79dbe69e

SHA256
35c80df14a0aede9430afeebc4ac418d8bfdff204a2f02a00da003af5e8403ef

SHA512
88295f3c324876c8fec91a1755825786ab5e3a673a1a86664c93f0a540d228335a19e5decb6e0fe16a67f6917ee9b8321258147a95335f867548bdfea8922af6

Download Submit
C:\Windows\system\XFEJLhJ.exe

Filesize
2.2MB

MD5
b5ccd5ad75274c93da8c6669228ba803

SHA1
96a7d267e98943b5867b2eedb32881ecf4cde444

SHA256
e5d571fcfcd0e421c65f9da5c90714b17e03d6d9d49ec57af64888b3b54f0db2

SHA512
c2e27dc2c6981d7d5707cede1686e3169adf2a1d81ae8d23f2863349d5df25fe89de8976aab0c0015ec565170744b5eea9c7aa75c441188731d02df982235663

Download Submit
C:\Windows\system\XPGwbag.exe

Filesize
2.2MB

MD5
e703e45f74ce08a472dc5ee62dd7de0e

SHA1
e5f0727ff07a079cee7bb00bf36b4e5b9be10985

SHA256
36cdce74d06c5f4302853fd39519fafd97a0697a13b58d54e26a6707a0c502d2

SHA512
3cc0c48574416b39f1ab3ec4e717264ec865e68de7c7a9f9cab35c1ea267fbc5ba7eb0c13f8b90c4bb7694fb890ef7285ec0d61df78ec8f74bfe5abbfaba1883

Download Submit
C:\Windows\system\YJCJyKc.exe

Filesize
2.2MB

MD5
4729733416acd21f755981e9a0450c23

SHA1
ba51edc8c3a08da7e226e5327588fbab0125e04d

SHA256
289160775b0352d2dfbb149eb493d7ce2bd3b4c6ad50df814db4fbac6ccb4616

SHA512
2ae3a0c79f07d1d5f88a70da5bed33e0c06bb46cec7c1b9f84d6f05737e87c08aa1c667d5cd0c8555d2d7af9ae3abd217d15f74f3d16d6bbfe1f8af3f45bdaaf

Download Submit
C:\Windows\system\lhAjBXt.exe

Filesize
2.2MB

MD5
b82e581e75f6931b9a95c69aa5c860e8

SHA1
1194af75eca8f518eec0ac060fb099872b51eda9

SHA256
433f9bc50ea38b1e03b222347f5661f7bfed13bb88aa9aedc3dab819268e4ef1

SHA512
e3a27e55342853df1af6b85e47937b8efdf13065f5821565e21e8395fc2a67fa4d0d3e4dbb616599b7552c25a1a90e7c568f40a09994a7849e72fccead5f2293

Download Submit
C:\Windows\system\oQNUGmr.exe

Filesize
2.2MB

MD5
d73f594875e0c912f18901f685bc9f8f

SHA1
a0fdb5a06e2936fbd763d6f7b70ba8d15637827b

SHA256
7e90ee2675a8b877a4d258e58dc8131a028f6190cc16207b2b74c8b88f28e54a

SHA512
d4bc8425e3874fa931139a98396189f6189893c895c39db40911d06b96fbe1d5324c6097d0c1e7eaf51bd261c3393c17697d3a03a58612d2d65ad033c8bb6d4c

Download Submit
C:\Windows\system\oxuHRRS.exe

Filesize
2.2MB

MD5
dbc34909518fba6d74538328e0225b6e

SHA1
2d421b326faae67bcb17c554eb32c7d305712628

SHA256
2f34595e94a76ffbe58cf22a5d6eca8b399a9a3b777ad6f586f1e048789fe621

SHA512
9862982ba07c6ab788b6722ae8acd5c9197cdd4a2a1a4a41ddcc1fa4b1d2e4cf6a5247bb7b05f3a7b2ac0379fa87ff7c4942eb754f0f171ba17894f30a680cd5

Download Submit
C:\Windows\system\qBePXVk.exe

Filesize
2.2MB

MD5
24e8dd3e77d980aa603eb0c8d2841030

SHA1
7515fb19cbe020e98bd0b9b9fb047e80bf5a70e0

SHA256
67a9f41b4ef4714da852299fa20f40dd2f7af00fcb0dfe701dbf3d6f2e047dba

SHA512
3ea0701214c1928676d412cde1f7e279e0705e9948b7689f3b86d3908554ba87b0f1e75be55ed88e1fdf989d50ab5875931cf88eef3307254d365a12194007fc

Download Submit
C:\Windows\system\qEhfBqx.exe

Filesize
2.2MB

MD5
f4b3914e18362b05483caf04d8635178

SHA1
8b5771fdc831cdd31b2781ef433eade19fae8f3d

SHA256
17acc12bd09a19cbd3043c97af221a6c60237822c4595b26c4705b357bb51f86

SHA512
ffd4e64dc796f77643e3cf53ffa86c3c624c731d5801c394612b1d1de533f358c61ff3080539f06ab517815009607fab6fd4b34106d32be3484719e44c671f83

Download Submit
C:\Windows\system\vMloHzT.exe

Filesize
2.2MB

MD5
21d6c8db9cfc4c96725f9536ba8536eb

SHA1
e929a89a649d62f84dfb0dd4cfed00cb354d44f7

SHA256
ec051c34c26aa251d176f6d5835735fc8ae42f12486b49ed81ce4ad5d204fd4f

SHA512
cd0125add4bad14905cc03e42fb31e1d36e6ffeefed56c57b42c684e34f9c6da28c00ade5908412039c15bdfcb3ce7f9a05edc2d6cf2145ab43cfb4a1d860b59

Download Submit
C:\Windows\system\wGObNfV.exe

Filesize
2.2MB

MD5
b0d3258223c7dee8e8318c0236a1a9de

SHA1
f7a9c99e0b3f4fd2baa824da604072ebfbe0af9c

SHA256
8862f3f2906202c272f4d7d03fb4874d08554c751e5b9bb2e8dddc44665567b0

SHA512
54fdda2e1afee5c7359b20b0792c3b3b7370785f6fd8f2e910af94a7fe355794c43958b6ddb2eb8acf82253bc73c45e6c915e7f0487df81f7b1dccd57a551234

Download Submit
C:\Windows\system\wsqmzgq.exe

Filesize
2.2MB

MD5
e189b128d0bf646f183f3fef6e8e40d1

SHA1
48bc27b1f1b7fa365a7c46a0401d9c9213320dec

SHA256
96bcd19fc9a00dd473f3a56197bf485f66d32297324b532fab972f447edd9061

SHA512
32115eb3e1ae1661325100a54ea957e916917ceaf05e265141dbb0ab4fa232889c50d1a788839cf71e6748b55d0540569ef56f49227346913f46287827b6fe98

Download Submit
C:\Windows\system\xtKXXwT.exe

Filesize
2.2MB

MD5
ba266fa3405e2f670254b5fb3c7175e8

SHA1
c63ac128e54e88f81964ead1e45f39d535a67750

SHA256
72e21e0bd450d8d0b06f50e85e8c8595cf28fb24bbb3e99b7d2adff24e1505ce

SHA512
8c63c632a5f8665c8f082037e5b8bb4d7163573c08186ae5d99b97aab0be7881be246ad7e0d26f307ba1d305422e18d769184d5bfe2aac79fd9c56d55c1e517e

Download Submit
\Windows\system\RyfcHLF.exe

Filesize
2.2MB

MD5
53dc91f9cb8558d8fa4c730a332d513c

SHA1
a58775ccac053e4832edf48c4cb555bc8f002290

SHA256
0cd39d57fdcb61f304da577b9a384755ead250348d93f45fc6291b0a8a0ae2a3

SHA512
e91dfa034c9eac3f76447055a438380a1db0f1ff7b5bd2104427e565ae4b6968698befa4b18cacb617460edc093b5d0a4f3cabc647abb85e88c4fed9a1f43695

Download Submit
\Windows\system\lIGubYL.exe

Filesize
2.2MB

MD5
37762e9ab1cef328a0703e62fc5d678e

SHA1
e723c56008f0433057351901ecc68310d633a52f

SHA256
11fdef6dd5b1f6a1d4912721fc062e6d5a4bd89289cfd5c381b9ef9b4dbb587c

SHA512
57121170828ff350c6e3b506864b9b7bcd93923cc803a05aad677b7912e5fb2968c0113d13db885130492bbe31fabfbcb2551a36c4b0fbdce5002bb0ea3d44d8

Download Submit
\Windows\system\uMBVKXq.exe

Filesize
2.2MB

MD5
15805e8d4f179f8c2e3c3ebfa3873ec9

SHA1
3e376be02219de67dd6b8e6da22989afd04399cf

SHA256
24d3e696dac8078460c7c2e09c46088fab0a0c09300a7bd4812811108154116a

SHA512
d4f53ee22b93713834b53f4ee96112e092fcbe2598ea9bbc959f6487ec1abe1d22ba95f59ee3132da7340709ca6400a94472e293aa2b1b3e0747eb19537164e4

Download Submit
memory/592-192-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/592-191-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/592-194-0x00000000029C0000-0x0000000002A40000-memory.dmp

Filesize
512KB

Download
memory/592-146-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download
memory/592-149-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/592-232-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/592-177-0x000007FEF53A0000-0x000007FEF5D3D000-memory.dmp

Filesize
9.6MB

Download
memory/604-13-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/604-179-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/604-1808-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-184-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1360-1826-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2088-183-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2088-1820-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2148-205-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2148-197-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2148-199-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2148-178-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-0-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-11-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-208-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2148-200-0x0000000002DF0000-0x00000000031E2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-196-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-14-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-195-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-202-0x0000000002DF0000-0x00000000031E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-180-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-15-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1821-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-198-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2424-210-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-209-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2496-185-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2496-1803-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2560-193-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2564-206-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2564-1802-0x000000013F770000-0x000000013FB62000-memory.dmp

Filesize
3.9MB

Download
memory/2584-207-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-204-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-190-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-201-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2792-1800-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-181-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-182-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-1825-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-203-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2900-1822-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download