xmrig | 91982211d7d464ff1a6d2c43a8305cbf1fdb47a8adc9c778f6f1af79fb36329e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
Size

1.4MB
MD5

0fa21f6a6d4923af4c7ebeb5a11af97b
SHA1

f4b0c33716de5fd1d955f789eb7e1a44dd4f7daa
SHA256

91982211d7d464ff1a6d2c43a8305cbf1fdb47a8adc9c778f6f1af79fb36329e
SHA512

44ae037f9b0224729dcb2bd8e93238b9e80b09e1d962c750a3ebe66d23d25739596d3c4f09e92654ada7e179bcbc08012ea429ff3842018273de7a9a55f63ca6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwlZCg7:Lz071uv4BPMkibTIA5CJM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2240-23-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2824-15-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2244-13-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2520-40-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2220-54-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2632-57-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2604-214-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2220-289-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2632-369-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/3000-71-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2240-64-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2520-2040-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2824-2041-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/3000-2044-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2240-2043-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2244-2042-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2632-3771-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2624-4222-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2412-4253-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2308	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2244	QbqsSOg.exe
2824	lXGvvCT.exe
2240	rFzMrYn.exe
3000	tZgqRcA.exe
2520	khBLpnR.exe
2604	yqiCvLm.exe
2632	LMdWKTT.exe
2412	cMJutsK.exe
2624	EnLuEGC.exe
1732	MOGfDBc.exe
2056	GmUXxKU.exe
2516	AtAIcBn.exe
1904	lfPNmkj.exe
640	GcBnWCA.exe
1520	trBIYua.exe
1916	KQuoRHc.exe
2396	DOuqpmC.exe
2852	XCYjgli.exe
1092	WFqyJCD.exe
2328	KlKJZpl.exe
1112	McBFGNe.exe
1432	hLqQqiN.exe
1760	SNAOEMf.exe
1640	kibkEIE.exe
1472	TOrGgfi.exe
592	lxIIipB.exe
2740	TRnKfEh.exe
1976	fLAqzWu.exe
2708	VBSEhGK.exe
1948	JqCCbMy.exe
428	sVBafIL.exe
1956	YEWuMMW.exe
1496	xbcwEFI.exe
960	tPfLYiH.exe
3012	XsCQQWe.exe
1144	vspfbAp.exe
904	RpMHVyl.exe
688	gJXuUOR.exe
2148	OMxjSft.exe
2828	PcIVyIP.exe
584	GiekTRt.exe
2164	mVwYNDZ.exe
936	MzeEvkm.exe
2204	GTejVDv.exe
272	QqzTpuC.exe
1200	XsOMAvT.exe
1700	NGKBqCj.exe
1136	epIKJjW.exe
276	SpyCJYm.exe
1456	DoIhmOD.exe
2076	tqaimHM.exe
2680	PlajEFd.exe
528	UdFHGvV.exe
2140	gXcQUpO.exe
2248	hurkbJP.exe
2112	UtdExfv.exe
2948	DohZGib.exe
2228	SceKnMn.exe
2620	NIyjujY.exe
1896	ApmuoLw.exe
2724	RZxJJqr.exe
832	bEPbIxL.exe
2464	IXPkDLG.exe
2388	YXLeAWA.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x000c00000001441e-6.dat	upx
behavioral1/files/0x0009000000014a94-8.dat	upx
behavioral1/files/0x0008000000014e3d-10.dat	upx
behavioral1/memory/2240-23-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2824-15-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x0007000000014ec4-24.dat	upx
behavioral1/memory/2244-13-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0009000000014aec-37.dat	upx
behavioral1/memory/2520-40-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-41.dat	upx
behavioral1/memory/2220-27-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x0008000000015264-50.dat	upx
behavioral1/memory/2220-54-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2632-57-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x0006000000016ccf-61.dat	upx
behavioral1/memory/2412-67-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x0007000000015c7c-58.dat	upx
behavioral1/files/0x0006000000016cf0-76.dat	upx
behavioral1/files/0x0006000000016d11-85.dat	upx
behavioral1/files/0x0006000000016d89-116.dat	upx
behavioral1/files/0x000600000001704f-139.dat	upx
behavioral1/files/0x000500000001868c-150.dat	upx
behavioral1/files/0x0006000000017090-141.dat	upx
behavioral1/files/0x0006000000018b42-194.dat	upx
behavioral1/files/0x0006000000018b33-187.dat	upx
behavioral1/files/0x0006000000018ae8-178.dat	upx
behavioral1/memory/2604-214-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-168.dat	upx
behavioral1/files/0x0005000000018698-163.dat	upx
behavioral1/files/0x0006000000016d84-149.dat	upx
behavioral1/files/0x0006000000016d4f-147.dat	upx
behavioral1/files/0x0006000000016d41-136.dat	upx
behavioral1/files/0x0006000000016e56-132.dat	upx
behavioral1/files/0x0006000000016d36-115.dat	upx
behavioral1/files/0x0006000000018ae2-173.dat	upx
behavioral1/files/0x0006000000018b15-180.dat	upx
behavioral1/files/0x0006000000018b37-189.dat	upx
behavioral1/memory/2220-289-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2632-369-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/files/0x0006000000016d24-88.dat	upx
behavioral1/files/0x0006000000016d01-80.dat	upx
behavioral1/memory/2624-73-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/1732-119-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x0006000000016d55-118.dat	upx
behavioral1/files/0x0006000000016d4a-117.dat	upx
behavioral1/files/0x0006000000016cd4-103.dat	upx
behavioral1/memory/2604-49-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/3000-71-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2240-64-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2520-2040-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2824-2041-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/3000-2044-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2240-2043-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2244-2042-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2632-3771-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2624-4222-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/memory/2412-4253-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gXcQUpO.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\yUAHbnV.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\htzUNXP.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\zZbrnsv.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\LWlKeIu.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\BPapRys.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\NaSzQpt.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ocfmjXI.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\VBSEhGK.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\LnxGAvZ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\SEERtCu.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\zBDpnpf.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\SexUzOI.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\gtSeKlZ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\jXwavRa.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\TgUbqrI.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\XYaLIGh.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\gAjjUID.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\hRIhwXM.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\UdFHGvV.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\LyoaFyc.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\inEnVpS.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\TLhNlhr.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\MjzwNUT.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\CrwzRdr.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\VxUbyqf.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ozuYLLz.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ljombAf.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\zpNVClZ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\jTGTUEJ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ZJftCRf.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\PWnUGRe.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\yonoXze.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\AKRaYHC.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\dfWgFID.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\otRBnaU.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\RYzfqJJ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\KQuoRHc.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\qtWsBDY.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\kcaEVTy.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\ekaCDGa.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\HyISRZO.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\aqlthSE.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\FPOhUMT.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\iCkVlTZ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\wDGkqwh.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\BwmkVAU.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\OCrLJlh.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\joRQNnj.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\aziuTds.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\OFzrxuc.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\cRSzUNf.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\pZoRZgn.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\GhRLbRx.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\LRaLxzY.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\nHzIgpk.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\WfaYrWi.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\QwdxwWO.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\vscSBKN.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\weUdohS.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\GXDBoCd.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\iojYvaT.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\uYLewNZ.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
File created	C:\Windows\System\FSIrxJn.exe	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2308	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2308	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2308	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	29
PID 2220 wrote to memory of 2244	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2244	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2244	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	30
PID 2220 wrote to memory of 2824	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2824	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2824	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	31
PID 2220 wrote to memory of 2240	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2240	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	32
PID 2220 wrote to memory of 2240	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	32
PID 2220 wrote to memory of 3000	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	33
PID 2220 wrote to memory of 3000	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	33
PID 2220 wrote to memory of 3000	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	33
PID 2220 wrote to memory of 2520	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2520	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2520	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	34
PID 2220 wrote to memory of 2604	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2604	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2604	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	35
PID 2220 wrote to memory of 2632	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2632	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2632	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	36
PID 2220 wrote to memory of 2624	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2624	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2624	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	37
PID 2220 wrote to memory of 2412	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2412	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2412	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	38
PID 2220 wrote to memory of 2516	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2516	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	39
PID 2220 wrote to memory of 2516	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	39
PID 2220 wrote to memory of 1732	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	40
PID 2220 wrote to memory of 1732	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	40
PID 2220 wrote to memory of 1732	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	40
PID 2220 wrote to memory of 2396	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2396	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2396	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	41
PID 2220 wrote to memory of 2056	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2056	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2056	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	42
PID 2220 wrote to memory of 2852	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2852	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	43
PID 2220 wrote to memory of 2852	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	43
PID 2220 wrote to memory of 1904	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	44
PID 2220 wrote to memory of 1904	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	44
PID 2220 wrote to memory of 1904	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	44
PID 2220 wrote to memory of 1092	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	45
PID 2220 wrote to memory of 1092	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	45
PID 2220 wrote to memory of 1092	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	45
PID 2220 wrote to memory of 640	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	46
PID 2220 wrote to memory of 640	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	46
PID 2220 wrote to memory of 640	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	46
PID 2220 wrote to memory of 1112	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1112	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1112	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	47
PID 2220 wrote to memory of 1520	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1520	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1520	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	48
PID 2220 wrote to memory of 1432	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1432	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1432	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	49
PID 2220 wrote to memory of 1916	2220	0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fa21f6a6d4923af4c7ebeb5a11af97b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\System\QbqsSOg.exe
  C:\Windows\System\QbqsSOg.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\lXGvvCT.exe
  C:\Windows\System\lXGvvCT.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\rFzMrYn.exe
  C:\Windows\System\rFzMrYn.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tZgqRcA.exe
  C:\Windows\System\tZgqRcA.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\khBLpnR.exe
  C:\Windows\System\khBLpnR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\yqiCvLm.exe
  C:\Windows\System\yqiCvLm.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\LMdWKTT.exe
  C:\Windows\System\LMdWKTT.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\EnLuEGC.exe
  C:\Windows\System\EnLuEGC.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\cMJutsK.exe
  C:\Windows\System\cMJutsK.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\AtAIcBn.exe
  C:\Windows\System\AtAIcBn.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\MOGfDBc.exe
  C:\Windows\System\MOGfDBc.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DOuqpmC.exe
  C:\Windows\System\DOuqpmC.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\GmUXxKU.exe
  C:\Windows\System\GmUXxKU.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XCYjgli.exe
  C:\Windows\System\XCYjgli.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\lfPNmkj.exe
  C:\Windows\System\lfPNmkj.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\WFqyJCD.exe
  C:\Windows\System\WFqyJCD.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\GcBnWCA.exe
  C:\Windows\System\GcBnWCA.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\McBFGNe.exe
  C:\Windows\System\McBFGNe.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\trBIYua.exe
  C:\Windows\System\trBIYua.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\hLqQqiN.exe
  C:\Windows\System\hLqQqiN.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\KQuoRHc.exe
  C:\Windows\System\KQuoRHc.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\kibkEIE.exe
  C:\Windows\System\kibkEIE.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\KlKJZpl.exe
  C:\Windows\System\KlKJZpl.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\TOrGgfi.exe
  C:\Windows\System\TOrGgfi.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\SNAOEMf.exe
  C:\Windows\System\SNAOEMf.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\lxIIipB.exe
  C:\Windows\System\lxIIipB.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\TRnKfEh.exe
  C:\Windows\System\TRnKfEh.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\fLAqzWu.exe
  C:\Windows\System\fLAqzWu.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\VBSEhGK.exe
  C:\Windows\System\VBSEhGK.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JqCCbMy.exe
  C:\Windows\System\JqCCbMy.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\sVBafIL.exe
  C:\Windows\System\sVBafIL.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\GiekTRt.exe
  C:\Windows\System\GiekTRt.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\YEWuMMW.exe
  C:\Windows\System\YEWuMMW.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\QqzTpuC.exe
  C:\Windows\System\QqzTpuC.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\xbcwEFI.exe
  C:\Windows\System\xbcwEFI.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\XsOMAvT.exe
  C:\Windows\System\XsOMAvT.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\tPfLYiH.exe
  C:\Windows\System\tPfLYiH.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\NGKBqCj.exe
  C:\Windows\System\NGKBqCj.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\XsCQQWe.exe
  C:\Windows\System\XsCQQWe.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\epIKJjW.exe
  C:\Windows\System\epIKJjW.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\vspfbAp.exe
  C:\Windows\System\vspfbAp.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\SpyCJYm.exe
  C:\Windows\System\SpyCJYm.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\RpMHVyl.exe
  C:\Windows\System\RpMHVyl.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\DoIhmOD.exe
  C:\Windows\System\DoIhmOD.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\gJXuUOR.exe
  C:\Windows\System\gJXuUOR.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\tqaimHM.exe
  C:\Windows\System\tqaimHM.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\OMxjSft.exe
  C:\Windows\System\OMxjSft.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\PlajEFd.exe
  C:\Windows\System\PlajEFd.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\PcIVyIP.exe
  C:\Windows\System\PcIVyIP.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\gXcQUpO.exe
  C:\Windows\System\gXcQUpO.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\mVwYNDZ.exe
  C:\Windows\System\mVwYNDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\hurkbJP.exe
  C:\Windows\System\hurkbJP.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\MzeEvkm.exe
  C:\Windows\System\MzeEvkm.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\UtdExfv.exe
  C:\Windows\System\UtdExfv.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\GTejVDv.exe
  C:\Windows\System\GTejVDv.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\SceKnMn.exe
  C:\Windows\System\SceKnMn.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\UdFHGvV.exe
  C:\Windows\System\UdFHGvV.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\ApmuoLw.exe
  C:\Windows\System\ApmuoLw.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\DohZGib.exe
  C:\Windows\System\DohZGib.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\bEPbIxL.exe
  C:\Windows\System\bEPbIxL.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\NIyjujY.exe
  C:\Windows\System\NIyjujY.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\IXPkDLG.exe
  C:\Windows\System\IXPkDLG.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\RZxJJqr.exe
  C:\Windows\System\RZxJJqr.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\YXLeAWA.exe
  C:\Windows\System\YXLeAWA.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\OhFyXWQ.exe
  C:\Windows\System\OhFyXWQ.exe
  2⤵
  PID:2168
- C:\Windows\System\ElAjuQM.exe
  C:\Windows\System\ElAjuQM.exe
  2⤵
  PID:1528
- C:\Windows\System\bFEvLSr.exe
  C:\Windows\System\bFEvLSr.exe
  2⤵
  PID:2392
- C:\Windows\System\APqZyWj.exe
  C:\Windows\System\APqZyWj.exe
  2⤵
  PID:2456
- C:\Windows\System\FcppRlv.exe
  C:\Windows\System\FcppRlv.exe
  2⤵
  PID:2080
- C:\Windows\System\WYjKpIp.exe
  C:\Windows\System\WYjKpIp.exe
  2⤵
  PID:780
- C:\Windows\System\nTMIyFJ.exe
  C:\Windows\System\nTMIyFJ.exe
  2⤵
  PID:1752
- C:\Windows\System\VRcomrz.exe
  C:\Windows\System\VRcomrz.exe
  2⤵
  PID:1384
- C:\Windows\System\oQomaUF.exe
  C:\Windows\System\oQomaUF.exe
  2⤵
  PID:2588
- C:\Windows\System\iCkVlTZ.exe
  C:\Windows\System\iCkVlTZ.exe
  2⤵
  PID:2596
- C:\Windows\System\UfdAxzB.exe
  C:\Windows\System\UfdAxzB.exe
  2⤵
  PID:1800
- C:\Windows\System\UMaFCpT.exe
  C:\Windows\System\UMaFCpT.exe
  2⤵
  PID:1840
- C:\Windows\System\OtexNMO.exe
  C:\Windows\System\OtexNMO.exe
  2⤵
  PID:1148
- C:\Windows\System\lqMVeFv.exe
  C:\Windows\System\lqMVeFv.exe
  2⤵
  PID:2208
- C:\Windows\System\KbjjNTS.exe
  C:\Windows\System\KbjjNTS.exe
  2⤵
  PID:1240
- C:\Windows\System\xWbsWOH.exe
  C:\Windows\System\xWbsWOH.exe
  2⤵
  PID:2360
- C:\Windows\System\qaqcoEd.exe
  C:\Windows\System\qaqcoEd.exe
  2⤵
  PID:2180
- C:\Windows\System\zfUNKQr.exe
  C:\Windows\System\zfUNKQr.exe
  2⤵
  PID:1784
- C:\Windows\System\sltBCiM.exe
  C:\Windows\System\sltBCiM.exe
  2⤵
  PID:2900
- C:\Windows\System\IbptiuL.exe
  C:\Windows\System\IbptiuL.exe
  2⤵
  PID:848
- C:\Windows\System\TzDJgGQ.exe
  C:\Windows\System\TzDJgGQ.exe
  2⤵
  PID:2448
- C:\Windows\System\fRfQzbN.exe
  C:\Windows\System\fRfQzbN.exe
  2⤵
  PID:596
- C:\Windows\System\hthobti.exe
  C:\Windows\System\hthobti.exe
  2⤵
  PID:1984
- C:\Windows\System\plqMRWW.exe
  C:\Windows\System\plqMRWW.exe
  2⤵
  PID:1616
- C:\Windows\System\TsyePtP.exe
  C:\Windows\System\TsyePtP.exe
  2⤵
  PID:1684
- C:\Windows\System\aEeuQhE.exe
  C:\Windows\System\aEeuQhE.exe
  2⤵
  PID:940
- C:\Windows\System\lwYYlxb.exe
  C:\Windows\System\lwYYlxb.exe
  2⤵
  PID:2944
- C:\Windows\System\cipzGSi.exe
  C:\Windows\System\cipzGSi.exe
  2⤵
  PID:2876
- C:\Windows\System\GQUzcmb.exe
  C:\Windows\System\GQUzcmb.exe
  2⤵
  PID:2836
- C:\Windows\System\THqYbtu.exe
  C:\Windows\System\THqYbtu.exe
  2⤵
  PID:1820
- C:\Windows\System\jJwXLEX.exe
  C:\Windows\System\jJwXLEX.exe
  2⤵
  PID:1252
- C:\Windows\System\BjXWjBg.exe
  C:\Windows\System\BjXWjBg.exe
  2⤵
  PID:2548
- C:\Windows\System\xlhklIb.exe
  C:\Windows\System\xlhklIb.exe
  2⤵
  PID:2988
- C:\Windows\System\nUpGOpt.exe
  C:\Windows\System\nUpGOpt.exe
  2⤵
  PID:1740
- C:\Windows\System\dLZRpHq.exe
  C:\Windows\System\dLZRpHq.exe
  2⤵
  PID:2200
- C:\Windows\System\pZoRZgn.exe
  C:\Windows\System\pZoRZgn.exe
  2⤵
  PID:2136
- C:\Windows\System\swiJDHJ.exe
  C:\Windows\System\swiJDHJ.exe
  2⤵
  PID:2980
- C:\Windows\System\gmrmRPH.exe
  C:\Windows\System\gmrmRPH.exe
  2⤵
  PID:2224
- C:\Windows\System\vIWlqGT.exe
  C:\Windows\System\vIWlqGT.exe
  2⤵
  PID:2612
- C:\Windows\System\LbaTXNF.exe
  C:\Windows\System\LbaTXNF.exe
  2⤵
  PID:2880
- C:\Windows\System\ctByWtm.exe
  C:\Windows\System\ctByWtm.exe
  2⤵
  PID:2568
- C:\Windows\System\zcYnxAQ.exe
  C:\Windows\System\zcYnxAQ.exe
  2⤵
  PID:1436
- C:\Windows\System\CXVsuoi.exe
  C:\Windows\System\CXVsuoi.exe
  2⤵
  PID:1628
- C:\Windows\System\WXaARKT.exe
  C:\Windows\System\WXaARKT.exe
  2⤵
  PID:1708
- C:\Windows\System\MspLBZZ.exe
  C:\Windows\System\MspLBZZ.exe
  2⤵
  PID:2452
- C:\Windows\System\IagzOwY.exe
  C:\Windows\System\IagzOwY.exe
  2⤵
  PID:868
- C:\Windows\System\GzlfBqR.exe
  C:\Windows\System\GzlfBqR.exe
  2⤵
  PID:1568
- C:\Windows\System\MEKGkwh.exe
  C:\Windows\System\MEKGkwh.exe
  2⤵
  PID:1204
- C:\Windows\System\iJtsYBB.exe
  C:\Windows\System\iJtsYBB.exe
  2⤵
  PID:1020
- C:\Windows\System\wRnPMCd.exe
  C:\Windows\System\wRnPMCd.exe
  2⤵
  PID:900
- C:\Windows\System\cvtPgQI.exe
  C:\Windows\System\cvtPgQI.exe
  2⤵
  PID:1340
- C:\Windows\System\DhGTfBq.exe
  C:\Windows\System\DhGTfBq.exe
  2⤵
  PID:1900
- C:\Windows\System\zDVFpJK.exe
  C:\Windows\System\zDVFpJK.exe
  2⤵
  PID:2712
- C:\Windows\System\tGRBwdg.exe
  C:\Windows\System\tGRBwdg.exe
  2⤵
  PID:2684
- C:\Windows\System\LoOMaQr.exe
  C:\Windows\System\LoOMaQr.exe
  2⤵
  PID:2264
- C:\Windows\System\MjJCybR.exe
  C:\Windows\System\MjJCybR.exe
  2⤵
  PID:1720
- C:\Windows\System\tQIrDew.exe
  C:\Windows\System\tQIrDew.exe
  2⤵
  PID:1688
- C:\Windows\System\HaLAFSn.exe
  C:\Windows\System\HaLAFSn.exe
  2⤵
  PID:1268
- C:\Windows\System\rclzThg.exe
  C:\Windows\System\rclzThg.exe
  2⤵
  PID:2920
- C:\Windows\System\kphWJLB.exe
  C:\Windows\System\kphWJLB.exe
  2⤵
  PID:2024
- C:\Windows\System\KDZIDjH.exe
  C:\Windows\System\KDZIDjH.exe
  2⤵
  PID:2268
- C:\Windows\System\ypVeSuo.exe
  C:\Windows\System\ypVeSuo.exe
  2⤵
  PID:2476
- C:\Windows\System\zJMMBKI.exe
  C:\Windows\System\zJMMBKI.exe
  2⤵
  PID:2540
- C:\Windows\System\RdDQaJm.exe
  C:\Windows\System\RdDQaJm.exe
  2⤵
  PID:2004
- C:\Windows\System\CQDhEyp.exe
  C:\Windows\System\CQDhEyp.exe
  2⤵
  PID:1692
- C:\Windows\System\GanHEwk.exe
  C:\Windows\System\GanHEwk.exe
  2⤵
  PID:1656
- C:\Windows\System\WVnaeFn.exe
  C:\Windows\System\WVnaeFn.exe
  2⤵
  PID:2840
- C:\Windows\System\seLPcXI.exe
  C:\Windows\System\seLPcXI.exe
  2⤵
  PID:1516
- C:\Windows\System\XyXfHFE.exe
  C:\Windows\System\XyXfHFE.exe
  2⤵
  PID:3044
- C:\Windows\System\YQENkhG.exe
  C:\Windows\System\YQENkhG.exe
  2⤵
  PID:2440
- C:\Windows\System\xkGAuHd.exe
  C:\Windows\System\xkGAuHd.exe
  2⤵
  PID:2576
- C:\Windows\System\nvyqFtn.exe
  C:\Windows\System\nvyqFtn.exe
  2⤵
  PID:2528
- C:\Windows\System\HvhxfjU.exe
  C:\Windows\System\HvhxfjU.exe
  2⤵
  PID:2892
- C:\Windows\System\pzGWxqj.exe
  C:\Windows\System\pzGWxqj.exe
  2⤵
  PID:2784
- C:\Windows\System\LnxGAvZ.exe
  C:\Windows\System\LnxGAvZ.exe
  2⤵
  PID:1120
- C:\Windows\System\fwGTwOS.exe
  C:\Windows\System\fwGTwOS.exe
  2⤵
  PID:2364
- C:\Windows\System\mXUBPUD.exe
  C:\Windows\System\mXUBPUD.exe
  2⤵
  PID:2404
- C:\Windows\System\BrLVwoF.exe
  C:\Windows\System\BrLVwoF.exe
  2⤵
  PID:460
- C:\Windows\System\pVGnXei.exe
  C:\Windows\System\pVGnXei.exe
  2⤵
  PID:1012
- C:\Windows\System\InJLZLK.exe
  C:\Windows\System\InJLZLK.exe
  2⤵
  PID:1104
- C:\Windows\System\ZqXQKIH.exe
  C:\Windows\System\ZqXQKIH.exe
  2⤵
  PID:2748
- C:\Windows\System\HaBOzRj.exe
  C:\Windows\System\HaBOzRj.exe
  2⤵
  PID:1116
- C:\Windows\System\XkvfKBR.exe
  C:\Windows\System\XkvfKBR.exe
  2⤵
  PID:3016
- C:\Windows\System\dhTRmaf.exe
  C:\Windows\System\dhTRmaf.exe
  2⤵
  PID:1216
- C:\Windows\System\VppSNGU.exe
  C:\Windows\System\VppSNGU.exe
  2⤵
  PID:2964
- C:\Windows\System\nQHXLIn.exe
  C:\Windows\System\nQHXLIn.exe
  2⤵
  PID:2408
- C:\Windows\System\bTPspRM.exe
  C:\Windows\System\bTPspRM.exe
  2⤵
  PID:1680
- C:\Windows\System\fYFDYSS.exe
  C:\Windows\System\fYFDYSS.exe
  2⤵
  PID:564
- C:\Windows\System\BbXxOCh.exe
  C:\Windows\System\BbXxOCh.exe
  2⤵
  PID:2736
- C:\Windows\System\PHKkoDv.exe
  C:\Windows\System\PHKkoDv.exe
  2⤵
  PID:2692
- C:\Windows\System\WVvPNbV.exe
  C:\Windows\System\WVvPNbV.exe
  2⤵
  PID:816
- C:\Windows\System\jkgxNRS.exe
  C:\Windows\System\jkgxNRS.exe
  2⤵
  PID:2084
- C:\Windows\System\QjwyWbw.exe
  C:\Windows\System\QjwyWbw.exe
  2⤵
  PID:1992
- C:\Windows\System\GuYiDey.exe
  C:\Windows\System\GuYiDey.exe
  2⤵
  PID:2096
- C:\Windows\System\VbSwOUN.exe
  C:\Windows\System\VbSwOUN.exe
  2⤵
  PID:2184
- C:\Windows\System\UTaEUnu.exe
  C:\Windows\System\UTaEUnu.exe
  2⤵
  PID:2652
- C:\Windows\System\wffBKnc.exe
  C:\Windows\System\wffBKnc.exe
  2⤵
  PID:2028
- C:\Windows\System\CxhIpOC.exe
  C:\Windows\System\CxhIpOC.exe
  2⤵
  PID:2704
- C:\Windows\System\QOgvNHq.exe
  C:\Windows\System\QOgvNHq.exe
  2⤵
  PID:1736
- C:\Windows\System\dHIkbpw.exe
  C:\Windows\System\dHIkbpw.exe
  2⤵
  PID:1056
- C:\Windows\System\MEiXoKd.exe
  C:\Windows\System\MEiXoKd.exe
  2⤵
  PID:2036
- C:\Windows\System\xtbCEHt.exe
  C:\Windows\System\xtbCEHt.exe
  2⤵
  PID:2772
- C:\Windows\System\OeaBVOu.exe
  C:\Windows\System\OeaBVOu.exe
  2⤵
  PID:1608
- C:\Windows\System\sdRHwoL.exe
  C:\Windows\System\sdRHwoL.exe
  2⤵
  PID:2432
- C:\Windows\System\sFEHJGz.exe
  C:\Windows\System\sFEHJGz.exe
  2⤵
  PID:1336
- C:\Windows\System\onwRoGK.exe
  C:\Windows\System\onwRoGK.exe
  2⤵
  PID:1764
- C:\Windows\System\XlAqQzq.exe
  C:\Windows\System\XlAqQzq.exe
  2⤵
  PID:2260
- C:\Windows\System\Ooflpxc.exe
  C:\Windows\System\Ooflpxc.exe
  2⤵
  PID:2756
- C:\Windows\System\gxQFUmH.exe
  C:\Windows\System\gxQFUmH.exe
  2⤵
  PID:1164
- C:\Windows\System\dlYvOJE.exe
  C:\Windows\System\dlYvOJE.exe
  2⤵
  PID:1920
- C:\Windows\System\goIRIsx.exe
  C:\Windows\System\goIRIsx.exe
  2⤵
  PID:2436
- C:\Windows\System\taSBBgQ.exe
  C:\Windows\System\taSBBgQ.exe
  2⤵
  PID:1580
- C:\Windows\System\vIKQCeM.exe
  C:\Windows\System\vIKQCeM.exe
  2⤵
  PID:876
- C:\Windows\System\UkQqHci.exe
  C:\Windows\System\UkQqHci.exe
  2⤵
  PID:944
- C:\Windows\System\jSHvxoz.exe
  C:\Windows\System\jSHvxoz.exe
  2⤵
  PID:2320
- C:\Windows\System\TSvYMlC.exe
  C:\Windows\System\TSvYMlC.exe
  2⤵
  PID:1952
- C:\Windows\System\XjWrkwm.exe
  C:\Windows\System\XjWrkwm.exe
  2⤵
  PID:3128
- C:\Windows\System\NhcZUyz.exe
  C:\Windows\System\NhcZUyz.exe
  2⤵
  PID:3144
- C:\Windows\System\NTCcCaD.exe
  C:\Windows\System\NTCcCaD.exe
  2⤵
  PID:3168
- C:\Windows\System\zpavGge.exe
  C:\Windows\System\zpavGge.exe
  2⤵
  PID:3184
- C:\Windows\System\lRvtodd.exe
  C:\Windows\System\lRvtodd.exe
  2⤵
  PID:3200
- C:\Windows\System\yeNbMnl.exe
  C:\Windows\System\yeNbMnl.exe
  2⤵
  PID:3216
- C:\Windows\System\joWyaTF.exe
  C:\Windows\System\joWyaTF.exe
  2⤵
  PID:3232
- C:\Windows\System\cPWEKEd.exe
  C:\Windows\System\cPWEKEd.exe
  2⤵
  PID:3248
- C:\Windows\System\bqZyOlu.exe
  C:\Windows\System\bqZyOlu.exe
  2⤵
  PID:3264
- C:\Windows\System\bNprUJn.exe
  C:\Windows\System\bNprUJn.exe
  2⤵
  PID:3280
- C:\Windows\System\IxxeAae.exe
  C:\Windows\System\IxxeAae.exe
  2⤵
  PID:3300
- C:\Windows\System\SIIyjZQ.exe
  C:\Windows\System\SIIyjZQ.exe
  2⤵
  PID:3316
- C:\Windows\System\jNwYFxz.exe
  C:\Windows\System\jNwYFxz.exe
  2⤵
  PID:3332
- C:\Windows\System\lsXRcVr.exe
  C:\Windows\System\lsXRcVr.exe
  2⤵
  PID:3348
- C:\Windows\System\iEiuapN.exe
  C:\Windows\System\iEiuapN.exe
  2⤵
  PID:3404
- C:\Windows\System\bbnMhUR.exe
  C:\Windows\System\bbnMhUR.exe
  2⤵
  PID:3452
- C:\Windows\System\EMVJnCM.exe
  C:\Windows\System\EMVJnCM.exe
  2⤵
  PID:3468
- C:\Windows\System\oRwGTmg.exe
  C:\Windows\System\oRwGTmg.exe
  2⤵
  PID:3484
- C:\Windows\System\lGnPjMm.exe
  C:\Windows\System\lGnPjMm.exe
  2⤵
  PID:3500
- C:\Windows\System\YQKGndv.exe
  C:\Windows\System\YQKGndv.exe
  2⤵
  PID:3520
- C:\Windows\System\wjZakxU.exe
  C:\Windows\System\wjZakxU.exe
  2⤵
  PID:3536
- C:\Windows\System\oDooCjA.exe
  C:\Windows\System\oDooCjA.exe
  2⤵
  PID:3552
- C:\Windows\System\rvDIWBx.exe
  C:\Windows\System\rvDIWBx.exe
  2⤵
  PID:3572
- C:\Windows\System\dmFUdoh.exe
  C:\Windows\System\dmFUdoh.exe
  2⤵
  PID:3588
- C:\Windows\System\PInFYlT.exe
  C:\Windows\System\PInFYlT.exe
  2⤵
  PID:3604
- C:\Windows\System\DfhdOXJ.exe
  C:\Windows\System\DfhdOXJ.exe
  2⤵
  PID:3624
- C:\Windows\System\WcJHGxb.exe
  C:\Windows\System\WcJHGxb.exe
  2⤵
  PID:3640
- C:\Windows\System\fnxLFWh.exe
  C:\Windows\System\fnxLFWh.exe
  2⤵
  PID:3656
- C:\Windows\System\lzwisxj.exe
  C:\Windows\System\lzwisxj.exe
  2⤵
  PID:3672
- C:\Windows\System\rYWLPoi.exe
  C:\Windows\System\rYWLPoi.exe
  2⤵
  PID:3688
- C:\Windows\System\pNSJcBN.exe
  C:\Windows\System\pNSJcBN.exe
  2⤵
  PID:3704
- C:\Windows\System\wNIbrSs.exe
  C:\Windows\System\wNIbrSs.exe
  2⤵
  PID:3720
- C:\Windows\System\ivkoAAT.exe
  C:\Windows\System\ivkoAAT.exe
  2⤵
  PID:3736
- C:\Windows\System\WqKUPuK.exe
  C:\Windows\System\WqKUPuK.exe
  2⤵
  PID:3752
- C:\Windows\System\efAYUEj.exe
  C:\Windows\System\efAYUEj.exe
  2⤵
  PID:3852
- C:\Windows\System\eSKyyfl.exe
  C:\Windows\System\eSKyyfl.exe
  2⤵
  PID:3880
- C:\Windows\System\dRnzlCM.exe
  C:\Windows\System\dRnzlCM.exe
  2⤵
  PID:3896
- C:\Windows\System\cxfrSup.exe
  C:\Windows\System\cxfrSup.exe
  2⤵
  PID:3912
- C:\Windows\System\UfSebnB.exe
  C:\Windows\System\UfSebnB.exe
  2⤵
  PID:3928
- C:\Windows\System\YTvzkRI.exe
  C:\Windows\System\YTvzkRI.exe
  2⤵
  PID:3944
- C:\Windows\System\dCVbKqE.exe
  C:\Windows\System\dCVbKqE.exe
  2⤵
  PID:3960
- C:\Windows\System\gaCdHvH.exe
  C:\Windows\System\gaCdHvH.exe
  2⤵
  PID:3976
- C:\Windows\System\AvbTaMv.exe
  C:\Windows\System\AvbTaMv.exe
  2⤵
  PID:3992
- C:\Windows\System\vnuujnz.exe
  C:\Windows\System\vnuujnz.exe
  2⤵
  PID:4012
- C:\Windows\System\JjkZjvz.exe
  C:\Windows\System\JjkZjvz.exe
  2⤵
  PID:4028
- C:\Windows\System\VaSEWcT.exe
  C:\Windows\System\VaSEWcT.exe
  2⤵
  PID:4044
- C:\Windows\System\MpwpDcq.exe
  C:\Windows\System\MpwpDcq.exe
  2⤵
  PID:4064
- C:\Windows\System\TPIOgGa.exe
  C:\Windows\System\TPIOgGa.exe
  2⤵
  PID:4080
- C:\Windows\System\HIrSkqV.exe
  C:\Windows\System\HIrSkqV.exe
  2⤵
  PID:2212
- C:\Windows\System\ptfhncf.exe
  C:\Windows\System\ptfhncf.exe
  2⤵
  PID:2424
- C:\Windows\System\LtZnXtt.exe
  C:\Windows\System\LtZnXtt.exe
  2⤵
  PID:1248
- C:\Windows\System\CKlxTxg.exe
  C:\Windows\System\CKlxTxg.exe
  2⤵
  PID:3080
- C:\Windows\System\uNiYAiX.exe
  C:\Windows\System\uNiYAiX.exe
  2⤵
  PID:3116
- C:\Windows\System\VhdDsei.exe
  C:\Windows\System\VhdDsei.exe
  2⤵
  PID:1060
- C:\Windows\System\xfYtNPN.exe
  C:\Windows\System\xfYtNPN.exe
  2⤵
  PID:852
- C:\Windows\System\weUdohS.exe
  C:\Windows\System\weUdohS.exe
  2⤵
  PID:1660
- C:\Windows\System\NDwEOAl.exe
  C:\Windows\System\NDwEOAl.exe
  2⤵
  PID:3136
- C:\Windows\System\sdwKvSe.exe
  C:\Windows\System\sdwKvSe.exe
  2⤵
  PID:3164
- C:\Windows\System\MaepGjb.exe
  C:\Windows\System\MaepGjb.exe
  2⤵
  PID:3272
- C:\Windows\System\SEERtCu.exe
  C:\Windows\System\SEERtCu.exe
  2⤵
  PID:3340
- C:\Windows\System\KAlcYaI.exe
  C:\Windows\System\KAlcYaI.exe
  2⤵
  PID:3180
- C:\Windows\System\MJipjfz.exe
  C:\Windows\System\MJipjfz.exe
  2⤵
  PID:3196
- C:\Windows\System\abOoABE.exe
  C:\Windows\System\abOoABE.exe
  2⤵
  PID:3420
- C:\Windows\System\hEMDQVI.exe
  C:\Windows\System\hEMDQVI.exe
  2⤵
  PID:3228
- C:\Windows\System\CbrZexo.exe
  C:\Windows\System\CbrZexo.exe
  2⤵
  PID:3292
- C:\Windows\System\fRzrogX.exe
  C:\Windows\System\fRzrogX.exe
  2⤵
  PID:3388
- C:\Windows\System\yUAHbnV.exe
  C:\Windows\System\yUAHbnV.exe
  2⤵
  PID:3368
- C:\Windows\System\BDjBMGH.exe
  C:\Windows\System\BDjBMGH.exe
  2⤵
  PID:3384
- C:\Windows\System\OLhCazG.exe
  C:\Windows\System\OLhCazG.exe
  2⤵
  PID:3400
- C:\Windows\System\peYuFBS.exe
  C:\Windows\System\peYuFBS.exe
  2⤵
  PID:3664
- C:\Windows\System\uPYOnBR.exe
  C:\Windows\System\uPYOnBR.exe
  2⤵
  PID:3492
- C:\Windows\System\GXDBoCd.exe
  C:\Windows\System\GXDBoCd.exe
  2⤵
  PID:3748
- C:\Windows\System\NEjUSBT.exe
  C:\Windows\System\NEjUSBT.exe
  2⤵
  PID:3580
- C:\Windows\System\yeoqusb.exe
  C:\Windows\System\yeoqusb.exe
  2⤵
  PID:3652
- C:\Windows\System\SEWSgRt.exe
  C:\Windows\System\SEWSgRt.exe
  2⤵
  PID:3560
- C:\Windows\System\rFyNhnl.exe
  C:\Windows\System\rFyNhnl.exe
  2⤵
  PID:3632
- C:\Windows\System\rkJNqki.exe
  C:\Windows\System\rkJNqki.exe
  2⤵
  PID:3668
- C:\Windows\System\QIEmKMe.exe
  C:\Windows\System\QIEmKMe.exe
  2⤵
  PID:3760
- C:\Windows\System\mqPvZIq.exe
  C:\Windows\System\mqPvZIq.exe
  2⤵
  PID:3776
- C:\Windows\System\AODzXAs.exe
  C:\Windows\System\AODzXAs.exe
  2⤵
  PID:3796
- C:\Windows\System\GOdhytH.exe
  C:\Windows\System\GOdhytH.exe
  2⤵
  PID:3824
- C:\Windows\System\eIfrWaT.exe
  C:\Windows\System\eIfrWaT.exe
  2⤵
  PID:3840
- C:\Windows\System\TOkwTRT.exe
  C:\Windows\System\TOkwTRT.exe
  2⤵
  PID:3860
- C:\Windows\System\ZBadbTl.exe
  C:\Windows\System\ZBadbTl.exe
  2⤵
  PID:3848
- C:\Windows\System\zYZCWcC.exe
  C:\Windows\System\zYZCWcC.exe
  2⤵
  PID:2940
- C:\Windows\System\onYiKmk.exe
  C:\Windows\System\onYiKmk.exe
  2⤵
  PID:3968
- C:\Windows\System\neRDyYD.exe
  C:\Windows\System\neRDyYD.exe
  2⤵
  PID:4008
- C:\Windows\System\cZLwSBF.exe
  C:\Windows\System\cZLwSBF.exe
  2⤵
  PID:4072
- C:\Windows\System\juAdeoC.exe
  C:\Windows\System\juAdeoC.exe
  2⤵
  PID:3084
- C:\Windows\System\TviOohZ.exe
  C:\Windows\System\TviOohZ.exe
  2⤵
  PID:2768
- C:\Windows\System\xxStdjB.exe
  C:\Windows\System\xxStdjB.exe
  2⤵
  PID:3312
- C:\Windows\System\LuhjwvW.exe
  C:\Windows\System\LuhjwvW.exe
  2⤵
  PID:4112
- C:\Windows\System\vufbGtb.exe
  C:\Windows\System\vufbGtb.exe
  2⤵
  PID:4216
- C:\Windows\System\jFlRkZs.exe
  C:\Windows\System\jFlRkZs.exe
  2⤵
  PID:4232
- C:\Windows\System\MvxEZzU.exe
  C:\Windows\System\MvxEZzU.exe
  2⤵
  PID:4252
- C:\Windows\System\mmwgIpO.exe
  C:\Windows\System\mmwgIpO.exe
  2⤵
  PID:4268
- C:\Windows\System\McQGZYF.exe
  C:\Windows\System\McQGZYF.exe
  2⤵
  PID:4288
- C:\Windows\System\LxHHfjK.exe
  C:\Windows\System\LxHHfjK.exe
  2⤵
  PID:4304
- C:\Windows\System\AxEGevr.exe
  C:\Windows\System\AxEGevr.exe
  2⤵
  PID:4320
- C:\Windows\System\IMwKVmg.exe
  C:\Windows\System\IMwKVmg.exe
  2⤵
  PID:4336
- C:\Windows\System\IILvVDj.exe
  C:\Windows\System\IILvVDj.exe
  2⤵
  PID:4352
- C:\Windows\System\VHVjSDB.exe
  C:\Windows\System\VHVjSDB.exe
  2⤵
  PID:4368
- C:\Windows\System\ekbmHps.exe
  C:\Windows\System\ekbmHps.exe
  2⤵
  PID:4384
- C:\Windows\System\zrZfAXf.exe
  C:\Windows\System\zrZfAXf.exe
  2⤵
  PID:4400
- C:\Windows\System\mMTXIuX.exe
  C:\Windows\System\mMTXIuX.exe
  2⤵
  PID:4416
- C:\Windows\System\oozAYbO.exe
  C:\Windows\System\oozAYbO.exe
  2⤵
  PID:4432
- C:\Windows\System\mIPUGLL.exe
  C:\Windows\System\mIPUGLL.exe
  2⤵
  PID:4448
- C:\Windows\System\aziSBcY.exe
  C:\Windows\System\aziSBcY.exe
  2⤵
  PID:4464
- C:\Windows\System\kJwQwif.exe
  C:\Windows\System\kJwQwif.exe
  2⤵
  PID:4480
- C:\Windows\System\cHbclYH.exe
  C:\Windows\System\cHbclYH.exe
  2⤵
  PID:4496
- C:\Windows\System\wDGkqwh.exe
  C:\Windows\System\wDGkqwh.exe
  2⤵
  PID:4516
- C:\Windows\System\fJXPGiV.exe
  C:\Windows\System\fJXPGiV.exe
  2⤵
  PID:4532
- C:\Windows\System\fHSetwr.exe
  C:\Windows\System\fHSetwr.exe
  2⤵
  PID:4548
- C:\Windows\System\KiarOUD.exe
  C:\Windows\System\KiarOUD.exe
  2⤵
  PID:4564
- C:\Windows\System\rqLTeQx.exe
  C:\Windows\System\rqLTeQx.exe
  2⤵
  PID:4580
- C:\Windows\System\bLinkHM.exe
  C:\Windows\System\bLinkHM.exe
  2⤵
  PID:4596
- C:\Windows\System\iUfbgiH.exe
  C:\Windows\System\iUfbgiH.exe
  2⤵
  PID:4612
- C:\Windows\System\vnIynXe.exe
  C:\Windows\System\vnIynXe.exe
  2⤵
  PID:4632
- C:\Windows\System\LUFQURH.exe
  C:\Windows\System\LUFQURH.exe
  2⤵
  PID:4648
- C:\Windows\System\ZqvYwjN.exe
  C:\Windows\System\ZqvYwjN.exe
  2⤵
  PID:4664
- C:\Windows\System\JQBTpEa.exe
  C:\Windows\System\JQBTpEa.exe
  2⤵
  PID:4680
- C:\Windows\System\BCjHzCV.exe
  C:\Windows\System\BCjHzCV.exe
  2⤵
  PID:4696
- C:\Windows\System\SWnkRJm.exe
  C:\Windows\System\SWnkRJm.exe
  2⤵
  PID:4712
- C:\Windows\System\ICDZjRv.exe
  C:\Windows\System\ICDZjRv.exe
  2⤵
  PID:4732
- C:\Windows\System\YyMaWeB.exe
  C:\Windows\System\YyMaWeB.exe
  2⤵
  PID:4752
- C:\Windows\System\YvJayZP.exe
  C:\Windows\System\YvJayZP.exe
  2⤵
  PID:4768
- C:\Windows\System\lVzBivV.exe
  C:\Windows\System\lVzBivV.exe
  2⤵
  PID:4784
- C:\Windows\System\eEQdtMW.exe
  C:\Windows\System\eEQdtMW.exe
  2⤵
  PID:4800
- C:\Windows\System\aWScCTd.exe
  C:\Windows\System\aWScCTd.exe
  2⤵
  PID:4816
- C:\Windows\System\CfwopgL.exe
  C:\Windows\System\CfwopgL.exe
  2⤵
  PID:4832
- C:\Windows\System\NCiwLXX.exe
  C:\Windows\System\NCiwLXX.exe
  2⤵
  PID:4848
- C:\Windows\System\IhpHBqb.exe
  C:\Windows\System\IhpHBqb.exe
  2⤵
  PID:4868
- C:\Windows\System\aziuTds.exe
  C:\Windows\System\aziuTds.exe
  2⤵
  PID:4884
- C:\Windows\System\MKtGlwO.exe
  C:\Windows\System\MKtGlwO.exe
  2⤵
  PID:4900
- C:\Windows\System\iKLCPGc.exe
  C:\Windows\System\iKLCPGc.exe
  2⤵
  PID:4916
- C:\Windows\System\ysCwpmy.exe
  C:\Windows\System\ysCwpmy.exe
  2⤵
  PID:4932
- C:\Windows\System\iWxAmWk.exe
  C:\Windows\System\iWxAmWk.exe
  2⤵
  PID:4948
- C:\Windows\System\OFzrxuc.exe
  C:\Windows\System\OFzrxuc.exe
  2⤵
  PID:4964
- C:\Windows\System\bYeVkkx.exe
  C:\Windows\System\bYeVkkx.exe
  2⤵
  PID:4980
- C:\Windows\System\pzKlejV.exe
  C:\Windows\System\pzKlejV.exe
  2⤵
  PID:4996
- C:\Windows\System\VwUBvLH.exe
  C:\Windows\System\VwUBvLH.exe
  2⤵
  PID:5020
- C:\Windows\System\zBDpnpf.exe
  C:\Windows\System\zBDpnpf.exe
  2⤵
  PID:5040
- C:\Windows\System\KMpMmMH.exe
  C:\Windows\System\KMpMmMH.exe
  2⤵
  PID:5056
- C:\Windows\System\bmdJlsQ.exe
  C:\Windows\System\bmdJlsQ.exe
  2⤵
  PID:5072
- C:\Windows\System\PHaFOiB.exe
  C:\Windows\System\PHaFOiB.exe
  2⤵
  PID:5088
- C:\Windows\System\rgqxWeD.exe
  C:\Windows\System\rgqxWeD.exe
  2⤵
  PID:5104
- C:\Windows\System\nwLgQBS.exe
  C:\Windows\System\nwLgQBS.exe
  2⤵
  PID:3324
- C:\Windows\System\DOQCNCP.exe
  C:\Windows\System\DOQCNCP.exe
  2⤵
  PID:3924
- C:\Windows\System\YoAQzeh.exe
  C:\Windows\System\YoAQzeh.exe
  2⤵
  PID:3596
- C:\Windows\System\nPZCYqT.exe
  C:\Windows\System\nPZCYqT.exe
  2⤵
  PID:3732
- C:\Windows\System\GhRLbRx.exe
  C:\Windows\System\GhRLbRx.exe
  2⤵
  PID:3788
- C:\Windows\System\GScZABf.exe
  C:\Windows\System\GScZABf.exe
  2⤵
  PID:3904
- C:\Windows\System\TuSLDNk.exe
  C:\Windows\System\TuSLDNk.exe
  2⤵
  PID:3412
- C:\Windows\System\eqGPHfu.exe
  C:\Windows\System\eqGPHfu.exe
  2⤵
  PID:3528
- C:\Windows\System\mobFgMB.exe
  C:\Windows\System\mobFgMB.exe
  2⤵
  PID:3728
- C:\Windows\System\SaXkdpj.exe
  C:\Windows\System\SaXkdpj.exe
  2⤵
  PID:4104
- C:\Windows\System\sPRGIYp.exe
  C:\Windows\System\sPRGIYp.exe
  2⤵
  PID:4024
- C:\Windows\System\XSIcYDO.exe
  C:\Windows\System\XSIcYDO.exe
  2⤵
  PID:4088
- C:\Windows\System\AIePriz.exe
  C:\Windows\System\AIePriz.exe
  2⤵
  PID:4140
- C:\Windows\System\JUHLhId.exe
  C:\Windows\System\JUHLhId.exe
  2⤵
  PID:4148
- C:\Windows\System\uphhIVK.exe
  C:\Windows\System\uphhIVK.exe
  2⤵
  PID:1712
- C:\Windows\System\yuAugIH.exe
  C:\Windows\System\yuAugIH.exe
  2⤵
  PID:3240
- C:\Windows\System\YQHiNVc.exe
  C:\Windows\System\YQHiNVc.exe
  2⤵
  PID:3288
- C:\Windows\System\HunLnvt.exe
  C:\Windows\System\HunLnvt.exe
  2⤵
  PID:3432
- C:\Windows\System\IxFOAzQ.exe
  C:\Windows\System\IxFOAzQ.exe
  2⤵
  PID:3464
- C:\Windows\System\rEAHlht.exe
  C:\Windows\System\rEAHlht.exe
  2⤵
  PID:3548
- C:\Windows\System\nJZbSwv.exe
  C:\Windows\System\nJZbSwv.exe
  2⤵
  PID:3792
- C:\Windows\System\UhWZAyT.exe
  C:\Windows\System\UhWZAyT.exe
  2⤵
  PID:3804
- C:\Windows\System\AGqBwsV.exe
  C:\Windows\System\AGqBwsV.exe
  2⤵
  PID:3876
- C:\Windows\System\Ksnpobm.exe
  C:\Windows\System\Ksnpobm.exe
  2⤵
  PID:4000
- C:\Windows\System\KfbsmZb.exe
  C:\Windows\System\KfbsmZb.exe
  2⤵
  PID:4120
- C:\Windows\System\WqImMGH.exe
  C:\Windows\System\WqImMGH.exe
  2⤵
  PID:4196
- C:\Windows\System\pwbdyYr.exe
  C:\Windows\System\pwbdyYr.exe
  2⤵
  PID:4264
- C:\Windows\System\PzSpLqC.exe
  C:\Windows\System\PzSpLqC.exe
  2⤵
  PID:4208
- C:\Windows\System\gJgzEMs.exe
  C:\Windows\System\gJgzEMs.exe
  2⤵
  PID:4164
- C:\Windows\System\BkdOECq.exe
  C:\Windows\System\BkdOECq.exe
  2⤵
  PID:4180
- C:\Windows\System\XaNCdYZ.exe
  C:\Windows\System\XaNCdYZ.exe
  2⤵
  PID:4240
- C:\Windows\System\RZPjNff.exe
  C:\Windows\System\RZPjNff.exe
  2⤵
  PID:4376
- C:\Windows\System\kJIOFeT.exe
  C:\Windows\System\kJIOFeT.exe
  2⤵
  PID:4312
- C:\Windows\System\ljombAf.exe
  C:\Windows\System\ljombAf.exe
  2⤵
  PID:4348
- C:\Windows\System\EAfdDio.exe
  C:\Windows\System\EAfdDio.exe
  2⤵
  PID:4444
- C:\Windows\System\ssTSQKB.exe
  C:\Windows\System\ssTSQKB.exe
  2⤵
  PID:4508
- C:\Windows\System\VpAABZI.exe
  C:\Windows\System\VpAABZI.exe
  2⤵
  PID:4424
- C:\Windows\System\foGNfqR.exe
  C:\Windows\System\foGNfqR.exe
  2⤵
  PID:4544
- C:\Windows\System\eJDeXmW.exe
  C:\Windows\System\eJDeXmW.exe
  2⤵
  PID:4640
- C:\Windows\System\ZJRaoeZ.exe
  C:\Windows\System\ZJRaoeZ.exe
  2⤵
  PID:4708
- C:\Windows\System\CPnSwyO.exe
  C:\Windows\System\CPnSwyO.exe
  2⤵
  PID:4428
- C:\Windows\System\NTDSvyz.exe
  C:\Windows\System\NTDSvyz.exe
  2⤵
  PID:4776
- C:\Windows\System\cRSzUNf.exe
  C:\Windows\System\cRSzUNf.exe
  2⤵
  PID:4560
- C:\Windows\System\wMFbTrO.exe
  C:\Windows\System\wMFbTrO.exe
  2⤵
  PID:4792
- C:\Windows\System\YqkaVnt.exe
  C:\Windows\System\YqkaVnt.exe
  2⤵
  PID:4720
- C:\Windows\System\pKzayee.exe
  C:\Windows\System\pKzayee.exe
  2⤵
  PID:4828
- C:\Windows\System\qBlrVzy.exe
  C:\Windows\System\qBlrVzy.exe
  2⤵
  PID:4892
- C:\Windows\System\IThUFRV.exe
  C:\Windows\System\IThUFRV.exe
  2⤵
  PID:4876
- C:\Windows\System\VOfIUgf.exe
  C:\Windows\System\VOfIUgf.exe
  2⤵
  PID:4972
- C:\Windows\System\iGBeHwC.exe
  C:\Windows\System\iGBeHwC.exe
  2⤵
  PID:5064
- C:\Windows\System\DAGwZvI.exe
  C:\Windows\System\DAGwZvI.exe
  2⤵
  PID:5052
- C:\Windows\System\URiLmqa.exe
  C:\Windows\System\URiLmqa.exe
  2⤵
  PID:5096
- C:\Windows\System\eRYPMkS.exe
  C:\Windows\System\eRYPMkS.exe
  2⤵
  PID:5112
- C:\Windows\System\crgqzXN.exe
  C:\Windows\System\crgqzXN.exe
  2⤵
  PID:4228
- C:\Windows\System\gAJTXpc.exe
  C:\Windows\System\gAJTXpc.exe
  2⤵
  PID:976
- C:\Windows\System\dGJIPDv.exe
  C:\Windows\System\dGJIPDv.exe
  2⤵
  PID:3832
- C:\Windows\System\GKhWgKK.exe
  C:\Windows\System\GKhWgKK.exe
  2⤵
  PID:4040
- C:\Windows\System\SoGxQdM.exe
  C:\Windows\System\SoGxQdM.exe
  2⤵
  PID:3988
- C:\Windows\System\eqDbUlA.exe
  C:\Windows\System\eqDbUlA.exe
  2⤵
  PID:3544
- C:\Windows\System\qtWsBDY.exe
  C:\Windows\System\qtWsBDY.exe
  2⤵
  PID:3768
- C:\Windows\System\amkOhVz.exe
  C:\Windows\System\amkOhVz.exe
  2⤵
  PID:1016
- C:\Windows\System\ocfmjXI.exe
  C:\Windows\System\ocfmjXI.exe
  2⤵
  PID:1576
- C:\Windows\System\VUgVJgL.exe
  C:\Windows\System\VUgVJgL.exe
  2⤵
  PID:2372
- C:\Windows\System\RmjLddc.exe
  C:\Windows\System\RmjLddc.exe
  2⤵
  PID:4192
- C:\Windows\System\FjSPYpP.exe
  C:\Windows\System\FjSPYpP.exe
  2⤵
  PID:4168
- C:\Windows\System\FGnTZHn.exe
  C:\Windows\System\FGnTZHn.exe
  2⤵
  PID:4276
- C:\Windows\System\vlCdlzZ.exe
  C:\Windows\System\vlCdlzZ.exe
  2⤵
  PID:4412
- C:\Windows\System\aiiyojm.exe
  C:\Windows\System\aiiyojm.exe
  2⤵
  PID:4604
- C:\Windows\System\GPyLbQe.exe
  C:\Windows\System\GPyLbQe.exe
  2⤵
  PID:4476
- C:\Windows\System\lEtqWJS.exe
  C:\Windows\System\lEtqWJS.exe
  2⤵
  PID:4504
- C:\Windows\System\sHZRyXC.exe
  C:\Windows\System\sHZRyXC.exe
  2⤵
  PID:4528
- C:\Windows\System\iOiuxtN.exe
  C:\Windows\System\iOiuxtN.exe
  2⤵
  PID:4592
- C:\Windows\System\WsHoTmR.exe
  C:\Windows\System\WsHoTmR.exe
  2⤵
  PID:4244
- C:\Windows\System\GhNtRJD.exe
  C:\Windows\System\GhNtRJD.exe
  2⤵
  PID:5028
- C:\Windows\System\fBTImsE.exe
  C:\Windows\System\fBTImsE.exe
  2⤵
  PID:5048
- C:\Windows\System\jjZXyuu.exe
  C:\Windows\System\jjZXyuu.exe
  2⤵
  PID:3120
- C:\Windows\System\zJhzYDI.exe
  C:\Windows\System\zJhzYDI.exe
  2⤵
  PID:3100
- C:\Windows\System\HFGyKut.exe
  C:\Windows\System\HFGyKut.exe
  2⤵
  PID:836
- C:\Windows\System\bKDpZPC.exe
  C:\Windows\System\bKDpZPC.exe
  2⤵
  PID:3260
- C:\Windows\System\LZFHQQe.exe
  C:\Windows\System\LZFHQQe.exe
  2⤵
  PID:3816
- C:\Windows\System\uwOBgDH.exe
  C:\Windows\System\uwOBgDH.exe
  2⤵
  PID:4060
- C:\Windows\System\ivDkPdN.exe
  C:\Windows\System\ivDkPdN.exe
  2⤵
  PID:3376
- C:\Windows\System\XbPoAeX.exe
  C:\Windows\System\XbPoAeX.exe
  2⤵
  PID:3568
- C:\Windows\System\INYAZWE.exe
  C:\Windows\System\INYAZWE.exe
  2⤵
  PID:3392
- C:\Windows\System\lGUsaJE.exe
  C:\Windows\System\lGUsaJE.exe
  2⤵
  PID:4188
- C:\Windows\System\vdGPvos.exe
  C:\Windows\System\vdGPvos.exe
  2⤵
  PID:4132
- C:\Windows\System\KrGjaoH.exe
  C:\Windows\System\KrGjaoH.exe
  2⤵
  PID:4576
- C:\Windows\System\mKvMVXH.exe
  C:\Windows\System\mKvMVXH.exe
  2⤵
  PID:4740
- C:\Windows\System\kwhjSLd.exe
  C:\Windows\System\kwhjSLd.exe
  2⤵
  PID:4440
- C:\Windows\System\lJrGSjW.exe
  C:\Windows\System\lJrGSjW.exe
  2⤵
  PID:4992
- C:\Windows\System\AgBMTSJ.exe
  C:\Windows\System\AgBMTSJ.exe
  2⤵
  PID:3864
- C:\Windows\System\OjaSKNI.exe
  C:\Windows\System\OjaSKNI.exe
  2⤵
  PID:4284
- C:\Windows\System\VzvLUnt.exe
  C:\Windows\System\VzvLUnt.exe
  2⤵
  PID:4360
- C:\Windows\System\VAfMaxP.exe
  C:\Windows\System\VAfMaxP.exe
  2⤵
  PID:4344
- C:\Windows\System\btWLTpK.exe
  C:\Windows\System\btWLTpK.exe
  2⤵
  PID:5004
- C:\Windows\System\LGERVbt.exe
  C:\Windows\System\LGERVbt.exe
  2⤵
  PID:4796
- C:\Windows\System\TNgQTwZ.exe
  C:\Windows\System\TNgQTwZ.exe
  2⤵
  PID:3244
- C:\Windows\System\DzfhQZJ.exe
  C:\Windows\System\DzfhQZJ.exe
  2⤵
  PID:2128
- C:\Windows\System\suDxnde.exe
  C:\Windows\System\suDxnde.exe
  2⤵
  PID:3512
- C:\Windows\System\uRvuzuv.exe
  C:\Windows\System\uRvuzuv.exe
  2⤵
  PID:4160
- C:\Windows\System\PNvoYKN.exe
  C:\Windows\System\PNvoYKN.exe
  2⤵
  PID:4672
- C:\Windows\System\EHQpzEe.exe
  C:\Windows\System\EHQpzEe.exe
  2⤵
  PID:3844
- C:\Windows\System\mdemjhR.exe
  C:\Windows\System\mdemjhR.exe
  2⤵
  PID:4824
- C:\Windows\System\qaSQAFK.exe
  C:\Windows\System\qaSQAFK.exe
  2⤵
  PID:3612
- C:\Windows\System\pKOPnrP.exe
  C:\Windows\System\pKOPnrP.exe
  2⤵
  PID:4300
- C:\Windows\System\jwhICBC.exe
  C:\Windows\System\jwhICBC.exe
  2⤵
  PID:4156
- C:\Windows\System\BPDWvEi.exe
  C:\Windows\System\BPDWvEi.exe
  2⤵
  PID:4744
- C:\Windows\System\UpvwOwY.exe
  C:\Windows\System\UpvwOwY.exe
  2⤵
  PID:5360
- C:\Windows\System\DKXVnpY.exe
  C:\Windows\System\DKXVnpY.exe
  2⤵
  PID:5376
- C:\Windows\System\hFJKPEn.exe
  C:\Windows\System\hFJKPEn.exe
  2⤵
  PID:5396
- C:\Windows\System\iEanxtC.exe
  C:\Windows\System\iEanxtC.exe
  2⤵
  PID:5412
- C:\Windows\System\QcQaBdA.exe
  C:\Windows\System\QcQaBdA.exe
  2⤵
  PID:5428
- C:\Windows\System\AHLXFPU.exe
  C:\Windows\System\AHLXFPU.exe
  2⤵
  PID:5444
- C:\Windows\System\tnpmAzE.exe
  C:\Windows\System\tnpmAzE.exe
  2⤵
  PID:5460
- C:\Windows\System\zotJqQV.exe
  C:\Windows\System\zotJqQV.exe
  2⤵
  PID:5476
- C:\Windows\System\fspIqFV.exe
  C:\Windows\System\fspIqFV.exe
  2⤵
  PID:5496
- C:\Windows\System\KHJlUwX.exe
  C:\Windows\System\KHJlUwX.exe
  2⤵
  PID:5512
- C:\Windows\System\cEuXhes.exe
  C:\Windows\System\cEuXhes.exe
  2⤵
  PID:5532
- C:\Windows\System\pNpICui.exe
  C:\Windows\System\pNpICui.exe
  2⤵
  PID:5548
- C:\Windows\System\WEmnqNG.exe
  C:\Windows\System\WEmnqNG.exe
  2⤵
  PID:5640
- C:\Windows\System\rmXzAcY.exe
  C:\Windows\System\rmXzAcY.exe
  2⤵
  PID:5656
- C:\Windows\System\UZXylki.exe
  C:\Windows\System\UZXylki.exe
  2⤵
  PID:5676
- C:\Windows\System\Umhkabf.exe
  C:\Windows\System\Umhkabf.exe
  2⤵
  PID:5692
- C:\Windows\System\SgTPSPo.exe
  C:\Windows\System\SgTPSPo.exe
  2⤵
  PID:5716
- C:\Windows\System\zwEUCZy.exe
  C:\Windows\System\zwEUCZy.exe
  2⤵
  PID:5732
- C:\Windows\System\UkodNye.exe
  C:\Windows\System\UkodNye.exe
  2⤵
  PID:5748
- C:\Windows\System\bsDjmIn.exe
  C:\Windows\System\bsDjmIn.exe
  2⤵
  PID:5768
- C:\Windows\System\SSjLIUG.exe
  C:\Windows\System\SSjLIUG.exe
  2⤵
  PID:5784
- C:\Windows\System\usPYxNY.exe
  C:\Windows\System\usPYxNY.exe
  2⤵
  PID:5800
- C:\Windows\System\LGvBgKD.exe
  C:\Windows\System\LGvBgKD.exe
  2⤵
  PID:5820
- C:\Windows\System\QriYrce.exe
  C:\Windows\System\QriYrce.exe
  2⤵
  PID:5840
- C:\Windows\System\ypxKivH.exe
  C:\Windows\System\ypxKivH.exe
  2⤵
  PID:5860
- C:\Windows\System\iOzsiIy.exe
  C:\Windows\System\iOzsiIy.exe
  2⤵
  PID:5896
- C:\Windows\System\PQglQlC.exe
  C:\Windows\System\PQglQlC.exe
  2⤵
  PID:5912
- C:\Windows\System\NTJXajK.exe
  C:\Windows\System\NTJXajK.exe
  2⤵
  PID:5928
- C:\Windows\System\BjQPsaR.exe
  C:\Windows\System\BjQPsaR.exe
  2⤵
  PID:5948
- C:\Windows\System\zuqmWXX.exe
  C:\Windows\System\zuqmWXX.exe
  2⤵
  PID:5964
- C:\Windows\System\NjVLizK.exe
  C:\Windows\System\NjVLizK.exe
  2⤵
  PID:5980
- C:\Windows\System\IFLhBOf.exe
  C:\Windows\System\IFLhBOf.exe
  2⤵
  PID:5996
- C:\Windows\System\nknzSQi.exe
  C:\Windows\System\nknzSQi.exe
  2⤵
  PID:6020
- C:\Windows\System\Ctssqyp.exe
  C:\Windows\System\Ctssqyp.exe
  2⤵
  PID:6036
- C:\Windows\System\jLHKHEu.exe
  C:\Windows\System\jLHKHEu.exe
  2⤵
  PID:6052
- C:\Windows\System\pvelgcF.exe
  C:\Windows\System\pvelgcF.exe
  2⤵
  PID:6068
- C:\Windows\System\edkDFIJ.exe
  C:\Windows\System\edkDFIJ.exe
  2⤵
  PID:6084
- C:\Windows\System\mXjDHZq.exe
  C:\Windows\System\mXjDHZq.exe
  2⤵
  PID:6112
- C:\Windows\System\BsIuYRh.exe
  C:\Windows\System\BsIuYRh.exe
  2⤵
  PID:6128
- C:\Windows\System\wPwcYlK.exe
  C:\Windows\System\wPwcYlK.exe
  2⤵
  PID:3892
- C:\Windows\System\yeNaMfj.exe
  C:\Windows\System\yeNaMfj.exe
  2⤵
  PID:5436
- C:\Windows\System\sqEahsB.exe
  C:\Windows\System\sqEahsB.exe
  2⤵
  PID:5144
- C:\Windows\System\MChenCm.exe
  C:\Windows\System\MChenCm.exe
  2⤵
  PID:5244
- C:\Windows\System\HAPeDSj.exe
  C:\Windows\System\HAPeDSj.exe
  2⤵
  PID:5324
- C:\Windows\System\oxhLuSx.exe
  C:\Windows\System\oxhLuSx.exe
  2⤵
  PID:5488
- C:\Windows\System\QqnNKdA.exe
  C:\Windows\System\QqnNKdA.exe
  2⤵
  PID:5124
- C:\Windows\System\RnrYuxz.exe
  C:\Windows\System\RnrYuxz.exe
  2⤵
  PID:5564
- C:\Windows\System\pDrbBUp.exe
  C:\Windows\System\pDrbBUp.exe
  2⤵
  PID:5160
- C:\Windows\System\FCwIAFq.exe
  C:\Windows\System\FCwIAFq.exe
  2⤵
  PID:5176
- C:\Windows\System\FccweXt.exe
  C:\Windows\System\FccweXt.exe
  2⤵
  PID:5200
- C:\Windows\System\TrvYgwC.exe
  C:\Windows\System\TrvYgwC.exe
  2⤵
  PID:5208
- C:\Windows\System\TPXoDwe.exe
  C:\Windows\System\TPXoDwe.exe
  2⤵
  PID:5220
- C:\Windows\System\fRsnouA.exe
  C:\Windows\System\fRsnouA.exe
  2⤵
  PID:5240
- C:\Windows\System\VKAtSlR.exe
  C:\Windows\System\VKAtSlR.exe
  2⤵
  PID:5264
- C:\Windows\System\ZHgVUta.exe
  C:\Windows\System\ZHgVUta.exe
  2⤵
  PID:5276
- C:\Windows\System\XRZMfca.exe
  C:\Windows\System\XRZMfca.exe
  2⤵
  PID:5296
- C:\Windows\System\TyNPMdw.exe
  C:\Windows\System\TyNPMdw.exe
  2⤵
  PID:5304
- C:\Windows\System\ZJzJxds.exe
  C:\Windows\System\ZJzJxds.exe
  2⤵
  PID:5328
- C:\Windows\System\fQdLPWh.exe
  C:\Windows\System\fQdLPWh.exe
  2⤵
  PID:5744
- C:\Windows\System\PlnDJSP.exe
  C:\Windows\System\PlnDJSP.exe
  2⤵
  PID:5648
- C:\Windows\System\SlGBdoM.exe
  C:\Windows\System\SlGBdoM.exe
  2⤵
  PID:5352
- C:\Windows\System\WfJiCEV.exe
  C:\Windows\System\WfJiCEV.exe
  2⤵
  PID:5420
- C:\Windows\System\xYTaSdV.exe
  C:\Windows\System\xYTaSdV.exe
  2⤵
  PID:5492
- C:\Windows\System\htzUNXP.exe
  C:\Windows\System\htzUNXP.exe
  2⤵
  PID:5688
- C:\Windows\System\YFFCHOh.exe
  C:\Windows\System\YFFCHOh.exe
  2⤵
  PID:5572
- C:\Windows\System\PWnUGRe.exe
  C:\Windows\System\PWnUGRe.exe
  2⤵
  PID:5588
- C:\Windows\System\YuOoZCQ.exe
  C:\Windows\System\YuOoZCQ.exe
  2⤵
  PID:5604
- C:\Windows\System\mqIgzEg.exe
  C:\Windows\System\mqIgzEg.exe
  2⤵
  PID:5636
- C:\Windows\System\rnrfehI.exe
  C:\Windows\System\rnrfehI.exe
  2⤵
  PID:5704
- C:\Windows\System\OPKsiDq.exe
  C:\Windows\System\OPKsiDq.exe
  2⤵
  PID:5852
- C:\Windows\System\EwHazsh.exe
  C:\Windows\System\EwHazsh.exe
  2⤵
  PID:5684
- C:\Windows\System\FcvxAhS.exe
  C:\Windows\System\FcvxAhS.exe
  2⤵
  PID:5760
- C:\Windows\System\fTxabxu.exe
  C:\Windows\System\fTxabxu.exe
  2⤵
  PID:240
- C:\Windows\System\eJwzhdD.exe
  C:\Windows\System\eJwzhdD.exe
  2⤵
  PID:5796
- C:\Windows\System\PaDWHKx.exe
  C:\Windows\System\PaDWHKx.exe
  2⤵
  PID:5828
- C:\Windows\System\LGTlYIY.exe
  C:\Windows\System\LGTlYIY.exe
  2⤵
  PID:5904
- C:\Windows\System\CAaUlmC.exe
  C:\Windows\System\CAaUlmC.exe
  2⤵
  PID:5920
- C:\Windows\System\uHstsuw.exe
  C:\Windows\System\uHstsuw.exe
  2⤵
  PID:5992
- C:\Windows\System\ltuPgJv.exe
  C:\Windows\System\ltuPgJv.exe
  2⤵
  PID:5940
- C:\Windows\System\UHGoLhL.exe
  C:\Windows\System\UHGoLhL.exe
  2⤵
  PID:6004
- C:\Windows\System\dodEYgb.exe
  C:\Windows\System\dodEYgb.exe
  2⤵
  PID:6064
- C:\Windows\System\rtpzFhg.exe
  C:\Windows\System\rtpzFhg.exe
  2⤵
  PID:6076
- C:\Windows\System\tNwKTdC.exe
  C:\Windows\System\tNwKTdC.exe
  2⤵
  PID:6140
- C:\Windows\System\xsLIdWz.exe
  C:\Windows\System\xsLIdWz.exe
  2⤵
  PID:5312
- C:\Windows\System\xHnRUDm.exe
  C:\Windows\System\xHnRUDm.exe
  2⤵
  PID:5136
- C:\Windows\System\xfAgKdG.exe
  C:\Windows\System\xfAgKdG.exe
  2⤵
  PID:3956
- C:\Windows\System\RegXASK.exe
  C:\Windows\System\RegXASK.exe
  2⤵
  PID:5560
- C:\Windows\System\oDXLQNM.exe
  C:\Windows\System\oDXLQNM.exe
  2⤵
  PID:5140
- C:\Windows\System\hjqjywU.exe
  C:\Windows\System\hjqjywU.exe
  2⤵
  PID:5172
- C:\Windows\System\jPytCuB.exe
  C:\Windows\System\jPytCuB.exe
  2⤵
  PID:5236
- C:\Windows\System\HuXzOZv.exe
  C:\Windows\System\HuXzOZv.exe
  2⤵
  PID:5216
- C:\Windows\System\CHOqpBe.exe
  C:\Windows\System\CHOqpBe.exe
  2⤵
  PID:5256
- C:\Windows\System\mmSbLfB.exe
  C:\Windows\System\mmSbLfB.exe
  2⤵
  PID:5628
- C:\Windows\System\zdomZjF.exe
  C:\Windows\System\zdomZjF.exe
  2⤵
  PID:5540
- C:\Windows\System\dJqqleo.exe
  C:\Windows\System\dJqqleo.exe
  2⤵
  PID:5344
- C:\Windows\System\nHzIgpk.exe
  C:\Windows\System\nHzIgpk.exe
  2⤵
  PID:5632
- C:\Windows\System\AUengTI.exe
  C:\Windows\System\AUengTI.exe
  2⤵
  PID:5812
- C:\Windows\System\KNEljCx.exe
  C:\Windows\System\KNEljCx.exe
  2⤵
  PID:5484
- C:\Windows\System\hSUqcqR.exe
  C:\Windows\System\hSUqcqR.exe
  2⤵
  PID:5668
- C:\Windows\System\IDHSuif.exe
  C:\Windows\System\IDHSuif.exe
  2⤵
  PID:5868
- C:\Windows\System\Lqullce.exe
  C:\Windows\System\Lqullce.exe
  2⤵
  PID:5724
- C:\Windows\System\knMkiqT.exe
  C:\Windows\System\knMkiqT.exe
  2⤵
  PID:5792
- C:\Windows\System\UwHdgXQ.exe
  C:\Windows\System\UwHdgXQ.exe
  2⤵
  PID:5960
- C:\Windows\System\PAkTAge.exe
  C:\Windows\System\PAkTAge.exe
  2⤵
  PID:5976
- C:\Windows\System\DaMwwTQ.exe
  C:\Windows\System\DaMwwTQ.exe
  2⤵
  PID:6104
- C:\Windows\System\qBqFmQl.exe
  C:\Windows\System\qBqFmQl.exe
  2⤵
  PID:4620
- C:\Windows\System\QqvZPXF.exe
  C:\Windows\System\QqvZPXF.exe
  2⤵
  PID:6120
- C:\Windows\System\dtxxddK.exe
  C:\Windows\System\dtxxddK.exe
  2⤵
  PID:5168
- C:\Windows\System\wNzjHJE.exe
  C:\Windows\System\wNzjHJE.exe
  2⤵
  PID:5192
- C:\Windows\System\GyoBKDQ.exe
  C:\Windows\System\GyoBKDQ.exe
  2⤵
  PID:5332
- C:\Windows\System\lxYlkIg.exe
  C:\Windows\System\lxYlkIg.exe
  2⤵
  PID:5580
- C:\Windows\System\djHkCKx.exe
  C:\Windows\System\djHkCKx.exe
  2⤵
  PID:5956
- C:\Windows\System\BVuPbEy.exe
  C:\Windows\System\BVuPbEy.exe
  2⤵
  PID:5468
- C:\Windows\System\uNOCXwV.exe
  C:\Windows\System\uNOCXwV.exe
  2⤵
  PID:5596
- C:\Windows\System\cDevrOS.exe
  C:\Windows\System\cDevrOS.exe
  2⤵
  PID:5392
- C:\Windows\System\jRCzNsB.exe
  C:\Windows\System\jRCzNsB.exe
  2⤵
  PID:5876
- C:\Windows\System\EtQnIsE.exe
  C:\Windows\System\EtQnIsE.exe
  2⤵
  PID:6044
- C:\Windows\System\NiKgSTC.exe
  C:\Windows\System\NiKgSTC.exe
  2⤵
  PID:5288
- C:\Windows\System\XGSmBCn.exe
  C:\Windows\System\XGSmBCn.exe
  2⤵
  PID:5188
- C:\Windows\System\TmHBjXf.exe
  C:\Windows\System\TmHBjXf.exe
  2⤵
  PID:5808
- C:\Windows\System\tiscPEY.exe
  C:\Windows\System\tiscPEY.exe
  2⤵
  PID:6136
- C:\Windows\System\TdpDkur.exe
  C:\Windows\System\TdpDkur.exe
  2⤵
  PID:5472
- C:\Windows\System\gmtJbTg.exe
  C:\Windows\System\gmtJbTg.exe
  2⤵
  PID:6016
- C:\Windows\System\ERhJNss.exe
  C:\Windows\System\ERhJNss.exe
  2⤵
  PID:5316
- C:\Windows\System\YRBRqfg.exe
  C:\Windows\System\YRBRqfg.exe
  2⤵
  PID:6028
- C:\Windows\System\sFmsWIU.exe
  C:\Windows\System\sFmsWIU.exe
  2⤵
  PID:6164
- C:\Windows\System\KoaNsXy.exe
  C:\Windows\System\KoaNsXy.exe
  2⤵
  PID:6180
- C:\Windows\System\rmzVkho.exe
  C:\Windows\System\rmzVkho.exe
  2⤵
  PID:6196
- C:\Windows\System\lJFhOax.exe
  C:\Windows\System\lJFhOax.exe
  2⤵
  PID:6216
- C:\Windows\System\aiMPYOI.exe
  C:\Windows\System\aiMPYOI.exe
  2⤵
  PID:6232
- C:\Windows\System\pkKQCkH.exe
  C:\Windows\System\pkKQCkH.exe
  2⤵
  PID:6248
- C:\Windows\System\WgDVkpS.exe
  C:\Windows\System\WgDVkpS.exe
  2⤵
  PID:6264
- C:\Windows\System\LnRbPMK.exe
  C:\Windows\System\LnRbPMK.exe
  2⤵
  PID:6280
- C:\Windows\System\hfMkPGJ.exe
  C:\Windows\System\hfMkPGJ.exe
  2⤵
  PID:6296
- C:\Windows\System\XYaLIGh.exe
  C:\Windows\System\XYaLIGh.exe
  2⤵
  PID:6312
- C:\Windows\System\NXFHupN.exe
  C:\Windows\System\NXFHupN.exe
  2⤵
  PID:6328
- C:\Windows\System\jdyxHjH.exe
  C:\Windows\System\jdyxHjH.exe
  2⤵
  PID:6344
- C:\Windows\System\vnYidgr.exe
  C:\Windows\System\vnYidgr.exe
  2⤵
  PID:6364
- C:\Windows\System\rWDIpRz.exe
  C:\Windows\System\rWDIpRz.exe
  2⤵
  PID:6380
- C:\Windows\System\NiCGXId.exe
  C:\Windows\System\NiCGXId.exe
  2⤵
  PID:6400
- C:\Windows\System\XlRowSk.exe
  C:\Windows\System\XlRowSk.exe
  2⤵
  PID:6416
- C:\Windows\System\ndBDdvA.exe
  C:\Windows\System\ndBDdvA.exe
  2⤵
  PID:6432
- C:\Windows\System\DBqmVLH.exe
  C:\Windows\System\DBqmVLH.exe
  2⤵
  PID:6452
- C:\Windows\System\TCyeheb.exe
  C:\Windows\System\TCyeheb.exe
  2⤵
  PID:6468
- C:\Windows\System\xKvNZbV.exe
  C:\Windows\System\xKvNZbV.exe
  2⤵
  PID:6484
- C:\Windows\System\AujHXUR.exe
  C:\Windows\System\AujHXUR.exe
  2⤵
  PID:6500
- C:\Windows\System\tADrigK.exe
  C:\Windows\System\tADrigK.exe
  2⤵
  PID:6516
- C:\Windows\System\AIMnGtZ.exe
  C:\Windows\System\AIMnGtZ.exe
  2⤵
  PID:6532
- C:\Windows\System\xiyfIBW.exe
  C:\Windows\System\xiyfIBW.exe
  2⤵
  PID:6548
- C:\Windows\System\hTAyUAq.exe
  C:\Windows\System\hTAyUAq.exe
  2⤵
  PID:6568
- C:\Windows\System\nhiSnwg.exe
  C:\Windows\System\nhiSnwg.exe
  2⤵
  PID:6592
- C:\Windows\System\FlWvySP.exe
  C:\Windows\System\FlWvySP.exe
  2⤵
  PID:6608
- C:\Windows\System\FFvlkGP.exe
  C:\Windows\System\FFvlkGP.exe
  2⤵
  PID:6628
- C:\Windows\System\bFzfQhL.exe
  C:\Windows\System\bFzfQhL.exe
  2⤵
  PID:6644
- C:\Windows\System\BloUsIB.exe
  C:\Windows\System\BloUsIB.exe
  2⤵
  PID:6660
- C:\Windows\System\DOEWnkR.exe
  C:\Windows\System\DOEWnkR.exe
  2⤵
  PID:6676
- C:\Windows\System\ozPiGwX.exe
  C:\Windows\System\ozPiGwX.exe
  2⤵
  PID:6692
- C:\Windows\System\RWVRpvN.exe
  C:\Windows\System\RWVRpvN.exe
  2⤵
  PID:6712
- C:\Windows\System\pPAVbzN.exe
  C:\Windows\System\pPAVbzN.exe
  2⤵
  PID:6732
- C:\Windows\System\EeeSCPz.exe
  C:\Windows\System\EeeSCPz.exe
  2⤵
  PID:6748
- C:\Windows\System\kcaEVTy.exe
  C:\Windows\System\kcaEVTy.exe
  2⤵
  PID:6764
- C:\Windows\System\dVCzOgD.exe
  C:\Windows\System\dVCzOgD.exe
  2⤵
  PID:6780
- C:\Windows\System\ZckYWvc.exe
  C:\Windows\System\ZckYWvc.exe
  2⤵
  PID:6796
- C:\Windows\System\KmNgFal.exe
  C:\Windows\System\KmNgFal.exe
  2⤵
  PID:6812
- C:\Windows\System\aqMGCXM.exe
  C:\Windows\System\aqMGCXM.exe
  2⤵
  PID:6828
- C:\Windows\System\AQMPVDh.exe
  C:\Windows\System\AQMPVDh.exe
  2⤵
  PID:6844
- C:\Windows\System\nYGUuOx.exe
  C:\Windows\System\nYGUuOx.exe
  2⤵
  PID:6860
- C:\Windows\System\IjPBcKY.exe
  C:\Windows\System\IjPBcKY.exe
  2⤵
  PID:6876
- C:\Windows\System\xiPvvoo.exe
  C:\Windows\System\xiPvvoo.exe
  2⤵
  PID:6892
- C:\Windows\System\gpAwUuU.exe
  C:\Windows\System\gpAwUuU.exe
  2⤵
  PID:6908
- C:\Windows\System\hetKMoC.exe
  C:\Windows\System\hetKMoC.exe
  2⤵
  PID:6924
- C:\Windows\System\zpNVClZ.exe
  C:\Windows\System\zpNVClZ.exe
  2⤵
  PID:6940
- C:\Windows\System\CkLDorE.exe
  C:\Windows\System\CkLDorE.exe
  2⤵
  PID:6956
- C:\Windows\System\GgMLDsN.exe
  C:\Windows\System\GgMLDsN.exe
  2⤵
  PID:6972
- C:\Windows\System\hTXYIdI.exe
  C:\Windows\System\hTXYIdI.exe
  2⤵
  PID:6988
- C:\Windows\System\yAfrsDa.exe
  C:\Windows\System\yAfrsDa.exe
  2⤵
  PID:7004
- C:\Windows\System\cYFyBQe.exe
  C:\Windows\System\cYFyBQe.exe
  2⤵
  PID:7020
- C:\Windows\System\KuUgNML.exe
  C:\Windows\System\KuUgNML.exe
  2⤵
  PID:7036
- C:\Windows\System\vBdZBRm.exe
  C:\Windows\System\vBdZBRm.exe
  2⤵
  PID:7052
- C:\Windows\System\biiFdCr.exe
  C:\Windows\System\biiFdCr.exe
  2⤵
  PID:7068
- C:\Windows\System\UDKxMmR.exe
  C:\Windows\System\UDKxMmR.exe
  2⤵
  PID:7088
- C:\Windows\System\nPMatvU.exe
  C:\Windows\System\nPMatvU.exe
  2⤵
  PID:7108
- C:\Windows\System\dlEzVAy.exe
  C:\Windows\System\dlEzVAy.exe
  2⤵
  PID:7124
- C:\Windows\System\GIEZfJg.exe
  C:\Windows\System\GIEZfJg.exe
  2⤵
  PID:7140
- C:\Windows\System\LunuVKP.exe
  C:\Windows\System\LunuVKP.exe
  2⤵
  PID:7156
- C:\Windows\System\aYEiOoF.exe
  C:\Windows\System\aYEiOoF.exe
  2⤵
  PID:6156
- C:\Windows\System\bGssnQt.exe
  C:\Windows\System\bGssnQt.exe
  2⤵
  PID:6192
- C:\Windows\System\NULDfwp.exe
  C:\Windows\System\NULDfwp.exe
  2⤵
  PID:6256
- C:\Windows\System\wuwbTVo.exe
  C:\Windows\System\wuwbTVo.exe
  2⤵
  PID:5600
- C:\Windows\System\tRfklUx.exe
  C:\Windows\System\tRfklUx.exe
  2⤵
  PID:6176
- C:\Windows\System\kELxdrn.exe
  C:\Windows\System\kELxdrn.exe
  2⤵
  PID:6212
- C:\Windows\System\AsRQDbn.exe
  C:\Windows\System\AsRQDbn.exe
  2⤵
  PID:6276
- C:\Windows\System\SVKAYHw.exe
  C:\Windows\System\SVKAYHw.exe
  2⤵
  PID:6340
- C:\Windows\System\OOKTYhQ.exe
  C:\Windows\System\OOKTYhQ.exe
  2⤵
  PID:6320
- C:\Windows\System\QMBEHxY.exe
  C:\Windows\System\QMBEHxY.exe
  2⤵
  PID:6360
- C:\Windows\System\zZbrnsv.exe
  C:\Windows\System\zZbrnsv.exe
  2⤵
  PID:6428
- C:\Windows\System\BtWVvDA.exe
  C:\Windows\System\BtWVvDA.exe
  2⤵
  PID:6496
- C:\Windows\System\qWqmMdV.exe
  C:\Windows\System\qWqmMdV.exe
  2⤵
  PID:6560
- C:\Windows\System\aUWMnWw.exe
  C:\Windows\System\aUWMnWw.exe
  2⤵
  PID:6408
- C:\Windows\System\bbpAoyt.exe
  C:\Windows\System\bbpAoyt.exe
  2⤵
  PID:6376
- C:\Windows\System\XXgABrb.exe
  C:\Windows\System\XXgABrb.exe
  2⤵
  PID:6448
- C:\Windows\System\HUFGjll.exe
  C:\Windows\System\HUFGjll.exe
  2⤵
  PID:6508
- C:\Windows\System\SjSQjwy.exe
  C:\Windows\System\SjSQjwy.exe
  2⤵
  PID:6580
- C:\Windows\System\feKtFFK.exe
  C:\Windows\System\feKtFFK.exe
  2⤵
  PID:6672
- C:\Windows\System\eMrrHzb.exe
  C:\Windows\System\eMrrHzb.exe
  2⤵
  PID:6620
- C:\Windows\System\HiIDlYq.exe
  C:\Windows\System\HiIDlYq.exe
  2⤵
  PID:6772
- C:\Windows\System\xALUoTf.exe
  C:\Windows\System\xALUoTf.exe
  2⤵
  PID:6688
- C:\Windows\System\AqtHPjB.exe
  C:\Windows\System\AqtHPjB.exe
  2⤵
  PID:6756
- C:\Windows\System\whvegAK.exe
  C:\Windows\System\whvegAK.exe
  2⤵
  PID:6820
- C:\Windows\System\Jmqvygd.exe
  C:\Windows\System\Jmqvygd.exe
  2⤵
  PID:6884
- C:\Windows\System\mwRmAeL.exe
  C:\Windows\System\mwRmAeL.exe
  2⤵
  PID:6920
- C:\Windows\System\WcniByH.exe
  C:\Windows\System\WcniByH.exe
  2⤵
  PID:6904
- C:\Windows\System\MXQSMfY.exe
  C:\Windows\System\MXQSMfY.exe
  2⤵
  PID:6980
- C:\Windows\System\otYzlmK.exe
  C:\Windows\System\otYzlmK.exe
  2⤵
  PID:7048
- C:\Windows\System\xLtavrB.exe
  C:\Windows\System\xLtavrB.exe
  2⤵
  PID:7084
- C:\Windows\System\NQsLhmX.exe
  C:\Windows\System\NQsLhmX.exe
  2⤵
  PID:6996
- C:\Windows\System\hfpDpjO.exe
  C:\Windows\System\hfpDpjO.exe
  2⤵
  PID:7060
- C:\Windows\System\LyoaFyc.exe
  C:\Windows\System\LyoaFyc.exe
  2⤵
  PID:7100
- C:\Windows\System\qmhzKzQ.exe
  C:\Windows\System\qmhzKzQ.exe
  2⤵
  PID:6968
- C:\Windows\System\YxPXGVT.exe
  C:\Windows\System\YxPXGVT.exe
  2⤵
  PID:6228
- C:\Windows\System\dqPkBUW.exe
  C:\Windows\System\dqPkBUW.exe
  2⤵
  PID:6160
- C:\Windows\System\JldrEPm.exe
  C:\Windows\System\JldrEPm.exe
  2⤵
  PID:6244
- C:\Windows\System\NZvBvZl.exe
  C:\Windows\System\NZvBvZl.exe
  2⤵
  PID:6292
- C:\Windows\System\LHMWxdu.exe
  C:\Windows\System\LHMWxdu.exe
  2⤵
  PID:6640
- C:\Windows\System\hjLODFX.exe
  C:\Windows\System\hjLODFX.exe
  2⤵
  PID:5132
- C:\Windows\System\NsZZHLJ.exe
  C:\Windows\System\NsZZHLJ.exe
  2⤵
  PID:6172
- C:\Windows\System\vyDobEF.exe
  C:\Windows\System\vyDobEF.exe
  2⤵
  PID:6492
- C:\Windows\System\wlrSPjS.exe
  C:\Windows\System\wlrSPjS.exe
  2⤵
  PID:6440
- C:\Windows\System\cvEBnOL.exe
  C:\Windows\System\cvEBnOL.exe
  2⤵
  PID:6544
- C:\Windows\System\HnrJQbQ.exe
  C:\Windows\System\HnrJQbQ.exe
  2⤵
  PID:6724
- C:\Windows\System\yonoXze.exe
  C:\Windows\System\yonoXze.exe
  2⤵
  PID:6872
- C:\Windows\System\LsFBEQi.exe
  C:\Windows\System\LsFBEQi.exe
  2⤵
  PID:5184
- C:\Windows\System\TuEDwaM.exe
  C:\Windows\System\TuEDwaM.exe
  2⤵
  PID:6152
- C:\Windows\System\vccYlhi.exe
  C:\Windows\System\vccYlhi.exe
  2⤵
  PID:6528
- C:\Windows\System\tRFuAhg.exe
  C:\Windows\System\tRFuAhg.exe
  2⤵
  PID:6604
- C:\Windows\System\hZaFInL.exe
  C:\Windows\System\hZaFInL.exe
  2⤵
  PID:6744
- C:\Windows\System\rTzZRxZ.exe
  C:\Windows\System\rTzZRxZ.exe
  2⤵
  PID:7096
- C:\Windows\System\tXPBgZv.exe
  C:\Windows\System\tXPBgZv.exe
  2⤵
  PID:7080
- C:\Windows\System\dICfqIv.exe
  C:\Windows\System\dICfqIv.exe
  2⤵
  PID:6804
- C:\Windows\System\WAeJmvR.exe
  C:\Windows\System\WAeJmvR.exe
  2⤵
  PID:6788
- C:\Windows\System\caaaBBN.exe
  C:\Windows\System\caaaBBN.exe
  2⤵
  PID:6704
- C:\Windows\System\jiouWpZ.exe
  C:\Windows\System\jiouWpZ.exe
  2⤵
  PID:6308
- C:\Windows\System\TcntoHc.exe
  C:\Windows\System\TcntoHc.exe
  2⤵
  PID:5156
- C:\Windows\System\gorJPmN.exe
  C:\Windows\System\gorJPmN.exe
  2⤵
  PID:6396
- C:\Windows\System\uazuckX.exe
  C:\Windows\System\uazuckX.exe
  2⤵
  PID:7136
- C:\Windows\System\XNMKsQP.exe
  C:\Windows\System\XNMKsQP.exe
  2⤵
  PID:6948
- C:\Windows\System\HsgxbZR.exe
  C:\Windows\System\HsgxbZR.exe
  2⤵
  PID:6684
- C:\Windows\System\vxUsPTj.exe
  C:\Windows\System\vxUsPTj.exe
  2⤵
  PID:6836
- C:\Windows\System\ldEtUhd.exe
  C:\Windows\System\ldEtUhd.exe
  2⤵
  PID:7176
- C:\Windows\System\ADHRxMO.exe
  C:\Windows\System\ADHRxMO.exe
  2⤵
  PID:7192
- C:\Windows\System\gAjjUID.exe
  C:\Windows\System\gAjjUID.exe
  2⤵
  PID:7208
- C:\Windows\System\bLXWnCI.exe
  C:\Windows\System\bLXWnCI.exe
  2⤵
  PID:7224
- C:\Windows\System\KSxIUvi.exe
  C:\Windows\System\KSxIUvi.exe
  2⤵
  PID:7240
- C:\Windows\System\IXrHJoW.exe
  C:\Windows\System\IXrHJoW.exe
  2⤵
  PID:7256
- C:\Windows\System\yDlJYkb.exe
  C:\Windows\System\yDlJYkb.exe
  2⤵
  PID:7272
- C:\Windows\System\GnnmWJb.exe
  C:\Windows\System\GnnmWJb.exe
  2⤵
  PID:7288
- C:\Windows\System\iojYvaT.exe
  C:\Windows\System\iojYvaT.exe
  2⤵
  PID:7304
- C:\Windows\System\WVBQaRY.exe
  C:\Windows\System\WVBQaRY.exe
  2⤵
  PID:7320
- C:\Windows\System\WecWZGp.exe
  C:\Windows\System\WecWZGp.exe
  2⤵
  PID:7336
- C:\Windows\System\vmZKHAY.exe
  C:\Windows\System\vmZKHAY.exe
  2⤵
  PID:7356
- C:\Windows\System\eVuigis.exe
  C:\Windows\System\eVuigis.exe
  2⤵
  PID:7372
- C:\Windows\System\CSiHqHX.exe
  C:\Windows\System\CSiHqHX.exe
  2⤵
  PID:7388
- C:\Windows\System\eXLytsX.exe
  C:\Windows\System\eXLytsX.exe
  2⤵
  PID:7404
- C:\Windows\System\EodvLNr.exe
  C:\Windows\System\EodvLNr.exe
  2⤵
  PID:7420
- C:\Windows\System\bcvEJlP.exe
  C:\Windows\System\bcvEJlP.exe
  2⤵
  PID:7440
- C:\Windows\System\MFLePLH.exe
  C:\Windows\System\MFLePLH.exe
  2⤵
  PID:7456
- C:\Windows\System\vSAnyje.exe
  C:\Windows\System\vSAnyje.exe
  2⤵
  PID:7480
- C:\Windows\System\SmrotQZ.exe
  C:\Windows\System\SmrotQZ.exe
  2⤵
  PID:7496
- C:\Windows\System\YNgxCGn.exe
  C:\Windows\System\YNgxCGn.exe
  2⤵
  PID:7512
- C:\Windows\System\UsDpqFd.exe
  C:\Windows\System\UsDpqFd.exe
  2⤵
  PID:7528
- C:\Windows\System\njdkqhO.exe
  C:\Windows\System\njdkqhO.exe
  2⤵
  PID:7544
- C:\Windows\System\WEkuxTE.exe
  C:\Windows\System\WEkuxTE.exe
  2⤵
  PID:7560
- C:\Windows\System\gHNAtjC.exe
  C:\Windows\System\gHNAtjC.exe
  2⤵
  PID:7576
- C:\Windows\System\hWbEwaI.exe
  C:\Windows\System\hWbEwaI.exe
  2⤵
  PID:7592
- C:\Windows\System\SXWLXny.exe
  C:\Windows\System\SXWLXny.exe
  2⤵
  PID:7608
- C:\Windows\System\xbmaOFk.exe
  C:\Windows\System\xbmaOFk.exe
  2⤵
  PID:7624
- C:\Windows\System\OtZZgpz.exe
  C:\Windows\System\OtZZgpz.exe
  2⤵
  PID:7640
- C:\Windows\System\BESfyQo.exe
  C:\Windows\System\BESfyQo.exe
  2⤵
  PID:7656
- C:\Windows\System\LWlKeIu.exe
  C:\Windows\System\LWlKeIu.exe
  2⤵
  PID:7672
- C:\Windows\System\npahvNd.exe
  C:\Windows\System\npahvNd.exe
  2⤵
  PID:7688
- C:\Windows\System\dhZmzYM.exe
  C:\Windows\System\dhZmzYM.exe
  2⤵
  PID:7704
- C:\Windows\System\EXKtnBp.exe
  C:\Windows\System\EXKtnBp.exe
  2⤵
  PID:7720
- C:\Windows\System\EpZYlxB.exe
  C:\Windows\System\EpZYlxB.exe
  2⤵
  PID:7740
- C:\Windows\System\pwEgbHk.exe
  C:\Windows\System\pwEgbHk.exe
  2⤵
  PID:7756
- C:\Windows\System\ZGqEoXr.exe
  C:\Windows\System\ZGqEoXr.exe
  2⤵
  PID:7772
- C:\Windows\System\DqUvMrE.exe
  C:\Windows\System\DqUvMrE.exe
  2⤵
  PID:7788
- C:\Windows\System\VaoClVh.exe
  C:\Windows\System\VaoClVh.exe
  2⤵
  PID:7804
- C:\Windows\System\cldycOm.exe
  C:\Windows\System\cldycOm.exe
  2⤵
  PID:7888
- C:\Windows\System\COugcND.exe
  C:\Windows\System\COugcND.exe
  2⤵
  PID:8012
- C:\Windows\System\JLkQGJa.exe
  C:\Windows\System\JLkQGJa.exe
  2⤵
  PID:8028
- C:\Windows\System\MfJUlVT.exe
  C:\Windows\System\MfJUlVT.exe
  2⤵
  PID:8044
- C:\Windows\System\zkXNPiZ.exe
  C:\Windows\System\zkXNPiZ.exe
  2⤵
  PID:8060
- C:\Windows\System\YRoQYkL.exe
  C:\Windows\System\YRoQYkL.exe
  2⤵
  PID:8084
- C:\Windows\System\vcVtMwk.exe
  C:\Windows\System\vcVtMwk.exe
  2⤵
  PID:8104
- C:\Windows\System\mXAYxde.exe
  C:\Windows\System\mXAYxde.exe
  2⤵
  PID:8132
- C:\Windows\System\hXyDUiu.exe
  C:\Windows\System\hXyDUiu.exe
  2⤵
  PID:8148
- C:\Windows\System\NFejvjT.exe
  C:\Windows\System\NFejvjT.exe
  2⤵
  PID:8164
- C:\Windows\System\FGoAFXj.exe
  C:\Windows\System\FGoAFXj.exe
  2⤵
  PID:8188
- C:\Windows\System\TMVUIVm.exe
  C:\Windows\System\TMVUIVm.exe
  2⤵
  PID:7344
- C:\Windows\System\wFbfhnA.exe
  C:\Windows\System\wFbfhnA.exe
  2⤵
  PID:6932
- C:\Windows\System\utKmCXY.exe
  C:\Windows\System\utKmCXY.exe
  2⤵
  PID:7280
- C:\Windows\System\VcNhQJj.exe
  C:\Windows\System\VcNhQJj.exe
  2⤵
  PID:7352
- C:\Windows\System\xVbPuxW.exe
  C:\Windows\System\xVbPuxW.exe
  2⤵
  PID:7448
- C:\Windows\System\gNbOosM.exe
  C:\Windows\System\gNbOosM.exe
  2⤵
  PID:6984
- C:\Windows\System\QYjyrEz.exe
  C:\Windows\System\QYjyrEz.exe
  2⤵
  PID:6952
- C:\Windows\System\AKRaYHC.exe
  C:\Windows\System\AKRaYHC.exe
  2⤵
  PID:7428
- C:\Windows\System\SdooSgY.exe
  C:\Windows\System\SdooSgY.exe
  2⤵
  PID:7200
- C:\Windows\System\kwdVfrd.exe
  C:\Windows\System\kwdVfrd.exe
  2⤵
  PID:7268
- C:\Windows\System\uTMKclW.exe
  C:\Windows\System\uTMKclW.exe
  2⤵
  PID:7396
- C:\Windows\System\FdcBwgI.exe
  C:\Windows\System\FdcBwgI.exe
  2⤵
  PID:7472
- C:\Windows\System\amNQCun.exe
  C:\Windows\System\amNQCun.exe
  2⤵
  PID:7536
- C:\Windows\System\enzREdv.exe
  C:\Windows\System\enzREdv.exe
  2⤵
  PID:7604
- C:\Windows\System\HdGkWqb.exe
  C:\Windows\System\HdGkWqb.exe
  2⤵
  PID:7700
- C:\Windows\System\TpcIvBK.exe
  C:\Windows\System\TpcIvBK.exe
  2⤵
  PID:7764
- C:\Windows\System\srIQYhC.exe
  C:\Windows\System\srIQYhC.exe
  2⤵
  PID:7616
- C:\Windows\System\kdstmln.exe
  C:\Windows\System\kdstmln.exe
  2⤵
  PID:7524
- C:\Windows\System\qDmLWhZ.exe
  C:\Windows\System\qDmLWhZ.exe
  2⤵
  PID:7652
- C:\Windows\System\FeqAdHB.exe
  C:\Windows\System\FeqAdHB.exe
  2⤵
  PID:7680
- C:\Windows\System\VmAyFPi.exe
  C:\Windows\System\VmAyFPi.exe
  2⤵
  PID:7752
- C:\Windows\System\exvGhaM.exe
  C:\Windows\System\exvGhaM.exe
  2⤵
  PID:7848
- C:\Windows\System\rLSBRzc.exe
  C:\Windows\System\rLSBRzc.exe
  2⤵
  PID:8072
- C:\Windows\System\OIiKmvi.exe
  C:\Windows\System\OIiKmvi.exe
  2⤵
  PID:7908
- C:\Windows\System\hJaanmT.exe
  C:\Windows\System\hJaanmT.exe
  2⤵
  PID:7916
- C:\Windows\System\IHvpmBb.exe
  C:\Windows\System\IHvpmBb.exe
  2⤵
  PID:7932
- C:\Windows\System\tzGWhcc.exe
  C:\Windows\System\tzGWhcc.exe
  2⤵
  PID:7956
- C:\Windows\System\vjubjxp.exe
  C:\Windows\System\vjubjxp.exe
  2⤵
  PID:7972
- C:\Windows\System\tWydEnl.exe
  C:\Windows\System\tWydEnl.exe
  2⤵
  PID:7988
- C:\Windows\System\ivolhZt.exe
  C:\Windows\System\ivolhZt.exe
  2⤵
  PID:8004
- C:\Windows\System\XtcMnkV.exe
  C:\Windows\System\XtcMnkV.exe
  2⤵
  PID:8124
- C:\Windows\System\opuXtns.exe
  C:\Windows\System\opuXtns.exe
  2⤵
  PID:7184
- C:\Windows\System\KvRxMFA.exe
  C:\Windows\System\KvRxMFA.exe
  2⤵
  PID:7312
- C:\Windows\System\kmunbpb.exe
  C:\Windows\System\kmunbpb.exe
  2⤵
  PID:7076
- C:\Windows\System\YPNdViY.exe
  C:\Windows\System\YPNdViY.exe
  2⤵
  PID:7600
- C:\Windows\System\AzNiLJh.exe
  C:\Windows\System\AzNiLJh.exe
  2⤵
  PID:7380
- C:\Windows\System\uCsstQv.exe
  C:\Windows\System\uCsstQv.exe
  2⤵
  PID:7780
- C:\Windows\System\LANgzwd.exe
  C:\Windows\System\LANgzwd.exe
  2⤵
  PID:7748
- C:\Windows\System\sxHrUni.exe
  C:\Windows\System\sxHrUni.exe
  2⤵
  PID:7904
- C:\Windows\System\meQeHFb.exe
  C:\Windows\System\meQeHFb.exe
  2⤵
  PID:8056
- C:\Windows\System\EWnkmdx.exe
  C:\Windows\System\EWnkmdx.exe
  2⤵
  PID:8144
- C:\Windows\System\zxzGShk.exe
  C:\Windows\System\zxzGShk.exe
  2⤵
  PID:7028
- C:\Windows\System\hBxCcWr.exe
  C:\Windows\System\hBxCcWr.exe
  2⤵
  PID:7864
- C:\Windows\System\FtXpAuj.exe
  C:\Windows\System\FtXpAuj.exe
  2⤵
  PID:7364
- C:\Windows\System\moXXTfV.exe
  C:\Windows\System\moXXTfV.exe
  2⤵
  PID:8112
- C:\Windows\System\TwWWJhH.exe
  C:\Windows\System\TwWWJhH.exe
  2⤵
  PID:7432
- C:\Windows\System\FdVKssJ.exe
  C:\Windows\System\FdVKssJ.exe
  2⤵
  PID:7736
- C:\Windows\System\VratAJA.exe
  C:\Windows\System\VratAJA.exe
  2⤵
  PID:7648
- C:\Windows\System\cNIBTDm.exe
  C:\Windows\System\cNIBTDm.exe
  2⤵
  PID:7928
- C:\Windows\System\DqhVXTw.exe
  C:\Windows\System\DqhVXTw.exe
  2⤵
  PID:8000
- C:\Windows\System\SIZiYvE.exe
  C:\Windows\System\SIZiYvE.exe
  2⤵
  PID:7172
- C:\Windows\System\vvjWgao.exe
  C:\Windows\System\vvjWgao.exe
  2⤵
  PID:7416
- C:\Windows\System\leRLozD.exe
  C:\Windows\System\leRLozD.exe
  2⤵
  PID:7504
- C:\Windows\System\kxZvIrc.exe
  C:\Windows\System\kxZvIrc.exe
  2⤵
  PID:7468
- C:\Windows\System\XlhPyny.exe
  C:\Windows\System\XlhPyny.exe
  2⤵
  PID:7716
- C:\Windows\System\BCFAjTb.exe
  C:\Windows\System\BCFAjTb.exe
  2⤵
  PID:6792
- C:\Windows\System\qVeiPtO.exe
  C:\Windows\System\qVeiPtO.exe
  2⤵
  PID:8116
- C:\Windows\System\ubMpZio.exe
  C:\Windows\System\ubMpZio.exe
  2⤵
  PID:7696
- C:\Windows\System\hhfcZGo.exe
  C:\Windows\System\hhfcZGo.exe
  2⤵
  PID:7252
- C:\Windows\System\ejmcbDd.exe
  C:\Windows\System\ejmcbDd.exe
  2⤵
  PID:7572
- C:\Windows\System\tubhNxy.exe
  C:\Windows\System\tubhNxy.exe
  2⤵
  PID:7236
- C:\Windows\System\wfqJJrb.exe
  C:\Windows\System\wfqJJrb.exe
  2⤵
  PID:8024
- C:\Windows\System\PktocoN.exe
  C:\Windows\System\PktocoN.exe
  2⤵
  PID:7488
- C:\Windows\System\olKVCJs.exe
  C:\Windows\System\olKVCJs.exe
  2⤵
  PID:7940
- C:\Windows\System\PCEhtZC.exe
  C:\Windows\System\PCEhtZC.exe
  2⤵
  PID:7664
- C:\Windows\System\CMShkNU.exe
  C:\Windows\System\CMShkNU.exe
  2⤵
  PID:6616
- C:\Windows\System\acMhUgf.exe
  C:\Windows\System\acMhUgf.exe
  2⤵
  PID:8212
- C:\Windows\System\EGevphb.exe
  C:\Windows\System\EGevphb.exe
  2⤵
  PID:8228
- C:\Windows\System\xaALRjz.exe
  C:\Windows\System\xaALRjz.exe
  2⤵
  PID:8244
- C:\Windows\System\QXUOqrx.exe
  C:\Windows\System\QXUOqrx.exe
  2⤵
  PID:8260
- C:\Windows\System\YiarYdz.exe
  C:\Windows\System\YiarYdz.exe
  2⤵
  PID:8276
- C:\Windows\System\NVcKNXa.exe
  C:\Windows\System\NVcKNXa.exe
  2⤵
  PID:8292
- C:\Windows\System\fjLSBFs.exe
  C:\Windows\System\fjLSBFs.exe
  2⤵
  PID:8308
- C:\Windows\System\tNMdaSd.exe
  C:\Windows\System\tNMdaSd.exe
  2⤵
  PID:8324
- C:\Windows\System\lqPFUan.exe
  C:\Windows\System\lqPFUan.exe
  2⤵
  PID:8340
- C:\Windows\System\dfDjfIp.exe
  C:\Windows\System\dfDjfIp.exe
  2⤵
  PID:8356
- C:\Windows\System\YMfvACw.exe
  C:\Windows\System\YMfvACw.exe
  2⤵
  PID:8372
- C:\Windows\System\TihhsGN.exe
  C:\Windows\System\TihhsGN.exe
  2⤵
  PID:8388
- C:\Windows\System\dfWgFID.exe
  C:\Windows\System\dfWgFID.exe
  2⤵
  PID:8404
- C:\Windows\System\KcLUDlN.exe
  C:\Windows\System\KcLUDlN.exe
  2⤵
  PID:8420
- C:\Windows\System\RghvNUq.exe
  C:\Windows\System\RghvNUq.exe
  2⤵
  PID:8436
- C:\Windows\System\ZjLdeSZ.exe
  C:\Windows\System\ZjLdeSZ.exe
  2⤵
  PID:8452
- C:\Windows\System\sxahDGg.exe
  C:\Windows\System\sxahDGg.exe
  2⤵
  PID:8472
- C:\Windows\System\IDUptiJ.exe
  C:\Windows\System\IDUptiJ.exe
  2⤵
  PID:8488
- C:\Windows\System\LUssAcw.exe
  C:\Windows\System\LUssAcw.exe
  2⤵
  PID:8504
- C:\Windows\System\FsjlQLC.exe
  C:\Windows\System\FsjlQLC.exe
  2⤵
  PID:8520
- C:\Windows\System\oVOqclB.exe
  C:\Windows\System\oVOqclB.exe
  2⤵
  PID:8540
- C:\Windows\System\eSTUpyM.exe
  C:\Windows\System\eSTUpyM.exe
  2⤵
  PID:8556
- C:\Windows\System\vuKaQmH.exe
  C:\Windows\System\vuKaQmH.exe
  2⤵
  PID:8572
- C:\Windows\System\gfnJnJN.exe
  C:\Windows\System\gfnJnJN.exe
  2⤵
  PID:8588
- C:\Windows\System\GWooLyq.exe
  C:\Windows\System\GWooLyq.exe
  2⤵
  PID:8604
- C:\Windows\System\PXldxnR.exe
  C:\Windows\System\PXldxnR.exe
  2⤵
  PID:8620
- C:\Windows\System\NlpkJAJ.exe
  C:\Windows\System\NlpkJAJ.exe
  2⤵
  PID:8644
- C:\Windows\System\jkquAUQ.exe
  C:\Windows\System\jkquAUQ.exe
  2⤵
  PID:8660
- C:\Windows\System\fidtTxm.exe
  C:\Windows\System\fidtTxm.exe
  2⤵
  PID:8684
- C:\Windows\System\ZZPQads.exe
  C:\Windows\System\ZZPQads.exe
  2⤵
  PID:8700
- C:\Windows\System\rJqZbym.exe
  C:\Windows\System\rJqZbym.exe
  2⤵
  PID:8752
- C:\Windows\System\uBJfTPJ.exe
  C:\Windows\System\uBJfTPJ.exe
  2⤵
  PID:8768
- C:\Windows\System\inEnVpS.exe
  C:\Windows\System\inEnVpS.exe
  2⤵
  PID:8784
- C:\Windows\System\OMmqsFa.exe
  C:\Windows\System\OMmqsFa.exe
  2⤵
  PID:8800
- C:\Windows\System\ctcIuZU.exe
  C:\Windows\System\ctcIuZU.exe
  2⤵
  PID:8824
- C:\Windows\System\axOdCDG.exe
  C:\Windows\System\axOdCDG.exe
  2⤵
  PID:8844
- C:\Windows\System\Ayuqhsw.exe
  C:\Windows\System\Ayuqhsw.exe
  2⤵
  PID:8860
- C:\Windows\System\LJfspyM.exe
  C:\Windows\System\LJfspyM.exe
  2⤵
  PID:8876
- C:\Windows\System\owGbkeu.exe
  C:\Windows\System\owGbkeu.exe
  2⤵
  PID:8892
- C:\Windows\System\WjtDEXY.exe
  C:\Windows\System\WjtDEXY.exe
  2⤵
  PID:8908
- C:\Windows\System\uyQeoLw.exe
  C:\Windows\System\uyQeoLw.exe
  2⤵
  PID:8924
- C:\Windows\System\ewAiSIP.exe
  C:\Windows\System\ewAiSIP.exe
  2⤵
  PID:8940
- C:\Windows\System\ZFiIKzE.exe
  C:\Windows\System\ZFiIKzE.exe
  2⤵
  PID:8956
- C:\Windows\System\JEOVEgX.exe
  C:\Windows\System\JEOVEgX.exe
  2⤵
  PID:8972
- C:\Windows\System\CebevNp.exe
  C:\Windows\System\CebevNp.exe
  2⤵
  PID:8988
- C:\Windows\System\OvWSjHn.exe
  C:\Windows\System\OvWSjHn.exe
  2⤵
  PID:9004
- C:\Windows\System\beagGVF.exe
  C:\Windows\System\beagGVF.exe
  2⤵
  PID:9020
- C:\Windows\System\YQAIYto.exe
  C:\Windows\System\YQAIYto.exe
  2⤵
  PID:9036
- C:\Windows\System\JriwbKy.exe
  C:\Windows\System\JriwbKy.exe
  2⤵
  PID:9052
- C:\Windows\System\JrRoAtU.exe
  C:\Windows\System\JrRoAtU.exe
  2⤵
  PID:9076
- C:\Windows\System\CXctTel.exe
  C:\Windows\System\CXctTel.exe
  2⤵
  PID:9092
- C:\Windows\System\BbJQzke.exe
  C:\Windows\System\BbJQzke.exe
  2⤵
  PID:9108
- C:\Windows\System\sHCzTGN.exe
  C:\Windows\System\sHCzTGN.exe
  2⤵
  PID:9124
- C:\Windows\System\ZYnQHAS.exe
  C:\Windows\System\ZYnQHAS.exe
  2⤵
  PID:9140
- C:\Windows\System\rFyqwJu.exe
  C:\Windows\System\rFyqwJu.exe
  2⤵
  PID:9156
- C:\Windows\System\wRmNdEu.exe
  C:\Windows\System\wRmNdEu.exe
  2⤵
  PID:9172
- C:\Windows\System\RXhQSoK.exe
  C:\Windows\System\RXhQSoK.exe
  2⤵
  PID:9188
- C:\Windows\System\vXqOHjH.exe
  C:\Windows\System\vXqOHjH.exe
  2⤵
  PID:9204
- C:\Windows\System\hQrbMDg.exe
  C:\Windows\System\hQrbMDg.exe
  2⤵
  PID:7844
- C:\Windows\System\ysupJIx.exe
  C:\Windows\System\ysupJIx.exe
  2⤵
  PID:7840
- C:\Windows\System\KPtZUYK.exe
  C:\Windows\System\KPtZUYK.exe
  2⤵
  PID:7852
- C:\Windows\System\Prpzlun.exe
  C:\Windows\System\Prpzlun.exe
  2⤵
  PID:8100
- C:\Windows\System\BteNZJP.exe
  C:\Windows\System\BteNZJP.exe
  2⤵
  PID:8552
- C:\Windows\System\xraTBwr.exe
  C:\Windows\System\xraTBwr.exe
  2⤵
  PID:8512
- C:\Windows\System\xFxzRpc.exe
  C:\Windows\System\xFxzRpc.exe
  2⤵
  PID:8096
- C:\Windows\System\VyToOFh.exe
  C:\Windows\System\VyToOFh.exe
  2⤵
  PID:8236
- C:\Windows\System\eyXQaGj.exe
  C:\Windows\System\eyXQaGj.exe
  2⤵
  PID:8596
- C:\Windows\System\KjZYxXz.exe
  C:\Windows\System\KjZYxXz.exe
  2⤵
  PID:8668
- C:\Windows\System\wrCNiQw.exe
  C:\Windows\System\wrCNiQw.exe
  2⤵
  PID:8240
- C:\Windows\System\uYLewNZ.exe
  C:\Windows\System\uYLewNZ.exe
  2⤵
  PID:8332
- C:\Windows\System\KnnaMiN.exe
  C:\Windows\System\KnnaMiN.exe
  2⤵
  PID:8400
- C:\Windows\System\KxlbPPE.exe
  C:\Windows\System\KxlbPPE.exe
  2⤵
  PID:8460
- C:\Windows\System\VqKmYDJ.exe
  C:\Windows\System\VqKmYDJ.exe
  2⤵
  PID:8580
- C:\Windows\System\TLBPHzU.exe
  C:\Windows\System\TLBPHzU.exe
  2⤵
  PID:8652
- C:\Windows\System\LRaLxzY.exe
  C:\Windows\System\LRaLxzY.exe
  2⤵
  PID:8656
- C:\Windows\System\GHyoRSj.exe
  C:\Windows\System\GHyoRSj.exe
  2⤵
  PID:8468
- C:\Windows\System\TeucLob.exe
  C:\Windows\System\TeucLob.exe
  2⤵
  PID:8532
- C:\Windows\System\ttexhdv.exe
  C:\Windows\System\ttexhdv.exe
  2⤵
  PID:8680
- C:\Windows\System\tvgyKMn.exe
  C:\Windows\System\tvgyKMn.exe
  2⤵
  PID:8636
- C:\Windows\System\PFCCtES.exe
  C:\Windows\System\PFCCtES.exe
  2⤵
  PID:8808
- C:\Windows\System\ZxJepnN.exe
  C:\Windows\System\ZxJepnN.exe
  2⤵
  PID:8740
- C:\Windows\System\iddPhti.exe
  C:\Windows\System\iddPhti.exe
  2⤵
  PID:8744
- C:\Windows\System\ZyxeByd.exe
  C:\Windows\System\ZyxeByd.exe
  2⤵
  PID:8832
- C:\Windows\System\dkWDAjx.exe
  C:\Windows\System\dkWDAjx.exe
  2⤵
  PID:9048
- C:\Windows\System\VzYkCZB.exe
  C:\Windows\System\VzYkCZB.exe
  2⤵
  PID:8888
- C:\Windows\System\eouqVEB.exe
  C:\Windows\System\eouqVEB.exe
  2⤵
  PID:8952
- C:\Windows\System\epOHuWH.exe
  C:\Windows\System\epOHuWH.exe
  2⤵
  PID:9000
- C:\Windows\System\VjbFuGn.exe
  C:\Windows\System\VjbFuGn.exe
  2⤵
  PID:9060
- C:\Windows\System\EemcYIN.exe
  C:\Windows\System\EemcYIN.exe
  2⤵
  PID:9184
- C:\Windows\System\dvGmCsK.exe
  C:\Windows\System\dvGmCsK.exe
  2⤵
  PID:9088
- C:\Windows\System\FzpoxvN.exe
  C:\Windows\System\FzpoxvN.exe
  2⤵
  PID:9196
- C:\Windows\System\JXftOqZ.exe
  C:\Windows\System\JXftOqZ.exe
  2⤵
  PID:8932
- C:\Windows\System\XeIvOLT.exe
  C:\Windows\System\XeIvOLT.exe
  2⤵
  PID:9168
- C:\Windows\System\CxUeEwj.exe
  C:\Windows\System\CxUeEwj.exe
  2⤵
  PID:9104
- C:\Windows\System\iVdoFgZ.exe
  C:\Windows\System\iVdoFgZ.exe
  2⤵
  PID:8224
- C:\Windows\System\BzaAdDK.exe
  C:\Windows\System\BzaAdDK.exe
  2⤵
  PID:8288
- C:\Windows\System\CRztkEV.exe
  C:\Windows\System\CRztkEV.exe
  2⤵
  PID:8380
- C:\Windows\System\GfiplwI.exe
  C:\Windows\System\GfiplwI.exe
  2⤵
  PID:7812
- C:\Windows\System\anCCyDA.exe
  C:\Windows\System\anCCyDA.exe
  2⤵
  PID:8708
- C:\Windows\System\MsxVQHB.exe
  C:\Windows\System\MsxVQHB.exe
  2⤵
  PID:8464
- C:\Windows\System\cHbOdwS.exe
  C:\Windows\System\cHbOdwS.exe
  2⤵
  PID:8500
- C:\Windows\System\JMjbBlJ.exe
  C:\Windows\System\JMjbBlJ.exe
  2⤵
  PID:8732
- C:\Windows\System\SexUzOI.exe
  C:\Windows\System\SexUzOI.exe
  2⤵
  PID:8856
- C:\Windows\System\FhshXqK.exe
  C:\Windows\System\FhshXqK.exe
  2⤵
  PID:9152
- C:\Windows\System\ypysYHK.exe
  C:\Windows\System\ypysYHK.exe
  2⤵
  PID:8220
- C:\Windows\System\pgDevRk.exe
  C:\Windows\System\pgDevRk.exe
  2⤵
  PID:7556
- C:\Windows\System\PnVqThh.exe
  C:\Windows\System\PnVqThh.exe
  2⤵
  PID:8348
- C:\Windows\System\ZaZvaas.exe
  C:\Windows\System\ZaZvaas.exe
  2⤵
  PID:8548
- C:\Windows\System\SumfIcl.exe
  C:\Windows\System\SumfIcl.exe
  2⤵
  PID:9228
- C:\Windows\System\DzsPMHl.exe
  C:\Windows\System\DzsPMHl.exe
  2⤵
  PID:9484
- C:\Windows\System\UGUJwWl.exe
  C:\Windows\System\UGUJwWl.exe
  2⤵
  PID:9516
- C:\Windows\System\miEfgkq.exe
  C:\Windows\System\miEfgkq.exe
  2⤵
  PID:9532
- C:\Windows\System\vwuEzRe.exe
  C:\Windows\System\vwuEzRe.exe
  2⤵
  PID:9548
- C:\Windows\System\Wgdgcvl.exe
  C:\Windows\System\Wgdgcvl.exe
  2⤵
  PID:9568
- C:\Windows\System\inrLPfi.exe
  C:\Windows\System\inrLPfi.exe
  2⤵
  PID:9588
- C:\Windows\System\tabLmIe.exe
  C:\Windows\System\tabLmIe.exe
  2⤵
  PID:9608
- C:\Windows\System\dhUjSii.exe
  C:\Windows\System\dhUjSii.exe
  2⤵
  PID:9796
- C:\Windows\System\tuGRsqV.exe
  C:\Windows\System\tuGRsqV.exe
  2⤵
  PID:9824
- C:\Windows\System\JOeBqcH.exe
  C:\Windows\System\JOeBqcH.exe
  2⤵
  PID:9840
- C:\Windows\System\rvySnwX.exe
  C:\Windows\System\rvySnwX.exe
  2⤵
  PID:9892
- C:\Windows\System\rryeAly.exe
  C:\Windows\System\rryeAly.exe
  2⤵
  PID:9912
- C:\Windows\System\ekaCDGa.exe
  C:\Windows\System\ekaCDGa.exe
  2⤵
  PID:9928
- C:\Windows\System\deMBFHN.exe
  C:\Windows\System\deMBFHN.exe
  2⤵
  PID:9944
- C:\Windows\System\pQVjyIk.exe
  C:\Windows\System\pQVjyIk.exe
  2⤵
  PID:10004
- C:\Windows\System\MxOjlFm.exe
  C:\Windows\System\MxOjlFm.exe
  2⤵
  PID:10032
- C:\Windows\System\aoFNfku.exe
  C:\Windows\System\aoFNfku.exe
  2⤵
  PID:10076
- C:\Windows\System\VuLnuIF.exe
  C:\Windows\System\VuLnuIF.exe
  2⤵
  PID:10092
- C:\Windows\System\jFzalNN.exe
  C:\Windows\System\jFzalNN.exe
  2⤵
  PID:10108
- C:\Windows\System\WfaYrWi.exe
  C:\Windows\System\WfaYrWi.exe
  2⤵
  PID:10124
- C:\Windows\System\YAOgrYY.exe
  C:\Windows\System\YAOgrYY.exe
  2⤵
  PID:10140
- C:\Windows\System\yqrCAsb.exe
  C:\Windows\System\yqrCAsb.exe
  2⤵
  PID:10156
- C:\Windows\System\edUYbeW.exe
  C:\Windows\System\edUYbeW.exe
  2⤵
  PID:10172
- C:\Windows\System\UAvrqgn.exe
  C:\Windows\System\UAvrqgn.exe
  2⤵
  PID:10188
- C:\Windows\System\vXXzNUj.exe
  C:\Windows\System\vXXzNUj.exe
  2⤵
  PID:10208
- C:\Windows\System\otRBnaU.exe
  C:\Windows\System\otRBnaU.exe
  2⤵
  PID:10224
- C:\Windows\System\PAuhZxu.exe
  C:\Windows\System\PAuhZxu.exe
  2⤵
  PID:7220
- C:\Windows\System\oUMJVvf.exe
  C:\Windows\System\oUMJVvf.exe
  2⤵
  PID:8336
- C:\Windows\System\ggGyzWT.exe
  C:\Windows\System\ggGyzWT.exe
  2⤵
  PID:9180
- C:\Windows\System\WanbTOv.exe
  C:\Windows\System\WanbTOv.exe
  2⤵
  PID:9220
- C:\Windows\System\PCWJNXq.exe
  C:\Windows\System\PCWJNXq.exe
  2⤵
  PID:8176
- C:\Windows\System\WEzWHFW.exe
  C:\Windows\System\WEzWHFW.exe
  2⤵
  PID:8936
- C:\Windows\System\gDSfJIR.exe
  C:\Windows\System\gDSfJIR.exe
  2⤵
  PID:8672
- C:\Windows\System\PPzbiHW.exe
  C:\Windows\System\PPzbiHW.exe
  2⤵
  PID:7588
- C:\Windows\System\ZTaTqNe.exe
  C:\Windows\System\ZTaTqNe.exe
  2⤵
  PID:8272
- C:\Windows\System\bjvpGnc.exe
  C:\Windows\System\bjvpGnc.exe
  2⤵
  PID:8612
- C:\Windows\System\pFxdZPk.exe
  C:\Windows\System\pFxdZPk.exe
  2⤵
  PID:8564
- C:\Windows\System\AUvhMdu.exe
  C:\Windows\System\AUvhMdu.exe
  2⤵
  PID:8780
- C:\Windows\System\kWcrzjp.exe
  C:\Windows\System\kWcrzjp.exe
  2⤵
  PID:8948
- C:\Windows\System\XhGbOOk.exe
  C:\Windows\System\XhGbOOk.exe
  2⤵
  PID:8160
- C:\Windows\System\SFFWsSh.exe
  C:\Windows\System\SFFWsSh.exe
  2⤵
  PID:8396
- C:\Windows\System\YhtcNhB.exe
  C:\Windows\System\YhtcNhB.exe
  2⤵
  PID:8964
- C:\Windows\System\yLJmUss.exe
  C:\Windows\System\yLJmUss.exe
  2⤵
  PID:8352
- C:\Windows\System\qofkxRR.exe
  C:\Windows\System\qofkxRR.exe
  2⤵
  PID:9064
- C:\Windows\System\ZqXVAlQ.exe
  C:\Windows\System\ZqXVAlQ.exe
  2⤵
  PID:9244
- C:\Windows\System\oNjFjDE.exe
  C:\Windows\System\oNjFjDE.exe
  2⤵
  PID:9260
- C:\Windows\System\GzLvdBb.exe
  C:\Windows\System\GzLvdBb.exe
  2⤵
  PID:9268
- C:\Windows\System\IWHFaTe.exe
  C:\Windows\System\IWHFaTe.exe
  2⤵
  PID:2072
- C:\Windows\System\XkzlhhF.exe
  C:\Windows\System\XkzlhhF.exe
  2⤵
  PID:2812
- C:\Windows\System\HLECsNa.exe
  C:\Windows\System\HLECsNa.exe
  2⤵
  PID:3048
- C:\Windows\System\kmTRlRW.exe
  C:\Windows\System\kmTRlRW.exe
  2⤵
  PID:9624
- C:\Windows\System\QwdxwWO.exe
  C:\Windows\System\QwdxwWO.exe
  2⤵
  PID:9492
- C:\Windows\System\gopeqvj.exe
  C:\Windows\System\gopeqvj.exe
  2⤵
  PID:9504
- C:\Windows\System\BwokAXf.exe
  C:\Windows\System\BwokAXf.exe
  2⤵
  PID:9664
- C:\Windows\System\bBkzqag.exe
  C:\Windows\System\bBkzqag.exe
  2⤵
  PID:9684
- C:\Windows\System\wEULaNX.exe
  C:\Windows\System\wEULaNX.exe
  2⤵
  PID:9704
- C:\Windows\System\OecDnJt.exe
  C:\Windows\System\OecDnJt.exe
  2⤵
  PID:9728
- C:\Windows\System\SDPYzCz.exe
  C:\Windows\System\SDPYzCz.exe
  2⤵
  PID:9756
- C:\Windows\System\cXQPRLD.exe
  C:\Windows\System\cXQPRLD.exe
  2⤵
  PID:9776
- C:\Windows\System\XOINJXl.exe
  C:\Windows\System\XOINJXl.exe
  2⤵
  PID:9748
- C:\Windows\System\PaqYlOm.exe
  C:\Windows\System\PaqYlOm.exe
  2⤵
  PID:9356
- C:\Windows\System\KYeVjJO.exe
  C:\Windows\System\KYeVjJO.exe
  2⤵
  PID:9528
- C:\Windows\System\rqjjxsm.exe
  C:\Windows\System\rqjjxsm.exe
  2⤵
  PID:9304
- C:\Windows\System\DaCMTYb.exe
  C:\Windows\System\DaCMTYb.exe
  2⤵
  PID:9344
- C:\Windows\System\YiXdXkK.exe
  C:\Windows\System\YiXdXkK.exe
  2⤵
  PID:9816
- C:\Windows\System\GTQpPrC.exe
  C:\Windows\System\GTQpPrC.exe
  2⤵
  PID:9312
- C:\Windows\System\wPdaSVY.exe
  C:\Windows\System\wPdaSVY.exe
  2⤵
  PID:9408
- C:\Windows\System\yTuWLnX.exe
  C:\Windows\System\yTuWLnX.exe
  2⤵
  PID:9440
- C:\Windows\System\sDFDgBY.exe
  C:\Windows\System\sDFDgBY.exe
  2⤵
  PID:9564
- C:\Windows\System\HyISRZO.exe
  C:\Windows\System\HyISRZO.exe
  2⤵
  PID:9872
- C:\Windows\System\PrVUigb.exe
  C:\Windows\System\PrVUigb.exe
  2⤵
  PID:8432
- C:\Windows\System\CDHEbhT.exe
  C:\Windows\System\CDHEbhT.exe
  2⤵
  PID:8764
- C:\Windows\System\yXnzMhG.exe
  C:\Windows\System\yXnzMhG.exe
  2⤵
  PID:8284
- C:\Windows\System\CVgPJHp.exe
  C:\Windows\System\CVgPJHp.exe
  2⤵
  PID:9240
- C:\Windows\System\GAyrgCc.exe
  C:\Windows\System\GAyrgCc.exe
  2⤵
  PID:9252
- C:\Windows\System\rsHutCy.exe
  C:\Windows\System\rsHutCy.exe
  2⤵
  PID:9736
- C:\Windows\System\PYMZzxb.exe
  C:\Windows\System\PYMZzxb.exe
  2⤵
  PID:9328
- C:\Windows\System\AIyYcHq.exe
  C:\Windows\System\AIyYcHq.exe
  2⤵
  PID:9348
- C:\Windows\System\PVGVbwc.exe
  C:\Windows\System\PVGVbwc.exe
  2⤵
  PID:9420
- C:\Windows\System\vGoSJAN.exe
  C:\Windows\System\vGoSJAN.exe
  2⤵
  PID:9404
- C:\Windows\System\tRuEWXg.exe
  C:\Windows\System\tRuEWXg.exe
  2⤵
  PID:10056
- C:\Windows\System\UQrkHyg.exe
  C:\Windows\System\UQrkHyg.exe
  2⤵
  PID:10052
- C:\Windows\System\moCyqjz.exe
  C:\Windows\System\moCyqjz.exe
  2⤵
  PID:9280
- C:\Windows\System\yPRLoih.exe
  C:\Windows\System\yPRLoih.exe
  2⤵
  PID:9848
- C:\Windows\System\drBKwzL.exe
  C:\Windows\System\drBKwzL.exe
  2⤵
  PID:9444
- C:\Windows\System\zhwEpTW.exe
  C:\Windows\System\zhwEpTW.exe
  2⤵
  PID:10012
- C:\Windows\System\BEOkSVq.exe
  C:\Windows\System\BEOkSVq.exe
  2⤵
  PID:9924
- C:\Windows\System\VgFeJaJ.exe
  C:\Windows\System\VgFeJaJ.exe
  2⤵
  PID:10164
- C:\Windows\System\NtBtAqB.exe
  C:\Windows\System\NtBtAqB.exe
  2⤵
  PID:10184
- C:\Windows\System\DoWGWiz.exe
  C:\Windows\System\DoWGWiz.exe
  2⤵
  PID:10232
- C:\Windows\System\oIZrGNb.exe
  C:\Windows\System\oIZrGNb.exe
  2⤵
  PID:9676
- C:\Windows\System\oLBYpXv.exe
  C:\Windows\System\oLBYpXv.exe
  2⤵
  PID:9772
- C:\Windows\System\OTTzHoc.exe
  C:\Windows\System\OTTzHoc.exe
  2⤵
  PID:9596
- C:\Windows\System\FjcMjmm.exe
  C:\Windows\System\FjcMjmm.exe
  2⤵
  PID:9320
- C:\Windows\System\mWihKfT.exe
  C:\Windows\System\mWihKfT.exe
  2⤵
  PID:9400
- C:\Windows\System\BJWzdEk.exe
  C:\Windows\System\BJWzdEk.exe
  2⤵
  PID:9908
- C:\Windows\System\Xcgxbgt.exe
  C:\Windows\System\Xcgxbgt.exe
  2⤵
  PID:2304
- C:\Windows\System\LFNyjhJ.exe
  C:\Windows\System\LFNyjhJ.exe
  2⤵
  PID:10064
- C:\Windows\System\ODAtYWt.exe
  C:\Windows\System\ODAtYWt.exe
  2⤵
  PID:10000
- C:\Windows\System\MvkzALL.exe
  C:\Windows\System\MvkzALL.exe
  2⤵
  PID:9920
- C:\Windows\System\TLhNlhr.exe
  C:\Windows\System\TLhNlhr.exe
  2⤵
  PID:10136
- C:\Windows\System\rZGMubp.exe
  C:\Windows\System\rZGMubp.exe
  2⤵
  PID:10040
- C:\Windows\System\FSNarTP.exe
  C:\Windows\System\FSNarTP.exe
  2⤵
  PID:10048
- C:\Windows\System\ciBiguu.exe
  C:\Windows\System\ciBiguu.exe
  2⤵
  PID:1416
- C:\Windows\System\DraGgDs.exe
  C:\Windows\System\DraGgDs.exe
  2⤵
  PID:9788
- C:\Windows\System\gHXLvYs.exe
  C:\Windows\System\gHXLvYs.exe
  2⤵
  PID:8776
- C:\Windows\System\DKwoXtP.exe
  C:\Windows\System\DKwoXtP.exe
  2⤵
  PID:2932
- C:\Windows\System\hMyevWW.exe
  C:\Windows\System\hMyevWW.exe
  2⤵
  PID:9656
- C:\Windows\System\vyAomxP.exe
  C:\Windows\System\vyAomxP.exe
  2⤵
  PID:9364
- C:\Windows\System\UzKijNm.exe
  C:\Windows\System\UzKijNm.exe
  2⤵
  PID:9984
- C:\Windows\System\NNWUcXm.exe
  C:\Windows\System\NNWUcXm.exe
  2⤵
  PID:9936
- C:\Windows\System\RuYUFYN.exe
  C:\Windows\System\RuYUFYN.exe
  2⤵
  PID:10204
- C:\Windows\System\ITjQzjW.exe
  C:\Windows\System\ITjQzjW.exe
  2⤵
  PID:9584
- C:\Windows\System\TeKWvxQ.exe
  C:\Windows\System\TeKWvxQ.exe
  2⤵
  PID:9472
- C:\Windows\System\jTGTUEJ.exe
  C:\Windows\System\jTGTUEJ.exe
  2⤵
  PID:9888
- C:\Windows\System\UpGjkwb.exe
  C:\Windows\System\UpGjkwb.exe
  2⤵
  PID:9976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AtAIcBn.exe

Filesize
1.4MB

MD5
c61867dbda78af095f028f5247e5b651

SHA1
ffc71c795a3424301bdd111a5335cbb9db32f92c

SHA256
b0c35806d82948d29b3e659f64ca29a72853af37b5f503a147d850b5498218d3

SHA512
b44fc342b22fd9820c49e5712c4fa7105e3e5056443a1faee0cc8757dcb3bd696a87feeed147df6ba79dd57fe19194bdcf734bdccf131bab5aa7836fe0c75bc3

Download Submit
C:\Windows\system\GcBnWCA.exe

Filesize
1.4MB

MD5
58d60ccd06b78851ce5a64f8fa89509e

SHA1
e69559ac5540a98b8cc95a2db83094a01472ad5e

SHA256
860047a3a17a4d6f587436d893e5d10f71ead9cd77056a724902800048f6e9bd

SHA512
5479753c9fb21a39f0c137e22e52cf3de3f44427e7745fbaf6c7fc8d38857bf0e7005175b78239e59041829e472fdcdcc129e9c108e7ae351c10d2fa60968d0e

Download Submit
C:\Windows\system\KlKJZpl.exe

Filesize
1.4MB

MD5
f8f46e7d7cdfed3dc7183d92298a987e

SHA1
e9bb105fa893ff679c46dd87719315c1409ca167

SHA256
bbb8e2261220a05c8bc0487e8e5abcd0df3e080dd484875868f39aa3d9ea51c6

SHA512
528d48210a3f42f05d5f3a0597d272c5f8f202c736e24110e002d830702a91b4596d3cbc4e8b04a832a29377d5115d1a951ac9516ef01b458cbed77f785fb6c5

Download Submit
C:\Windows\system\McBFGNe.exe

Filesize
1.4MB

MD5
12bf9bbd784fc15d90181816561be4de

SHA1
cbdb64e773fbab5c78b8aeb9f3c2dfb898657695

SHA256
b81eaa15ae113f5f4ebe9917a86575dc360d0f465ffbb20382966d586f95fee9

SHA512
07b2bc5280890f17beb3478c1da4ab5cc794cbf15ac37fcfeee4d42ed165cb47b5601a01b4aa9ae3b2e6b52544bcadb90be25cfdd254cfd4bce332993c5434db

Download Submit
C:\Windows\system\QbqsSOg.exe

Filesize
1.4MB

MD5
03893e38c171cfb5cdf2fc8cbb9481f5

SHA1
91b0c1cafa33b14d9dda0eac1a8bbe89cf059833

SHA256
a9bf2843807ab8b6a16a164d82a0e9f7d032f4a1a3120e6c0b1a97bf5a46dba4

SHA512
a0bb50e5a977512d3d94d9dbba2eb963d302e299fbd762ecfac866cb8274f093ff99633e3d80dcfd76288a0068ba4bfebd4128f5eb0b7eb1d624787ef73336df

Download Submit
C:\Windows\system\TRnKfEh.exe

Filesize
1.4MB

MD5
de1a0917929629be77fc9712d8eb1353

SHA1
973fe87644e0c17286c0f97935eaa8f293d79fb9

SHA256
e6bf5dbc3eae6fcce83238bc568353ce7ea6f363d65bf1e7cf92f6131c86e7c2

SHA512
6d4a1b8e8e68df096f90e8be20fac3698eb25646c4773419fd34335277fc5b7b13f084a373bddda89ad0013c243a39138d4d8d8f96a56d71b0930c6cfe4aca5b

Download Submit
C:\Windows\system\VBSEhGK.exe

Filesize
1.4MB

MD5
f631f6aca7c71e0d29b3718078ee125e

SHA1
6411ab79c95bc556e04aa3a15ff85319395b7fe6

SHA256
c26893fb43f6b3f3940118eb815444cfc91a70ff6c0ec92d7814ca94833bebf0

SHA512
4472c43f639763310deca41b523f6c34867931de307350d5a4509dc14a95bc0b20fe42714b03ff0996589e45131c2764b95001cd7b21e96b165a7c4124208084

Download Submit
C:\Windows\system\WFqyJCD.exe

Filesize
1.4MB

MD5
fb9200a0bae2685eb20058635da7b516

SHA1
f07e60f3b2196931970696b0c9d1a2877b1eb516

SHA256
4c16187b36a94601f7d070168ee128953bbf176140dc18dce635627c6d2c9b36

SHA512
f394f1f3bd64cabf9d9ba0ace8d9ce3b3f56464b726b64c93e3af30cb893b7ac4e158e7cc030e89904f6301b70f96b740bc061673b38d87fabe116a14646f03a

Download Submit
C:\Windows\system\fLAqzWu.exe

Filesize
1.4MB

MD5
c8ae94c3116eaf5a87510a9d4dcebadd

SHA1
d9ef8d2f0afee59b8e5a2717ef15c2a6a86e3548

SHA256
be21278e28c75b7aadf802dfc9bbd73f4939949477993ef19611e322c88721f2

SHA512
facebb56f293d03fc43122033731f05e21288d1abf6bf162fa204d9d3f3d4939e6d96c233b1f58faa9f32daba7420c2550baa3cbd4d0bfc9eaab158304a6dd4e

Download Submit
C:\Windows\system\hLqQqiN.exe

Filesize
1.4MB

MD5
d0d36fa1fea9a5ccfcf974a8018c0219

SHA1
46162dd270ebd6ef25548b4f754958627d257a4a

SHA256
d03496bb931e7d30908c346b5b3c74431df7559ba9bf41f00cb7cddcd0c14747

SHA512
aeba64726e968702fd9fa2926b5ceb8036bcf6cc92b8519dd549c82ccf19dac0be13d50a36da29cd6544b12e1b12211a2882e0db75cdcf3edb2d5af9f55237b8

Download Submit
C:\Windows\system\khBLpnR.exe

Filesize
1.4MB

MD5
b8c27b9adccdbbdea65f3414065ee1cb

SHA1
18ceb4d9da38bbd00a1228124b446aada5a04a4d

SHA256
0a89ba28e6c5a06e4364256bd8d10a4c2eacba699d6a0551a1fb88e246a4c86a

SHA512
d937f6d69108fdac59b9c25d2f88b26401381177635f0f5c2bf4c4b081c9757426af87af4f29e4cf753b198cfb0e32e9c86a4375127973bf80023147f9768e0c

Download Submit
C:\Windows\system\lfPNmkj.exe

Filesize
1.4MB

MD5
acc855977790ef5d70a0223a8990216e

SHA1
be5729d7a33722deaf6a3cc18bdc0384340f2eaa

SHA256
e7010aff0bd85f4cf806a95823ae42bfcec272967d5c54bd92f974f233e18538

SHA512
89cb69b9a997059a5df2b29ce14a650de6f84ec222526bfc73d4071801eb2f08b5c4ef5c9ac6671318ec8e24c7d197efb7da0c0bd381927e2e2ec141f1df1e49

Download Submit
C:\Windows\system\lxIIipB.exe

Filesize
1.4MB

MD5
a79bc9ed06519971f850f5c395649299

SHA1
060eab5f317d1bac7bb01df9e6f9e6108e4abb4f

SHA256
b30ae1739b97da25b7752401f27313b3ace9128b4eb7e292be1cc926788a20ec

SHA512
2df5dc74b56d180ece8981f2ead3ad9ab358625ae48f3beded286ec28002b30399ca60f35ca822e3e09fa8851f5b3d0deb71e179bb52bd250b97a4dc649d8135

Download Submit
C:\Windows\system\rFzMrYn.exe

Filesize
1.4MB

MD5
2606b6a41cf0b40a90851427e2c94e63

SHA1
86127d8117fe0e7270f124dff5da24ac52975a6d

SHA256
e7f70cf9f48887e7f1d824ec4a7cba2f837409f7259e5fe0e3fb4c84a346a9eb

SHA512
192cb7281aa7d895c5936066fc37e31ead0eb13fa8cdfc8de9073a84db11673c545209507879d506a7b90a96794f7c2590a274ee33f1accdcbd6eb9e137c34bf

Download Submit
C:\Windows\system\sVBafIL.exe

Filesize
1.4MB

MD5
9c1191466174e1d620836c685bfc1dd2

SHA1
0cb7d821d0a5cf7319f9d4c30aca69af835ae46d

SHA256
09808ce86b646039ffa19165ed3b5848a7d0494225e02f91bb1de37d9a14f9d2

SHA512
6087678aadb016d437cd9112c8785beb3760171eedef460204eb1888cc115d75cad7697084d0eccdf98d5b3f059b225d2c1598b11d41cfe2a7d2b15f4c285282

Download Submit
C:\Windows\system\trBIYua.exe

Filesize
1.4MB

MD5
3dcb2cc72a7bcb7de387ecaa50fd7de1

SHA1
61330994a904577ad66c36407da7bdc2d4922d97

SHA256
ab2967b184bae9d56999fab2bdf4244fd76ef8f4894874439ae66c8ac673d7c2

SHA512
096527914e6f0fb1e75656ce9a0d055514242256b40cbdc3cc4c258bd74ab2a89cae4307abfdf57e6ee519a40af2b95a7f795b248369b8b7b933bd5e501cbcfa

Download Submit
\Windows\system\DOuqpmC.exe

Filesize
1.4MB

MD5
ec3ea48f2ef8468c125b9fdf1e95faa7

SHA1
7f458901bca6c7dcce6d88e909b16e7103724d55

SHA256
b606dc88289086cca2dd9ef608cc93d6fc58c5f9aa86b89c2ec7aebaa62593fb

SHA512
6842221bd2620d6840b042a4770f2ff087f1e4afd5784268d07a405b89b3c99f84b654c97861add4981ea35a72a4de49fddf736c7fea62df5c7a4e273b0c6557

Download Submit
\Windows\system\EnLuEGC.exe

Filesize
1.4MB

MD5
6b2873733bb465c5b1c17ab3eaf2a324

SHA1
d93ec4b8715e8e05c62c501b11d3c4835510fb64

SHA256
202c914a4e6b7150bcc78e4b4b87a2802b6740aa2feb325116b8441706d45c5b

SHA512
9e5e708f6fe4e94ac6203223a74cf3c9df28aef504278a472e53716907d2c5efc8f01fa9c29c2913a3aac802330cb4d4b29a10123308b11c352bfacc058871c1

Download Submit
\Windows\system\GiekTRt.exe

Filesize
1.4MB

MD5
a0e94267f8515fa645316b5f55f5cc80

SHA1
44d61ed4a2d59db95ddc5a7cae09be347a7c3b18

SHA256
17f8babf078415cccad2071a513272265bad54f421217b2f902fc0836e995c68

SHA512
481fcc2be1ff5b05e3888878a9f2ef9adec8d3e2c7f75b69bccbc9c7943c6df240f1a5c0c0742d88472c440a4ebea5844a8d39064945de3fc65aac36022f890a

Download Submit
\Windows\system\GmUXxKU.exe

Filesize
1.4MB

MD5
841fc1feb303fc5d7d47c62aa9766574

SHA1
03c6283c384608375e59c0712f0d1f8c2baee524

SHA256
5300983f434dbbf746d03e6e021d63758bd9400813bcbc6d78e72a62cd5bbebe

SHA512
b3e60d2dce411e0daf703c3185b7590cf3729deb684fe3a98d68450eccfc5e8ae3efc7abd671a0e876b55795e653efe496c5d5e0408f614d91d4902e4144b1f7

Download Submit
\Windows\system\JqCCbMy.exe

Filesize
1.4MB

MD5
82f9f0a7eee96b58578899acd9480cf8

SHA1
51135a8b2ebee4baca5f68021b7c802f75bde148

SHA256
f3822d31daf2d5585f607a691e805e6f912daf7ee1760dd2cbd2c8cd12d0e360

SHA512
ff4e2dbcd2ebb788dcec8742949a9f288c39418e8760ece9ed246f4ef445ab60b7c8da5e77ab0b9464f86b66963501617e1a7023607a87ae78618ddd1fde49a6

Download Submit
\Windows\system\KQuoRHc.exe

Filesize
1.4MB

MD5
29a4b7aa6292bd9824394ebb8d485950

SHA1
5737601b464bb9fe0fd90403f179418027b06504

SHA256
a9fe4d5d378e21244031fe3d43382a05f29b8f634324eaa688b3412b691658c7

SHA512
a35438d26ecd987c477cc3d79c7f49b25d4b56a83e599a4e90d0b10ee68583616fe67ead7530880e8f20b2ebfd3dcde49e84f31b6529f634541d76427e857aaa

Download Submit
\Windows\system\LMdWKTT.exe

Filesize
1.4MB

MD5
a07ed7f0720b598462227d13dc6b0f79

SHA1
f96501c58cdf19e8bd4f869c06f2a75f10817a35

SHA256
b9c294c02120671dd6838aa89a5703a386aa541fcbb2ec062b7e02c1a40dc95c

SHA512
53136ca8248e4d6075c5205eb4be27d65c727639f055fa94d6a4abc2583fdd804fcb71325b67009e526f9e3c0475e80a7a6ae45fe9e73866f2aae577b4a1c181

Download Submit
\Windows\system\MOGfDBc.exe

Filesize
1.4MB

MD5
3dd227cec71865209a91ca6bb6e26dc7

SHA1
1575dad07bd98d27816b067471e85d8e6fbba157

SHA256
25ad2554f235a31cc51434b9df9f5946b50395c7e9dcf19db1ecc69852fe68a9

SHA512
ba839c5912851f35d5d5863a27c89c64737ce5acf9f93ccf4542a6b850427949d44d1bca85d71659252ebfaea89fc93a6abc5455e3f36aab7c0daf8ed0937854

Download Submit
\Windows\system\SNAOEMf.exe

Filesize
1.4MB

MD5
652af6ed37bc36813276d1bf62bc5733

SHA1
2319d61555562b3f52b51ee3b987093a5438080b

SHA256
3d778769389071ae8c57a1385f8f1ade207ba12c024ff6216f4aaff851baaaf8

SHA512
9f6c3e7366c633f76d90126d68f6b61341e8c58faef0dec945f99d86e81f911481a6943307b120aded28c9aea6296028facbbd8e16129d00495dbdb2b20cc40e

Download Submit
\Windows\system\TOrGgfi.exe

Filesize
1.4MB

MD5
306b714e8af615b82a5421f2f35a98b0

SHA1
557e0d2386030a0cf25d80be21148525b023e643

SHA256
f55cbd9d20f35b6d3778575cfeab132aafc9136820c3e29a95879b3a955afcb4

SHA512
750d910820e3cdc5c21e3e0714509c2586ca3be047c3154c8d4b84dbbb7f3f210ec23d54e0bfb67e5e568d35ac2b0f936581994910ec33b909eba82820385e04

Download Submit
\Windows\system\XCYjgli.exe

Filesize
1.4MB

MD5
5c408c1bb2a65926efdc63734feafdac

SHA1
da0163676254d4a82dd1ce428a486dbc4f744fb0

SHA256
a71c8006072e1335fb62c84ada1dc1911bcc41527350005ef8419939ad963d59

SHA512
e73d0b3c52f7b37c6d93ca1c6f13bb782c99907096cfb3ccc03f0b67be53c1358439d111b50aa0011cb947b84a6b4fad96cc6a4edf0125a00ccf458aaf785a96

Download Submit
\Windows\system\YEWuMMW.exe

Filesize
1.4MB

MD5
ec78e9bf084a957f5d6fc473456777ed

SHA1
969c7582e9409980927374762705704c19451f8c

SHA256
743a0e70736b211bb8650efa468afec995aa679eeb0a4db77ea3870439141016

SHA512
6495e90ba79ee06a0cf5d0a0e288dde24372af5060b8a839393dbed73b91c5d3ad9d2d780df51afbe47abc856d8841bef83da0203cc8f45b852f0b366f340c7a

Download Submit
\Windows\system\cMJutsK.exe

Filesize
1.4MB

MD5
8c226606a80bfa1b0fda4ce3c156f8d7

SHA1
ddb1830096b399d01bc1c438e4893153066f266a

SHA256
d0573d14ed5b7a6895b26f9823b68ec110cd58fba0d76dc3f330420e811dc485

SHA512
5c9a6695f67c0c92987fcda7cbbc663433b4c18642b8edaed4dcca8f4f61182b871731c6af4acb59e08d24777e61f8deaf3dbfef091059dd7d95b2158913860a

Download Submit
\Windows\system\kibkEIE.exe

Filesize
1.4MB

MD5
967c9e46ea2fce7d13e784bc50403f83

SHA1
41a33807e0cd7a57a6d2fbf1007ea44ee879c326

SHA256
3dde88dce4f367cbafd488a18bf1800b1b9a43f52e416d0f2ebf21ffc71298ba

SHA512
24e9c1f90166ead612d41f9e76859443f261df3eb194ce17e258b24366b4af2e3f4e0a2d1e0c40d971715fc3221000317f321213db75b001cbe0f283664e8f47

Download Submit
\Windows\system\lXGvvCT.exe

Filesize
1.4MB

MD5
96dbd18cdf75564385f5f02c8537e423

SHA1
f5494ccbd40511555a9aedd5d55c006bf60a51ab

SHA256
eabb4163cfcd98cfaa16667c7e54baf1713776e250d848ca12d86beb80752b82

SHA512
da060aaf3be9777e7e677162727328f4d02f079e028811631509565c0e8898e34959c0418800aa133ac53038bea0d45e885e47f16eded42e6ceae55342d87fdd

Download Submit
\Windows\system\tZgqRcA.exe

Filesize
1.4MB

MD5
4a7bf7b56d2798a9fb9a93734525d7e3

SHA1
d6a83a8038f074b80559ac2cef24ee2155a6f44f

SHA256
4cc36f3f0cc1d8d009af5c7c1c7d4ab92220c4210ce5cd56806c2f8f81fa7eaf

SHA512
f01c9c2674dd4aac9cd40ada99e784161116d29ab5ab6398254020c01e688176e7a513a02f005c676ff25552ab2e3f27b67912eaf97ed999578167fb2fcf1e92

Download Submit
\Windows\system\yqiCvLm.exe

Filesize
1.4MB

MD5
53ce8c309636b1926669d9b5c10febd5

SHA1
1ef3421d59768f5291c945c99444f10a7c19577d

SHA256
25dc295a5eb5aeee009c041cfc8050b521d39352868bb039443500f9293d1631

SHA512
9a2df056f3f55d3cadd200544f60dd0aedc3c91c9508ed4ce2b29349d1f1fb29f1e1c2afeab4c5889442e7e1a470fefc04e9784ab0dadd7c32ab06e3081084b1

Download Submit
memory/1732-119-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2220-27-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2220-12-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2220-122-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2220-16-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-66-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2220-21-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2220-364-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2220-123-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2220-56-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2220-55-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2220-54-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2220-93-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2220-0-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2220-42-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2220-39-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2220-1-0x0000000001BA0000-0x0000000001BB0000-memory.dmp

Filesize
64KB

Download
memory/2220-124-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2220-289-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2240-23-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2240-64-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2043-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2244-13-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2244-2042-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2308-79-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2308-44-0x000000001B2A0000-0x000000001B582000-memory.dmp

Filesize
2.9MB

Download
memory/2308-45-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2308-33-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2412-67-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2412-4253-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2520-40-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-2040-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-49-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2604-214-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2624-73-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2624-4222-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2632-57-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-369-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-3771-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-2041-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-15-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-71-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/3000-2044-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download