xmrig | e5acc910bd7102335cf5e6214d5a8cc4f37ad6d3d30494e642509802947ec76f

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
Size

1.9MB
MD5

0dc487a596cc117c28738b6e97da21d8
SHA1

8f702d3984d4f6c4630996a24adf0a495d4090a6
SHA256

e5acc910bd7102335cf5e6214d5a8cc4f37ad6d3d30494e642509802947ec76f
SHA512

a408003e8efea557e1ba35f7d5a60eec8da185ea4d8c5178448dc14ee8363fcaa3c338f9bb78e9192627c55dd17784c724af2a982dda67253873d6b92307e356
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U18:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2500-50-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/1624-49-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2564-162-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2648-160-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2516-34-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/2208-39-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2948-21-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2948-5241-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2208-5249-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2500-5252-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2516-5251-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig
behavioral1/memory/1624-5382-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2528-5387-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2648-5393-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2316-5390-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2824-11379-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2948	wLbLtFm.exe
1624	NmnbBaW.exe
2516	CgBQuwp.exe
2208	GHJYYKQ.exe
2500	yYQAWGh.exe
2648	nhMwBBM.exe
2564	xLXZrep.exe
2316	MXLJJJA.exe
2528	qtbDFvO.exe
1568	vSdrRxd.exe
1892	iHCFNNG.exe
1848	cbPyQHL.exe
1808	xwxwYMc.exe
1916	IAcPwYO.exe
2328	yjuBnuP.exe
1828	XkPFpRw.exe
1592	RZFxygO.exe
2476	YtYRphe.exe
1056	rqqtLhZ.exe
596	uJXQLMY.exe
872	ADVDgAv.exe
2580	qIIVUPu.exe
1904	MoFyhgV.exe
1912	EuxGGyW.exe
2428	EaCXxZM.exe
1844	wdiTELu.exe
2864	KXzrzrZ.exe
3016	XZGbwBv.exe
1832	iJgyNUl.exe
2076	mAbYcpu.exe
2188	lIDaBEC.exe
2284	iyviKnm.exe
2028	zypZrIh.exe
1224	LMrnLcs.exe
2024	YmzvIIF.exe
1448	yMVmlUv.exe
1968	PXmegor.exe
2224	vBgaJhQ.exe
2872	pslrvCq.exe
2556	cSqNmAE.exe
876	wnLcsZT.exe
1548	iSjNmCB.exe
1588	tKJpYXb.exe
2840	JJkPAWM.exe
2172	XMfhhNb.exe
2000	yFddbwE.exe
1584	rkOevcO.exe
852	RBMqWFq.exe
2812	ZyrVtZu.exe
356	zfKqhKi.exe
2712	ZJOHtnl.exe
3068	ptyUkdK.exe
716	iPaoFci.exe
856	WJjXbfW.exe
1880	hWBlYeB.exe
3100	YXPsebN.exe
1744	ThiYssh.exe
3148	iNMpMsF.exe
3180	pFDDKMU.exe
3216	jvCxyxl.exe
3256	zEXpupZ.exe
1884	ZLVPLNf.exe
3300	joiLgjo.exe
3332	hqGpcqa.exe

Loads dropped DLL 64 IoCs

pid	Process
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000015c85-3.dat	upx
behavioral1/files/0x0007000000015d44-15.dat	upx
behavioral1/files/0x0008000000015d24-22.dat	upx
behavioral1/files/0x00050000000186c1-145.dat	upx
behavioral1/files/0x0009000000018640-136.dat	upx
behavioral1/files/0x00060000000175b8-129.dat	upx
behavioral1/files/0x000500000001874c-184.dat	upx
behavioral1/files/0x00050000000191ed-194.dat	upx
behavioral1/files/0x001800000000558a-61.dat	upx
behavioral1/files/0x0007000000016cf5-58.dat	upx
behavioral1/files/0x0007000000015e09-53.dat	upx
behavioral1/memory/2500-50-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/files/0x0006000000016d05-66.dat	upx
behavioral1/files/0x0006000000016d16-73.dat	upx
behavioral1/files/0x0006000000016d32-84.dat	upx
behavioral1/memory/1624-49-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x0008000000016cb2-48.dat	upx
behavioral1/files/0x0006000000016da4-100.dat	upx
behavioral1/files/0x0006000000016d36-94.dat	upx
behavioral1/files/0x0006000000016d3a-91.dat	upx
behavioral1/files/0x0006000000016e78-106.dat	upx
behavioral1/files/0x000600000001739d-113.dat	upx
behavioral1/files/0x000600000001744c-120.dat	upx
behavioral1/files/0x00060000000175b2-126.dat	upx
behavioral1/files/0x000500000001865a-139.dat	upx
behavioral1/files/0x001500000001863c-132.dat	upx
behavioral1/memory/2564-162-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x000500000001874a-177.dat	upx
behavioral1/memory/2648-160-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/files/0x00060000000175ac-156.dat	upx
behavioral1/files/0x00060000000173e5-155.dat	upx
behavioral1/files/0x0006000000016fe8-154.dat	upx
behavioral1/files/0x0006000000016db3-153.dat	upx
behavioral1/files/0x0006000000016d9f-152.dat	upx
behavioral1/memory/2528-151-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/files/0x00050000000186d3-148.dat	upx
behavioral1/memory/2516-34-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x0006000000018bba-186.dat	upx
behavioral1/files/0x00050000000191eb-192.dat	upx
behavioral1/files/0x0005000000018700-168.dat	upx
behavioral1/memory/2316-83-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d1f-82.dat	upx
behavioral1/files/0x0006000000016d0e-81.dat	upx
behavioral1/files/0x0006000000016cfd-80.dat	upx
behavioral1/files/0x0007000000015e6d-40.dat	upx
behavioral1/memory/2208-39-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x0009000000015cd9-24.dat	upx
behavioral1/files/0x0007000000015d4c-23.dat	upx
behavioral1/memory/2948-21-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2824-2-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2948-5241-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2208-5249-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2500-5252-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2516-5251-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/1624-5382-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2528-5387-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2648-5393-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2316-5390-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/memory/2824-11379-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NQqDOjV.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\QBJXMbv.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\UCOlNPC.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\eurrBwo.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\FaAIWSd.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\iyfMCaj.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\hRByoIi.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\kIkHfbl.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\YCDLvgO.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\LdGJKrk.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\IuBXMEQ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\fJYozgb.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\MVfdQwI.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\KCwwbKu.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\csWAHNm.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\MVqazhk.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\zXpIbkU.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\xucqWGC.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\UhcXtpC.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\UXCZzaq.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\PniorET.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\KxDAAET.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\ADavNTc.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\NcyVVfk.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\RwbnurU.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\wqrsclb.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\TsGIUxP.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\ZBxlXVa.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\kDQCXxQ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\dNCJozk.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\hasKBLn.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\FOdBSlD.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\dzgCwCv.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\zIGNpfm.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\lhdRcAW.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\QWgQyVg.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\rMjlVsJ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\cgHaJNp.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\IkwjGeP.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\bypWLuw.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\oxCiMmJ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\tPHqgtf.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\Sdposnj.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\puGrfjs.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\nxcZzvq.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\PmDMBHc.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\OfOqEEY.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\udRDPNH.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\sVfeMAQ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\VMfkCHK.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\skmOAZm.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\tIUAGsT.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\AWIlStp.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\CToccMQ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\JafOKGx.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\cwyzgjF.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\XJtEdsc.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\pYcqtXn.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\dGUdXzo.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\lXrtPou.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\RVLQZaz.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\revJjYQ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\bdRGJfZ.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
File created	C:\Windows\System\vNdXaRP.exe	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2216	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	29
PID 2824 wrote to memory of 2216	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	29
PID 2824 wrote to memory of 2216	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	29
PID 2824 wrote to memory of 2948	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	30
PID 2824 wrote to memory of 2948	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	30
PID 2824 wrote to memory of 2948	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	30
PID 2824 wrote to memory of 2208	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	31
PID 2824 wrote to memory of 2208	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	31
PID 2824 wrote to memory of 2208	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	31
PID 2824 wrote to memory of 1624	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	32
PID 2824 wrote to memory of 1624	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	32
PID 2824 wrote to memory of 1624	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	32
PID 2824 wrote to memory of 2500	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	33
PID 2824 wrote to memory of 2500	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	33
PID 2824 wrote to memory of 2500	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	33
PID 2824 wrote to memory of 2516	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	34
PID 2824 wrote to memory of 2516	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	34
PID 2824 wrote to memory of 2516	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	34
PID 2824 wrote to memory of 2564	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	35
PID 2824 wrote to memory of 2564	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	35
PID 2824 wrote to memory of 2564	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	35
PID 2824 wrote to memory of 2648	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	36
PID 2824 wrote to memory of 2648	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	36
PID 2824 wrote to memory of 2648	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	36
PID 2824 wrote to memory of 2580	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	37
PID 2824 wrote to memory of 2580	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	37
PID 2824 wrote to memory of 2580	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	37
PID 2824 wrote to memory of 2316	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	38
PID 2824 wrote to memory of 2316	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	38
PID 2824 wrote to memory of 2316	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	38
PID 2824 wrote to memory of 2428	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	39
PID 2824 wrote to memory of 2428	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	39
PID 2824 wrote to memory of 2428	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	39
PID 2824 wrote to memory of 2528	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	40
PID 2824 wrote to memory of 2528	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	40
PID 2824 wrote to memory of 2528	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	40
PID 2824 wrote to memory of 2864	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	41
PID 2824 wrote to memory of 2864	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	41
PID 2824 wrote to memory of 2864	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	41
PID 2824 wrote to memory of 1568	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	42
PID 2824 wrote to memory of 1568	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	42
PID 2824 wrote to memory of 1568	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	42
PID 2824 wrote to memory of 1832	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	43
PID 2824 wrote to memory of 1832	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	43
PID 2824 wrote to memory of 1832	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	43
PID 2824 wrote to memory of 1892	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	44
PID 2824 wrote to memory of 1892	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	44
PID 2824 wrote to memory of 1892	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	44
PID 2824 wrote to memory of 2188	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	45
PID 2824 wrote to memory of 2188	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	45
PID 2824 wrote to memory of 2188	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	45
PID 2824 wrote to memory of 1848	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	46
PID 2824 wrote to memory of 1848	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	46
PID 2824 wrote to memory of 1848	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	46
PID 2824 wrote to memory of 2028	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	47
PID 2824 wrote to memory of 2028	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	47
PID 2824 wrote to memory of 2028	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	47
PID 2824 wrote to memory of 1808	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	48
PID 2824 wrote to memory of 1808	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	48
PID 2824 wrote to memory of 1808	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	48
PID 2824 wrote to memory of 2024	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	49
PID 2824 wrote to memory of 2024	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	49
PID 2824 wrote to memory of 2024	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	49
PID 2824 wrote to memory of 1916	2824	0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0dc487a596cc117c28738b6e97da21d8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System\wLbLtFm.exe
  C:\Windows\System\wLbLtFm.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\GHJYYKQ.exe
  C:\Windows\System\GHJYYKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\NmnbBaW.exe
  C:\Windows\System\NmnbBaW.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\yYQAWGh.exe
  C:\Windows\System\yYQAWGh.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\CgBQuwp.exe
  C:\Windows\System\CgBQuwp.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\xLXZrep.exe
  C:\Windows\System\xLXZrep.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\nhMwBBM.exe
  C:\Windows\System\nhMwBBM.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\qIIVUPu.exe
  C:\Windows\System\qIIVUPu.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\MXLJJJA.exe
  C:\Windows\System\MXLJJJA.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\EaCXxZM.exe
  C:\Windows\System\EaCXxZM.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\qtbDFvO.exe
  C:\Windows\System\qtbDFvO.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\KXzrzrZ.exe
  C:\Windows\System\KXzrzrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\vSdrRxd.exe
  C:\Windows\System\vSdrRxd.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\iJgyNUl.exe
  C:\Windows\System\iJgyNUl.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\iHCFNNG.exe
  C:\Windows\System\iHCFNNG.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\lIDaBEC.exe
  C:\Windows\System\lIDaBEC.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\cbPyQHL.exe
  C:\Windows\System\cbPyQHL.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\zypZrIh.exe
  C:\Windows\System\zypZrIh.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\xwxwYMc.exe
  C:\Windows\System\xwxwYMc.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\YmzvIIF.exe
  C:\Windows\System\YmzvIIF.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\IAcPwYO.exe
  C:\Windows\System\IAcPwYO.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\PXmegor.exe
  C:\Windows\System\PXmegor.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\yjuBnuP.exe
  C:\Windows\System\yjuBnuP.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\wnLcsZT.exe
  C:\Windows\System\wnLcsZT.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\XkPFpRw.exe
  C:\Windows\System\XkPFpRw.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\tKJpYXb.exe
  C:\Windows\System\tKJpYXb.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\RZFxygO.exe
  C:\Windows\System\RZFxygO.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\rkOevcO.exe
  C:\Windows\System\rkOevcO.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\YtYRphe.exe
  C:\Windows\System\YtYRphe.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\ZyrVtZu.exe
  C:\Windows\System\ZyrVtZu.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\rqqtLhZ.exe
  C:\Windows\System\rqqtLhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\ptyUkdK.exe
  C:\Windows\System\ptyUkdK.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\uJXQLMY.exe
  C:\Windows\System\uJXQLMY.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\iPaoFci.exe
  C:\Windows\System\iPaoFci.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\ADVDgAv.exe
  C:\Windows\System\ADVDgAv.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\ThiYssh.exe
  C:\Windows\System\ThiYssh.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\MoFyhgV.exe
  C:\Windows\System\MoFyhgV.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\ZLVPLNf.exe
  C:\Windows\System\ZLVPLNf.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\EuxGGyW.exe
  C:\Windows\System\EuxGGyW.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\wzJmPCR.exe
  C:\Windows\System\wzJmPCR.exe
  2⤵
  PID:2924
- C:\Windows\System\wdiTELu.exe
  C:\Windows\System\wdiTELu.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\mxPIaUR.exe
  C:\Windows\System\mxPIaUR.exe
  2⤵
  PID:2392
- C:\Windows\System\XZGbwBv.exe
  C:\Windows\System\XZGbwBv.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\hYVKmhf.exe
  C:\Windows\System\hYVKmhf.exe
  2⤵
  PID:3060
- C:\Windows\System\mAbYcpu.exe
  C:\Windows\System\mAbYcpu.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\pQGAMxY.exe
  C:\Windows\System\pQGAMxY.exe
  2⤵
  PID:384
- C:\Windows\System\iyviKnm.exe
  C:\Windows\System\iyviKnm.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\FPdtYGn.exe
  C:\Windows\System\FPdtYGn.exe
  2⤵
  PID:1016
- C:\Windows\System\LMrnLcs.exe
  C:\Windows\System\LMrnLcs.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\UgluBcg.exe
  C:\Windows\System\UgluBcg.exe
  2⤵
  PID:644
- C:\Windows\System\yMVmlUv.exe
  C:\Windows\System\yMVmlUv.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\nbGhfmt.exe
  C:\Windows\System\nbGhfmt.exe
  2⤵
  PID:2364
- C:\Windows\System\vBgaJhQ.exe
  C:\Windows\System\vBgaJhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\geEzlZf.exe
  C:\Windows\System\geEzlZf.exe
  2⤵
  PID:2276
- C:\Windows\System\pslrvCq.exe
  C:\Windows\System\pslrvCq.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\GIRTgBY.exe
  C:\Windows\System\GIRTgBY.exe
  2⤵
  PID:2676
- C:\Windows\System\cSqNmAE.exe
  C:\Windows\System\cSqNmAE.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\oqtaGOx.exe
  C:\Windows\System\oqtaGOx.exe
  2⤵
  PID:1524
- C:\Windows\System\iSjNmCB.exe
  C:\Windows\System\iSjNmCB.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\SyxozyL.exe
  C:\Windows\System\SyxozyL.exe
  2⤵
  PID:2432
- C:\Windows\System\JJkPAWM.exe
  C:\Windows\System\JJkPAWM.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\HocYvtq.exe
  C:\Windows\System\HocYvtq.exe
  2⤵
  PID:1660
- C:\Windows\System\XMfhhNb.exe
  C:\Windows\System\XMfhhNb.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\bCgvGfB.exe
  C:\Windows\System\bCgvGfB.exe
  2⤵
  PID:2040
- C:\Windows\System\yFddbwE.exe
  C:\Windows\System\yFddbwE.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\JwVWBiD.exe
  C:\Windows\System\JwVWBiD.exe
  2⤵
  PID:2504
- C:\Windows\System\RBMqWFq.exe
  C:\Windows\System\RBMqWFq.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\GIxdAQT.exe
  C:\Windows\System\GIxdAQT.exe
  2⤵
  PID:2376
- C:\Windows\System\zfKqhKi.exe
  C:\Windows\System\zfKqhKi.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\giwFZMn.exe
  C:\Windows\System\giwFZMn.exe
  2⤵
  PID:1084
- C:\Windows\System\ZJOHtnl.exe
  C:\Windows\System\ZJOHtnl.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\GxAsPOF.exe
  C:\Windows\System\GxAsPOF.exe
  2⤵
  PID:1020
- C:\Windows\System\WJjXbfW.exe
  C:\Windows\System\WJjXbfW.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\rySGfXd.exe
  C:\Windows\System\rySGfXd.exe
  2⤵
  PID:2876
- C:\Windows\System\hWBlYeB.exe
  C:\Windows\System\hWBlYeB.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\UmTmLfV.exe
  C:\Windows\System\UmTmLfV.exe
  2⤵
  PID:3084
- C:\Windows\System\YXPsebN.exe
  C:\Windows\System\YXPsebN.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\EiynGQS.exe
  C:\Windows\System\EiynGQS.exe
  2⤵
  PID:3124
- C:\Windows\System\iNMpMsF.exe
  C:\Windows\System\iNMpMsF.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\hEuLsfn.exe
  C:\Windows\System\hEuLsfn.exe
  2⤵
  PID:3164
- C:\Windows\System\pFDDKMU.exe
  C:\Windows\System\pFDDKMU.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\lJgMEJT.exe
  C:\Windows\System\lJgMEJT.exe
  2⤵
  PID:3196
- C:\Windows\System\jvCxyxl.exe
  C:\Windows\System\jvCxyxl.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\JMQsTaQ.exe
  C:\Windows\System\JMQsTaQ.exe
  2⤵
  PID:3236
- C:\Windows\System\zEXpupZ.exe
  C:\Windows\System\zEXpupZ.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\dpxHRtA.exe
  C:\Windows\System\dpxHRtA.exe
  2⤵
  PID:3272
- C:\Windows\System\joiLgjo.exe
  C:\Windows\System\joiLgjo.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\HmRMLoO.exe
  C:\Windows\System\HmRMLoO.exe
  2⤵
  PID:3316
- C:\Windows\System\hqGpcqa.exe
  C:\Windows\System\hqGpcqa.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\tZZhHro.exe
  C:\Windows\System\tZZhHro.exe
  2⤵
  PID:3348
- C:\Windows\System\rFPZOJq.exe
  C:\Windows\System\rFPZOJq.exe
  2⤵
  PID:3364
- C:\Windows\System\kvxQfLK.exe
  C:\Windows\System\kvxQfLK.exe
  2⤵
  PID:3380
- C:\Windows\System\JvwdVgV.exe
  C:\Windows\System\JvwdVgV.exe
  2⤵
  PID:3396
- C:\Windows\System\vHBtzMG.exe
  C:\Windows\System\vHBtzMG.exe
  2⤵
  PID:3412
- C:\Windows\System\OXFCupb.exe
  C:\Windows\System\OXFCupb.exe
  2⤵
  PID:3428
- C:\Windows\System\vLbMSzy.exe
  C:\Windows\System\vLbMSzy.exe
  2⤵
  PID:3444
- C:\Windows\System\jwMEOJa.exe
  C:\Windows\System\jwMEOJa.exe
  2⤵
  PID:3460
- C:\Windows\System\nSRYcQy.exe
  C:\Windows\System\nSRYcQy.exe
  2⤵
  PID:3476
- C:\Windows\System\xAIFrBf.exe
  C:\Windows\System\xAIFrBf.exe
  2⤵
  PID:3492
- C:\Windows\System\ShZefgX.exe
  C:\Windows\System\ShZefgX.exe
  2⤵
  PID:3516
- C:\Windows\System\rjDAgmU.exe
  C:\Windows\System\rjDAgmU.exe
  2⤵
  PID:3532
- C:\Windows\System\MKIAqdh.exe
  C:\Windows\System\MKIAqdh.exe
  2⤵
  PID:3548
- C:\Windows\System\HZPwyDB.exe
  C:\Windows\System\HZPwyDB.exe
  2⤵
  PID:3572
- C:\Windows\System\INYHPgO.exe
  C:\Windows\System\INYHPgO.exe
  2⤵
  PID:3588
- C:\Windows\System\saqgJEp.exe
  C:\Windows\System\saqgJEp.exe
  2⤵
  PID:3608
- C:\Windows\System\kZwjojM.exe
  C:\Windows\System\kZwjojM.exe
  2⤵
  PID:3628
- C:\Windows\System\wPxuqew.exe
  C:\Windows\System\wPxuqew.exe
  2⤵
  PID:3648
- C:\Windows\System\AdVlhFo.exe
  C:\Windows\System\AdVlhFo.exe
  2⤵
  PID:3664
- C:\Windows\System\USoqThi.exe
  C:\Windows\System\USoqThi.exe
  2⤵
  PID:3684
- C:\Windows\System\tbcgolb.exe
  C:\Windows\System\tbcgolb.exe
  2⤵
  PID:3704
- C:\Windows\System\eYXWyLg.exe
  C:\Windows\System\eYXWyLg.exe
  2⤵
  PID:3724
- C:\Windows\System\MPuWftP.exe
  C:\Windows\System\MPuWftP.exe
  2⤵
  PID:3744
- C:\Windows\System\fjmppyA.exe
  C:\Windows\System\fjmppyA.exe
  2⤵
  PID:3760
- C:\Windows\System\btXHYXi.exe
  C:\Windows\System\btXHYXi.exe
  2⤵
  PID:3776
- C:\Windows\System\NcyVVfk.exe
  C:\Windows\System\NcyVVfk.exe
  2⤵
  PID:3800
- C:\Windows\System\DRdCPqn.exe
  C:\Windows\System\DRdCPqn.exe
  2⤵
  PID:3820
- C:\Windows\System\llwfPqJ.exe
  C:\Windows\System\llwfPqJ.exe
  2⤵
  PID:3836
- C:\Windows\System\mMOSGbH.exe
  C:\Windows\System\mMOSGbH.exe
  2⤵
  PID:3852
- C:\Windows\System\AfWIwOg.exe
  C:\Windows\System\AfWIwOg.exe
  2⤵
  PID:3872
- C:\Windows\System\qsTMkfn.exe
  C:\Windows\System\qsTMkfn.exe
  2⤵
  PID:3888
- C:\Windows\System\YshsvjI.exe
  C:\Windows\System\YshsvjI.exe
  2⤵
  PID:3904
- C:\Windows\System\XhutxLd.exe
  C:\Windows\System\XhutxLd.exe
  2⤵
  PID:3920
- C:\Windows\System\oWCMqQq.exe
  C:\Windows\System\oWCMqQq.exe
  2⤵
  PID:3936
- C:\Windows\System\lcAdKZs.exe
  C:\Windows\System\lcAdKZs.exe
  2⤵
  PID:3952
- C:\Windows\System\WBjpHHX.exe
  C:\Windows\System\WBjpHHX.exe
  2⤵
  PID:3968
- C:\Windows\System\nAdnnrQ.exe
  C:\Windows\System\nAdnnrQ.exe
  2⤵
  PID:4012
- C:\Windows\System\OhZHxio.exe
  C:\Windows\System\OhZHxio.exe
  2⤵
  PID:4028
- C:\Windows\System\AbHXHVT.exe
  C:\Windows\System\AbHXHVT.exe
  2⤵
  PID:4044
- C:\Windows\System\rpjyDqJ.exe
  C:\Windows\System\rpjyDqJ.exe
  2⤵
  PID:4060
- C:\Windows\System\OZIpGwf.exe
  C:\Windows\System\OZIpGwf.exe
  2⤵
  PID:4076
- C:\Windows\System\LYnWqQq.exe
  C:\Windows\System\LYnWqQq.exe
  2⤵
  PID:4092
- C:\Windows\System\xxmoDFQ.exe
  C:\Windows\System\xxmoDFQ.exe
  2⤵
  PID:1200
- C:\Windows\System\FGdUkdk.exe
  C:\Windows\System\FGdUkdk.exe
  2⤵
  PID:3004
- C:\Windows\System\KViDgCs.exe
  C:\Windows\System\KViDgCs.exe
  2⤵
  PID:3076
- C:\Windows\System\uSQcQkR.exe
  C:\Windows\System\uSQcQkR.exe
  2⤵
  PID:3120
- C:\Windows\System\PIrItra.exe
  C:\Windows\System\PIrItra.exe
  2⤵
  PID:3188
- C:\Windows\System\YJLiXnn.exe
  C:\Windows\System\YJLiXnn.exe
  2⤵
  PID:3264
- C:\Windows\System\VNpwIjz.exe
  C:\Windows\System\VNpwIjz.exe
  2⤵
  PID:2740
- C:\Windows\System\FrSgGzh.exe
  C:\Windows\System\FrSgGzh.exe
  2⤵
  PID:4036
- C:\Windows\System\BuoHczI.exe
  C:\Windows\System\BuoHczI.exe
  2⤵
  PID:2772
- C:\Windows\System\PSnAqHF.exe
  C:\Windows\System\PSnAqHF.exe
  2⤵
  PID:3156
- C:\Windows\System\mUdLFju.exe
  C:\Windows\System\mUdLFju.exe
  2⤵
  PID:3340
- C:\Windows\System\pUiftJz.exe
  C:\Windows\System\pUiftJz.exe
  2⤵
  PID:3376
- C:\Windows\System\OUAkaLy.exe
  C:\Windows\System\OUAkaLy.exe
  2⤵
  PID:3404
- C:\Windows\System\dVPVFgT.exe
  C:\Windows\System\dVPVFgT.exe
  2⤵
  PID:1964
- C:\Windows\System\aMiLcrm.exe
  C:\Windows\System\aMiLcrm.exe
  2⤵
  PID:344
- C:\Windows\System\vBxCtre.exe
  C:\Windows\System\vBxCtre.exe
  2⤵
  PID:3672
- C:\Windows\System\ZOtjkYC.exe
  C:\Windows\System\ZOtjkYC.exe
  2⤵
  PID:2600
- C:\Windows\System\LjQmYnV.exe
  C:\Windows\System\LjQmYnV.exe
  2⤵
  PID:2632
- C:\Windows\System\GQlHQAP.exe
  C:\Windows\System\GQlHQAP.exe
  2⤵
  PID:3500
- C:\Windows\System\AJQXLHf.exe
  C:\Windows\System\AJQXLHf.exe
  2⤵
  PID:276
- C:\Windows\System\vHXIFte.exe
  C:\Windows\System\vHXIFte.exe
  2⤵
  PID:1328
- C:\Windows\System\PCBrwhS.exe
  C:\Windows\System\PCBrwhS.exe
  2⤵
  PID:1864
- C:\Windows\System\XcoIFRG.exe
  C:\Windows\System\XcoIFRG.exe
  2⤵
  PID:2520
- C:\Windows\System\cUvsanS.exe
  C:\Windows\System\cUvsanS.exe
  2⤵
  PID:2984
- C:\Windows\System\BMBgcRs.exe
  C:\Windows\System\BMBgcRs.exe
  2⤵
  PID:1908
- C:\Windows\System\chmmuDV.exe
  C:\Windows\System\chmmuDV.exe
  2⤵
  PID:1836
- C:\Windows\System\lGCTiGC.exe
  C:\Windows\System\lGCTiGC.exe
  2⤵
  PID:2584
- C:\Windows\System\QJmJiJb.exe
  C:\Windows\System\QJmJiJb.exe
  2⤵
  PID:488
- C:\Windows\System\qfPEnyy.exe
  C:\Windows\System\qfPEnyy.exe
  2⤵
  PID:2972
- C:\Windows\System\hdUmCki.exe
  C:\Windows\System\hdUmCki.exe
  2⤵
  PID:3860
- C:\Windows\System\spwOaoi.exe
  C:\Windows\System\spwOaoi.exe
  2⤵
  PID:2388
- C:\Windows\System\YgXCRnb.exe
  C:\Windows\System\YgXCRnb.exe
  2⤵
  PID:920
- C:\Windows\System\qjZPfjv.exe
  C:\Windows\System\qjZPfjv.exe
  2⤵
  PID:1652
- C:\Windows\System\wgULLFB.exe
  C:\Windows\System\wgULLFB.exe
  2⤵
  PID:828
- C:\Windows\System\eHdzuUd.exe
  C:\Windows\System\eHdzuUd.exe
  2⤵
  PID:1688
- C:\Windows\System\GpSMPAG.exe
  C:\Windows\System\GpSMPAG.exe
  2⤵
  PID:2708
- C:\Windows\System\GSKRYnm.exe
  C:\Windows\System\GSKRYnm.exe
  2⤵
  PID:3252
- C:\Windows\System\fTaiMQE.exe
  C:\Windows\System\fTaiMQE.exe
  2⤵
  PID:3568
- C:\Windows\System\EwUapXh.exe
  C:\Windows\System\EwUapXh.exe
  2⤵
  PID:3636
- C:\Windows\System\XzfcBHX.exe
  C:\Windows\System\XzfcBHX.exe
  2⤵
  PID:3528
- C:\Windows\System\DUGlNwU.exe
  C:\Windows\System\DUGlNwU.exe
  2⤵
  PID:3456
- C:\Windows\System\wnvVlXD.exe
  C:\Windows\System\wnvVlXD.exe
  2⤵
  PID:3392
- C:\Windows\System\RwbnurU.exe
  C:\Windows\System\RwbnurU.exe
  2⤵
  PID:3328
- C:\Windows\System\lTwdYeJ.exe
  C:\Windows\System\lTwdYeJ.exe
  2⤵
  PID:3248
- C:\Windows\System\sHljlBH.exe
  C:\Windows\System\sHljlBH.exe
  2⤵
  PID:3172
- C:\Windows\System\vHJgBIz.exe
  C:\Windows\System\vHJgBIz.exe
  2⤵
  PID:3096
- C:\Windows\System\INkUKYR.exe
  C:\Windows\System\INkUKYR.exe
  2⤵
  PID:2080
- C:\Windows\System\xkttlnF.exe
  C:\Windows\System\xkttlnF.exe
  2⤵
  PID:1148
- C:\Windows\System\bAliJIo.exe
  C:\Windows\System\bAliJIo.exe
  2⤵
  PID:3620
- C:\Windows\System\csyxJhs.exe
  C:\Windows\System\csyxJhs.exe
  2⤵
  PID:2332
- C:\Windows\System\rwceuUK.exe
  C:\Windows\System\rwceuUK.exe
  2⤵
  PID:2448
- C:\Windows\System\jDAXhpF.exe
  C:\Windows\System\jDAXhpF.exe
  2⤵
  PID:2932
- C:\Windows\System\nLgKYOz.exe
  C:\Windows\System\nLgKYOz.exe
  2⤵
  PID:1444
- C:\Windows\System\veRNuuy.exe
  C:\Windows\System\veRNuuy.exe
  2⤵
  PID:836
- C:\Windows\System\gLqdzMZ.exe
  C:\Windows\System\gLqdzMZ.exe
  2⤵
  PID:3716
- C:\Windows\System\vBLIRTN.exe
  C:\Windows\System\vBLIRTN.exe
  2⤵
  PID:3784
- C:\Windows\System\kbgESXX.exe
  C:\Windows\System\kbgESXX.exe
  2⤵
  PID:3828
- C:\Windows\System\xQRERln.exe
  C:\Windows\System\xQRERln.exe
  2⤵
  PID:3928
- C:\Windows\System\LdLQJBR.exe
  C:\Windows\System\LdLQJBR.exe
  2⤵
  PID:3700
- C:\Windows\System\wMcsiTs.exe
  C:\Windows\System\wMcsiTs.exe
  2⤵
  PID:3736
- C:\Windows\System\KnsvxNW.exe
  C:\Windows\System\KnsvxNW.exe
  2⤵
  PID:4024
- C:\Windows\System\IDmCAfU.exe
  C:\Windows\System\IDmCAfU.exe
  2⤵
  PID:4088
- C:\Windows\System\RlBVuLj.exe
  C:\Windows\System\RlBVuLj.exe
  2⤵
  PID:3224
- C:\Windows\System\nFVtilb.exe
  C:\Windows\System\nFVtilb.exe
  2⤵
  PID:3556
- C:\Windows\System\IoEysKI.exe
  C:\Windows\System\IoEysKI.exe
  2⤵
  PID:3844
- C:\Windows\System\ZvDXbdW.exe
  C:\Windows\System\ZvDXbdW.exe
  2⤵
  PID:3912
- C:\Windows\System\syITdTv.exe
  C:\Windows\System\syITdTv.exe
  2⤵
  PID:1868
- C:\Windows\System\KxDAAET.exe
  C:\Windows\System\KxDAAET.exe
  2⤵
  PID:3948
- C:\Windows\System\qfMsDYf.exe
  C:\Windows\System\qfMsDYf.exe
  2⤵
  PID:2700
- C:\Windows\System\BNMsFbv.exe
  C:\Windows\System\BNMsFbv.exe
  2⤵
  PID:2628
- C:\Windows\System\wsbnFoW.exe
  C:\Windows\System\wsbnFoW.exe
  2⤵
  PID:3308
- C:\Windows\System\OepfNZu.exe
  C:\Windows\System\OepfNZu.exe
  2⤵
  PID:2596
- C:\Windows\System\SHxfzVZ.exe
  C:\Windows\System\SHxfzVZ.exe
  2⤵
  PID:3680
- C:\Windows\System\YJVlCLD.exe
  C:\Windows\System\YJVlCLD.exe
  2⤵
  PID:1640
- C:\Windows\System\PwUhSVx.exe
  C:\Windows\System\PwUhSVx.exe
  2⤵
  PID:1152
- C:\Windows\System\EvtLUqb.exe
  C:\Windows\System\EvtLUqb.exe
  2⤵
  PID:1260
- C:\Windows\System\VnBVFIk.exe
  C:\Windows\System\VnBVFIk.exe
  2⤵
  PID:2128
- C:\Windows\System\BJZqheu.exe
  C:\Windows\System\BJZqheu.exe
  2⤵
  PID:1528
- C:\Windows\System\gaubYKx.exe
  C:\Windows\System\gaubYKx.exe
  2⤵
  PID:2848
- C:\Windows\System\QWgQyVg.exe
  C:\Windows\System\QWgQyVg.exe
  2⤵
  PID:2312
- C:\Windows\System\lSgUuoC.exe
  C:\Windows\System\lSgUuoC.exe
  2⤵
  PID:3140
- C:\Windows\System\JWjAmLt.exe
  C:\Windows\System\JWjAmLt.exe
  2⤵
  PID:3488
- C:\Windows\System\TsicwPd.exe
  C:\Windows\System\TsicwPd.exe
  2⤵
  PID:3356
- C:\Windows\System\IcutftR.exe
  C:\Windows\System\IcutftR.exe
  2⤵
  PID:684
- C:\Windows\System\asXnvHC.exe
  C:\Windows\System\asXnvHC.exe
  2⤵
  PID:1804
- C:\Windows\System\QLdLmTa.exe
  C:\Windows\System\QLdLmTa.exe
  2⤵
  PID:3792
- C:\Windows\System\eBBgmjl.exe
  C:\Windows\System\eBBgmjl.exe
  2⤵
  PID:3772
- C:\Windows\System\KriYJmn.exe
  C:\Windows\System\KriYJmn.exe
  2⤵
  PID:3812
- C:\Windows\System\GVOGkvl.exe
  C:\Windows\System\GVOGkvl.exe
  2⤵
  PID:4140
- C:\Windows\System\UtgTiYB.exe
  C:\Windows\System\UtgTiYB.exe
  2⤵
  PID:4160
- C:\Windows\System\GmZYDfY.exe
  C:\Windows\System\GmZYDfY.exe
  2⤵
  PID:4176
- C:\Windows\System\KEzXITL.exe
  C:\Windows\System\KEzXITL.exe
  2⤵
  PID:4192
- C:\Windows\System\sHZYgaH.exe
  C:\Windows\System\sHZYgaH.exe
  2⤵
  PID:4208
- C:\Windows\System\aTOGYDl.exe
  C:\Windows\System\aTOGYDl.exe
  2⤵
  PID:4224
- C:\Windows\System\oLYDoiK.exe
  C:\Windows\System\oLYDoiK.exe
  2⤵
  PID:4244
- C:\Windows\System\QboEnuQ.exe
  C:\Windows\System\QboEnuQ.exe
  2⤵
  PID:4264
- C:\Windows\System\AiRNQSq.exe
  C:\Windows\System\AiRNQSq.exe
  2⤵
  PID:4288
- C:\Windows\System\DObdGeB.exe
  C:\Windows\System\DObdGeB.exe
  2⤵
  PID:4312
- C:\Windows\System\MYZEbaM.exe
  C:\Windows\System\MYZEbaM.exe
  2⤵
  PID:4328
- C:\Windows\System\AiFLazF.exe
  C:\Windows\System\AiFLazF.exe
  2⤵
  PID:4344
- C:\Windows\System\iiurjLA.exe
  C:\Windows\System\iiurjLA.exe
  2⤵
  PID:4360
- C:\Windows\System\WjErJDh.exe
  C:\Windows\System\WjErJDh.exe
  2⤵
  PID:4400
- C:\Windows\System\aSbFltC.exe
  C:\Windows\System\aSbFltC.exe
  2⤵
  PID:4436
- C:\Windows\System\TeULbaO.exe
  C:\Windows\System\TeULbaO.exe
  2⤵
  PID:4452
- C:\Windows\System\dwcUaPy.exe
  C:\Windows\System\dwcUaPy.exe
  2⤵
  PID:4468
- C:\Windows\System\ifdofms.exe
  C:\Windows\System\ifdofms.exe
  2⤵
  PID:4484
- C:\Windows\System\gGTgJFM.exe
  C:\Windows\System\gGTgJFM.exe
  2⤵
  PID:4500
- C:\Windows\System\vkdekYx.exe
  C:\Windows\System\vkdekYx.exe
  2⤵
  PID:4516
- C:\Windows\System\BBUAPHB.exe
  C:\Windows\System\BBUAPHB.exe
  2⤵
  PID:4532
- C:\Windows\System\LsEyiIc.exe
  C:\Windows\System\LsEyiIc.exe
  2⤵
  PID:4548
- C:\Windows\System\ztvqgyB.exe
  C:\Windows\System\ztvqgyB.exe
  2⤵
  PID:4564
- C:\Windows\System\fjycFBI.exe
  C:\Windows\System\fjycFBI.exe
  2⤵
  PID:4580
- C:\Windows\System\LsZMkCo.exe
  C:\Windows\System\LsZMkCo.exe
  2⤵
  PID:4596
- C:\Windows\System\JxrffNv.exe
  C:\Windows\System\JxrffNv.exe
  2⤵
  PID:4612
- C:\Windows\System\QZftjwM.exe
  C:\Windows\System\QZftjwM.exe
  2⤵
  PID:4628
- C:\Windows\System\hcrgBsY.exe
  C:\Windows\System\hcrgBsY.exe
  2⤵
  PID:4644
- C:\Windows\System\mdXEgGf.exe
  C:\Windows\System\mdXEgGf.exe
  2⤵
  PID:4660
- C:\Windows\System\KBhYTAq.exe
  C:\Windows\System\KBhYTAq.exe
  2⤵
  PID:4680
- C:\Windows\System\msIFQbi.exe
  C:\Windows\System\msIFQbi.exe
  2⤵
  PID:4696
- C:\Windows\System\ITfkEOE.exe
  C:\Windows\System\ITfkEOE.exe
  2⤵
  PID:4712
- C:\Windows\System\WfhBIci.exe
  C:\Windows\System\WfhBIci.exe
  2⤵
  PID:4728
- C:\Windows\System\GSOrDIA.exe
  C:\Windows\System\GSOrDIA.exe
  2⤵
  PID:4744
- C:\Windows\System\qLSrBuU.exe
  C:\Windows\System\qLSrBuU.exe
  2⤵
  PID:4760
- C:\Windows\System\xDnOtLn.exe
  C:\Windows\System\xDnOtLn.exe
  2⤵
  PID:4776
- C:\Windows\System\mTjfCOt.exe
  C:\Windows\System\mTjfCOt.exe
  2⤵
  PID:4792
- C:\Windows\System\hRCjrfu.exe
  C:\Windows\System\hRCjrfu.exe
  2⤵
  PID:4808
- C:\Windows\System\ZEhkmsE.exe
  C:\Windows\System\ZEhkmsE.exe
  2⤵
  PID:4824
- C:\Windows\System\UOpdKOU.exe
  C:\Windows\System\UOpdKOU.exe
  2⤵
  PID:4840
- C:\Windows\System\HTbhLqu.exe
  C:\Windows\System\HTbhLqu.exe
  2⤵
  PID:4856
- C:\Windows\System\SQICeSV.exe
  C:\Windows\System\SQICeSV.exe
  2⤵
  PID:4872
- C:\Windows\System\OhfNQKh.exe
  C:\Windows\System\OhfNQKh.exe
  2⤵
  PID:4892
- C:\Windows\System\DBrNSfw.exe
  C:\Windows\System\DBrNSfw.exe
  2⤵
  PID:4908
- C:\Windows\System\WdMoFTQ.exe
  C:\Windows\System\WdMoFTQ.exe
  2⤵
  PID:4924
- C:\Windows\System\mjVoAOx.exe
  C:\Windows\System\mjVoAOx.exe
  2⤵
  PID:4940
- C:\Windows\System\wmLmpOZ.exe
  C:\Windows\System\wmLmpOZ.exe
  2⤵
  PID:4956
- C:\Windows\System\lJDyuUL.exe
  C:\Windows\System\lJDyuUL.exe
  2⤵
  PID:4972
- C:\Windows\System\iGXMnvx.exe
  C:\Windows\System\iGXMnvx.exe
  2⤵
  PID:4988
- C:\Windows\System\CTiSWtc.exe
  C:\Windows\System\CTiSWtc.exe
  2⤵
  PID:5004
- C:\Windows\System\IwoAgPu.exe
  C:\Windows\System\IwoAgPu.exe
  2⤵
  PID:5020
- C:\Windows\System\jsIdICm.exe
  C:\Windows\System\jsIdICm.exe
  2⤵
  PID:5036
- C:\Windows\System\FFhTyyQ.exe
  C:\Windows\System\FFhTyyQ.exe
  2⤵
  PID:5052
- C:\Windows\System\BrjRrIe.exe
  C:\Windows\System\BrjRrIe.exe
  2⤵
  PID:5068
- C:\Windows\System\PudSkfN.exe
  C:\Windows\System\PudSkfN.exe
  2⤵
  PID:5084
- C:\Windows\System\qHheMNz.exe
  C:\Windows\System\qHheMNz.exe
  2⤵
  PID:5100
- C:\Windows\System\tnePmXV.exe
  C:\Windows\System\tnePmXV.exe
  2⤵
  PID:608
- C:\Windows\System\FDuBbDj.exe
  C:\Windows\System\FDuBbDj.exe
  2⤵
  PID:1856
- C:\Windows\System\cWzMyYm.exe
  C:\Windows\System\cWzMyYm.exe
  2⤵
  PID:1960
- C:\Windows\System\pUVJdPW.exe
  C:\Windows\System\pUVJdPW.exe
  2⤵
  PID:1596
- C:\Windows\System\uPJvYRH.exe
  C:\Windows\System\uPJvYRH.exe
  2⤵
  PID:3208
- C:\Windows\System\tVONOxb.exe
  C:\Windows\System\tVONOxb.exe
  2⤵
  PID:1760
- C:\Windows\System\LeJsAmw.exe
  C:\Windows\System\LeJsAmw.exe
  2⤵
  PID:1976
- C:\Windows\System\BxwIvvU.exe
  C:\Windows\System\BxwIvvU.exe
  2⤵
  PID:4112
- C:\Windows\System\icLOBPB.exe
  C:\Windows\System\icLOBPB.exe
  2⤵
  PID:4128
- C:\Windows\System\RVLQZaz.exe
  C:\Windows\System\RVLQZaz.exe
  2⤵
  PID:4172
- C:\Windows\System\ragmlst.exe
  C:\Windows\System\ragmlst.exe
  2⤵
  PID:5136
- C:\Windows\System\vlkDchQ.exe
  C:\Windows\System\vlkDchQ.exe
  2⤵
  PID:5156
- C:\Windows\System\WqGQtwE.exe
  C:\Windows\System\WqGQtwE.exe
  2⤵
  PID:5176
- C:\Windows\System\uxAkAQu.exe
  C:\Windows\System\uxAkAQu.exe
  2⤵
  PID:5192
- C:\Windows\System\UnAcuBU.exe
  C:\Windows\System\UnAcuBU.exe
  2⤵
  PID:5208
- C:\Windows\System\rBHFgim.exe
  C:\Windows\System\rBHFgim.exe
  2⤵
  PID:5224
- C:\Windows\System\zTeOovc.exe
  C:\Windows\System\zTeOovc.exe
  2⤵
  PID:5240
- C:\Windows\System\fqhMkoX.exe
  C:\Windows\System\fqhMkoX.exe
  2⤵
  PID:5256
- C:\Windows\System\CzbLbsN.exe
  C:\Windows\System\CzbLbsN.exe
  2⤵
  PID:5272
- C:\Windows\System\qkRUHCE.exe
  C:\Windows\System\qkRUHCE.exe
  2⤵
  PID:5288
- C:\Windows\System\PiaJbkh.exe
  C:\Windows\System\PiaJbkh.exe
  2⤵
  PID:5304
- C:\Windows\System\hrVizek.exe
  C:\Windows\System\hrVizek.exe
  2⤵
  PID:5320
- C:\Windows\System\yrJYKQH.exe
  C:\Windows\System\yrJYKQH.exe
  2⤵
  PID:5336
- C:\Windows\System\BQriwpZ.exe
  C:\Windows\System\BQriwpZ.exe
  2⤵
  PID:5352
- C:\Windows\System\TtGBOQE.exe
  C:\Windows\System\TtGBOQE.exe
  2⤵
  PID:5368
- C:\Windows\System\BjRzQev.exe
  C:\Windows\System\BjRzQev.exe
  2⤵
  PID:5384
- C:\Windows\System\DJHzGei.exe
  C:\Windows\System\DJHzGei.exe
  2⤵
  PID:5408
- C:\Windows\System\aVDyFGL.exe
  C:\Windows\System\aVDyFGL.exe
  2⤵
  PID:5424
- C:\Windows\System\tPkZphG.exe
  C:\Windows\System\tPkZphG.exe
  2⤵
  PID:5440
- C:\Windows\System\rmcuxvw.exe
  C:\Windows\System\rmcuxvw.exe
  2⤵
  PID:5456
- C:\Windows\System\HPlrBJy.exe
  C:\Windows\System\HPlrBJy.exe
  2⤵
  PID:5472
- C:\Windows\System\KtPcwjH.exe
  C:\Windows\System\KtPcwjH.exe
  2⤵
  PID:5516
- C:\Windows\System\uCOxhzC.exe
  C:\Windows\System\uCOxhzC.exe
  2⤵
  PID:5532
- C:\Windows\System\syrgICu.exe
  C:\Windows\System\syrgICu.exe
  2⤵
  PID:5552
- C:\Windows\System\MbieqPQ.exe
  C:\Windows\System\MbieqPQ.exe
  2⤵
  PID:5604
- C:\Windows\System\vTqHypW.exe
  C:\Windows\System\vTqHypW.exe
  2⤵
  PID:5620
- C:\Windows\System\jqhKAQo.exe
  C:\Windows\System\jqhKAQo.exe
  2⤵
  PID:5636
- C:\Windows\System\ZijWGxh.exe
  C:\Windows\System\ZijWGxh.exe
  2⤵
  PID:5652
- C:\Windows\System\KESRFLk.exe
  C:\Windows\System\KESRFLk.exe
  2⤵
  PID:5676
- C:\Windows\System\KYmsLbo.exe
  C:\Windows\System\KYmsLbo.exe
  2⤵
  PID:5692
- C:\Windows\System\QgykMYq.exe
  C:\Windows\System\QgykMYq.exe
  2⤵
  PID:5708
- C:\Windows\System\JjZmUdd.exe
  C:\Windows\System\JjZmUdd.exe
  2⤵
  PID:5724
- C:\Windows\System\BDmAOBS.exe
  C:\Windows\System\BDmAOBS.exe
  2⤵
  PID:5740
- C:\Windows\System\nILTpbc.exe
  C:\Windows\System\nILTpbc.exe
  2⤵
  PID:5756
- C:\Windows\System\UdKbqUR.exe
  C:\Windows\System\UdKbqUR.exe
  2⤵
  PID:5772
- C:\Windows\System\RETujaj.exe
  C:\Windows\System\RETujaj.exe
  2⤵
  PID:5788
- C:\Windows\System\DfYzZZW.exe
  C:\Windows\System\DfYzZZW.exe
  2⤵
  PID:5804
- C:\Windows\System\bikZVtK.exe
  C:\Windows\System\bikZVtK.exe
  2⤵
  PID:5824
- C:\Windows\System\BcujHJr.exe
  C:\Windows\System\BcujHJr.exe
  2⤵
  PID:5840
- C:\Windows\System\dobEoAF.exe
  C:\Windows\System\dobEoAF.exe
  2⤵
  PID:5856
- C:\Windows\System\IQDaslW.exe
  C:\Windows\System\IQDaslW.exe
  2⤵
  PID:5872
- C:\Windows\System\bVjRtxI.exe
  C:\Windows\System\bVjRtxI.exe
  2⤵
  PID:5888
- C:\Windows\System\xqjISvH.exe
  C:\Windows\System\xqjISvH.exe
  2⤵
  PID:5904
- C:\Windows\System\DqoOxkG.exe
  C:\Windows\System\DqoOxkG.exe
  2⤵
  PID:5920
- C:\Windows\System\eXtZuNx.exe
  C:\Windows\System\eXtZuNx.exe
  2⤵
  PID:5936
- C:\Windows\System\SnzRclF.exe
  C:\Windows\System\SnzRclF.exe
  2⤵
  PID:5952
- C:\Windows\System\iuhIaoL.exe
  C:\Windows\System\iuhIaoL.exe
  2⤵
  PID:5968
- C:\Windows\System\urejdLr.exe
  C:\Windows\System\urejdLr.exe
  2⤵
  PID:5984
- C:\Windows\System\VecWnUB.exe
  C:\Windows\System\VecWnUB.exe
  2⤵
  PID:6024
- C:\Windows\System\NLohetc.exe
  C:\Windows\System\NLohetc.exe
  2⤵
  PID:6040
- C:\Windows\System\wiTkAVw.exe
  C:\Windows\System\wiTkAVw.exe
  2⤵
  PID:6060
- C:\Windows\System\QxxODBG.exe
  C:\Windows\System\QxxODBG.exe
  2⤵
  PID:6076
- C:\Windows\System\EfSdzVe.exe
  C:\Windows\System\EfSdzVe.exe
  2⤵
  PID:4428
- C:\Windows\System\HDorhrq.exe
  C:\Windows\System\HDorhrq.exe
  2⤵
  PID:4920
- C:\Windows\System\IZKpEyb.exe
  C:\Windows\System\IZKpEyb.exe
  2⤵
  PID:5012
- C:\Windows\System\CwLbARd.exe
  C:\Windows\System\CwLbARd.exe
  2⤵
  PID:5080
- C:\Windows\System\koROKxh.exe
  C:\Windows\System\koROKxh.exe
  2⤵
  PID:2480
- C:\Windows\System\wNMXBwF.exe
  C:\Windows\System\wNMXBwF.exe
  2⤵
  PID:3420
- C:\Windows\System\DKCgGCU.exe
  C:\Windows\System\DKCgGCU.exe
  2⤵
  PID:3692
- C:\Windows\System\ZAXaLVk.exe
  C:\Windows\System\ZAXaLVk.exe
  2⤵
  PID:3896
- C:\Windows\System\iZnIVTg.exe
  C:\Windows\System\iZnIVTg.exe
  2⤵
  PID:3880
- C:\Windows\System\jRwUikq.exe
  C:\Windows\System\jRwUikq.exe
  2⤵
  PID:328
- C:\Windows\System\eUUcDLr.exe
  C:\Windows\System\eUUcDLr.exe
  2⤵
  PID:2336
- C:\Windows\System\BLKNYRI.exe
  C:\Windows\System\BLKNYRI.exe
  2⤵
  PID:892
- C:\Windows\System\nwzKhnw.exe
  C:\Windows\System\nwzKhnw.exe
  2⤵
  PID:2232
- C:\Windows\System\UCLQFZM.exe
  C:\Windows\System\UCLQFZM.exe
  2⤵
  PID:4296
- C:\Windows\System\rMulFuL.exe
  C:\Windows\System\rMulFuL.exe
  2⤵
  PID:2968
- C:\Windows\System\qprtJFO.exe
  C:\Windows\System\qprtJFO.exe
  2⤵
  PID:4376
- C:\Windows\System\DHeVXga.exe
  C:\Windows\System\DHeVXga.exe
  2⤵
  PID:4444
- C:\Windows\System\WTyTdTU.exe
  C:\Windows\System\WTyTdTU.exe
  2⤵
  PID:4540
- C:\Windows\System\ZUTlJbg.exe
  C:\Windows\System\ZUTlJbg.exe
  2⤵
  PID:4604
- C:\Windows\System\UVGLeLR.exe
  C:\Windows\System\UVGLeLR.exe
  2⤵
  PID:2640
- C:\Windows\System\bnNtEEJ.exe
  C:\Windows\System\bnNtEEJ.exe
  2⤵
  PID:2672
- C:\Windows\System\UcliVIE.exe
  C:\Windows\System\UcliVIE.exe
  2⤵
  PID:5568
- C:\Windows\System\SkHniyc.exe
  C:\Windows\System\SkHniyc.exe
  2⤵
  PID:5584
- C:\Windows\System\LsEHKTq.exe
  C:\Windows\System\LsEHKTq.exe
  2⤵
  PID:5600
- C:\Windows\System\vEBbJjh.exe
  C:\Windows\System\vEBbJjh.exe
  2⤵
  PID:2796
- C:\Windows\System\JOxZZeq.exe
  C:\Windows\System\JOxZZeq.exe
  2⤵
  PID:5832
- C:\Windows\System\BLpXnJb.exe
  C:\Windows\System\BLpXnJb.exe
  2⤵
  PID:5800
- C:\Windows\System\hJpGxEm.exe
  C:\Windows\System\hJpGxEm.exe
  2⤵
  PID:1824
- C:\Windows\System\pRsUcab.exe
  C:\Windows\System\pRsUcab.exe
  2⤵
  PID:5928
- C:\Windows\System\AAJbzKM.exe
  C:\Windows\System\AAJbzKM.exe
  2⤵
  PID:5060
- C:\Windows\System\SbQDGZF.exe
  C:\Windows\System\SbQDGZF.exe
  2⤵
  PID:1216
- C:\Windows\System\WlxwWKb.exe
  C:\Windows\System\WlxwWKb.exe
  2⤵
  PID:4136
- C:\Windows\System\JVWUqNn.exe
  C:\Windows\System\JVWUqNn.exe
  2⤵
  PID:5188
- C:\Windows\System\rSJEjzC.exe
  C:\Windows\System\rSJEjzC.exe
  2⤵
  PID:5280
- C:\Windows\System\NcgTLoL.exe
  C:\Windows\System\NcgTLoL.exe
  2⤵
  PID:5380
- C:\Windows\System\wzZyNgS.exe
  C:\Windows\System\wzZyNgS.exe
  2⤵
  PID:3512
- C:\Windows\System\sqPJqNC.exe
  C:\Windows\System\sqPJqNC.exe
  2⤵
  PID:324
- C:\Windows\System\RfBkUSe.exe
  C:\Windows\System\RfBkUSe.exe
  2⤵
  PID:6012
- C:\Windows\System\yPBMLme.exe
  C:\Windows\System\yPBMLme.exe
  2⤵
  PID:4252
- C:\Windows\System\zPgFmpj.exe
  C:\Windows\System\zPgFmpj.exe
  2⤵
  PID:4380
- C:\Windows\System\nzVuOEK.exe
  C:\Windows\System\nzVuOEK.exe
  2⤵
  PID:272
- C:\Windows\System\yJkMJNY.exe
  C:\Windows\System\yJkMJNY.exe
  2⤵
  PID:4768
- C:\Windows\System\qfVKmYa.exe
  C:\Windows\System\qfVKmYa.exe
  2⤵
  PID:4804
- C:\Windows\System\VPbRtWD.exe
  C:\Windows\System\VPbRtWD.exe
  2⤵
  PID:4900
- C:\Windows\System\zXSYZMP.exe
  C:\Windows\System\zXSYZMP.exe
  2⤵
  PID:4168
- C:\Windows\System\jSwOjBL.exe
  C:\Windows\System\jSwOjBL.exe
  2⤵
  PID:5220
- C:\Windows\System\bSLAWXe.exe
  C:\Windows\System\bSLAWXe.exe
  2⤵
  PID:5452
- C:\Windows\System\tpoYpJb.exe
  C:\Windows\System\tpoYpJb.exe
  2⤵
  PID:5488
- C:\Windows\System\uQpjMbs.exe
  C:\Windows\System\uQpjMbs.exe
  2⤵
  PID:5504
- C:\Windows\System\YZlFMBV.exe
  C:\Windows\System\YZlFMBV.exe
  2⤵
  PID:5616
- C:\Windows\System\jmiHVLe.exe
  C:\Windows\System\jmiHVLe.exe
  2⤵
  PID:5716
- C:\Windows\System\NGxbaji.exe
  C:\Windows\System\NGxbaji.exe
  2⤵
  PID:5780
- C:\Windows\System\BkbEmrN.exe
  C:\Windows\System\BkbEmrN.exe
  2⤵
  PID:5812
- C:\Windows\System\KrEDany.exe
  C:\Windows\System\KrEDany.exe
  2⤵
  PID:6084
- C:\Windows\System\AuIUHLW.exe
  C:\Windows\System\AuIUHLW.exe
  2⤵
  PID:4676
- C:\Windows\System\bmuivJV.exe
  C:\Windows\System\bmuivJV.exe
  2⤵
  PID:5816
- C:\Windows\System\yXLxFSN.exe
  C:\Windows\System\yXLxFSN.exe
  2⤵
  PID:5884
- C:\Windows\System\VkPohar.exe
  C:\Windows\System\VkPohar.exe
  2⤵
  PID:5948
- C:\Windows\System\VudaJso.exe
  C:\Windows\System\VudaJso.exe
  2⤵
  PID:4740
- C:\Windows\System\zXZEkTW.exe
  C:\Windows\System\zXZEkTW.exe
  2⤵
  PID:5416
- C:\Windows\System\dYJaUbg.exe
  C:\Windows\System\dYJaUbg.exe
  2⤵
  PID:6124
- C:\Windows\System\rutPdTY.exe
  C:\Windows\System\rutPdTY.exe
  2⤵
  PID:6136
- C:\Windows\System\jCrdRRZ.exe
  C:\Windows\System\jCrdRRZ.exe
  2⤵
  PID:4412
- C:\Windows\System\bZAlxBw.exe
  C:\Windows\System\bZAlxBw.exe
  2⤵
  PID:6072
- C:\Windows\System\LGSJCrr.exe
  C:\Windows\System\LGSJCrr.exe
  2⤵
  PID:1432
- C:\Windows\System\dhadaNq.exe
  C:\Windows\System\dhadaNq.exe
  2⤵
  PID:1980
- C:\Windows\System\TkmsXIL.exe
  C:\Windows\System\TkmsXIL.exe
  2⤵
  PID:4464
- C:\Windows\System\BfmhRfT.exe
  C:\Windows\System\BfmhRfT.exe
  2⤵
  PID:4528
- C:\Windows\System\EsnyjlD.exe
  C:\Windows\System\EsnyjlD.exe
  2⤵
  PID:4720
- C:\Windows\System\EPoPfhT.exe
  C:\Windows\System\EPoPfhT.exe
  2⤵
  PID:4980
- C:\Windows\System\aAikGTm.exe
  C:\Windows\System\aAikGTm.exe
  2⤵
  PID:2456
- C:\Windows\System\OMtMidL.exe
  C:\Windows\System\OMtMidL.exe
  2⤵
  PID:940
- C:\Windows\System\KgslFIR.exe
  C:\Windows\System\KgslFIR.exe
  2⤵
  PID:336
- C:\Windows\System\RhmYsTF.exe
  C:\Windows\System\RhmYsTF.exe
  2⤵
  PID:2472
- C:\Windows\System\hdzpfCA.exe
  C:\Windows\System\hdzpfCA.exe
  2⤵
  PID:1312
- C:\Windows\System\ZhzeXJv.exe
  C:\Windows\System\ZhzeXJv.exe
  2⤵
  PID:1732
- C:\Windows\System\PXoVLWy.exe
  C:\Windows\System\PXoVLWy.exe
  2⤵
  PID:4124
- C:\Windows\System\JxCcshP.exe
  C:\Windows\System\JxCcshP.exe
  2⤵
  PID:4236
- C:\Windows\System\NNklVWe.exe
  C:\Windows\System\NNklVWe.exe
  2⤵
  PID:4272
- C:\Windows\System\SCqDMRB.exe
  C:\Windows\System\SCqDMRB.exe
  2⤵
  PID:4324
- C:\Windows\System\rOerkBI.exe
  C:\Windows\System\rOerkBI.exe
  2⤵
  PID:2592
- C:\Windows\System\IfvVyCP.exe
  C:\Windows\System\IfvVyCP.exe
  2⤵
  PID:5168
- C:\Windows\System\PKSSALn.exe
  C:\Windows\System\PKSSALn.exe
  2⤵
  PID:5232
- C:\Windows\System\oQdKvSX.exe
  C:\Windows\System\oQdKvSX.exe
  2⤵
  PID:5296
- C:\Windows\System\UQvlaEH.exe
  C:\Windows\System\UQvlaEH.exe
  2⤵
  PID:5364
- C:\Windows\System\FUDTVFg.exe
  C:\Windows\System\FUDTVFg.exe
  2⤵
  PID:5432
- C:\Windows\System\fiMqNmL.exe
  C:\Windows\System\fiMqNmL.exe
  2⤵
  PID:1416
- C:\Windows\System\VLfKgAz.exe
  C:\Windows\System\VLfKgAz.exe
  2⤵
  PID:1628
- C:\Windows\System\tvwKBIE.exe
  C:\Windows\System\tvwKBIE.exe
  2⤵
  PID:1420
- C:\Windows\System\GXFFqoW.exe
  C:\Windows\System\GXFFqoW.exe
  2⤵
  PID:2704
- C:\Windows\System\PTYIdcq.exe
  C:\Windows\System\PTYIdcq.exe
  2⤵
  PID:3288
- C:\Windows\System\EnqFeyx.exe
  C:\Windows\System\EnqFeyx.exe
  2⤵
  PID:2576
- C:\Windows\System\HPVbouX.exe
  C:\Windows\System\HPVbouX.exe
  2⤵
  PID:3280
- C:\Windows\System\NMQqEes.exe
  C:\Windows\System\NMQqEes.exe
  2⤵
  PID:3144
- C:\Windows\System\QDqojqo.exe
  C:\Windows\System\QDqojqo.exe
  2⤵
  PID:2828
- C:\Windows\System\xNHUEgQ.exe
  C:\Windows\System\xNHUEgQ.exe
  2⤵
  PID:3740
- C:\Windows\System\dVJuzvY.exe
  C:\Windows\System\dVJuzvY.exe
  2⤵
  PID:4084
- C:\Windows\System\izLcykW.exe
  C:\Windows\System\izLcykW.exe
  2⤵
  PID:2844
- C:\Windows\System\AczUbfT.exe
  C:\Windows\System\AczUbfT.exe
  2⤵
  PID:572
- C:\Windows\System\eeuUVvX.exe
  C:\Windows\System\eeuUVvX.exe
  2⤵
  PID:5128
- C:\Windows\System\wGLGcfL.exe
  C:\Windows\System\wGLGcfL.exe
  2⤵
  PID:4188
- C:\Windows\System\GPyUhhZ.exe
  C:\Windows\System\GPyUhhZ.exe
  2⤵
  PID:2412
- C:\Windows\System\GeIvlyw.exe
  C:\Windows\System\GeIvlyw.exe
  2⤵
  PID:4396
- C:\Windows\System\RWLXnRg.exe
  C:\Windows\System\RWLXnRg.exe
  2⤵
  PID:4220
- C:\Windows\System\KlgKjCh.exe
  C:\Windows\System\KlgKjCh.exe
  2⤵
  PID:4508
- C:\Windows\System\IMUgbVh.exe
  C:\Windows\System\IMUgbVh.exe
  2⤵
  PID:5580
- C:\Windows\System\bnzFJKk.exe
  C:\Windows\System\bnzFJKk.exe
  2⤵
  PID:5592
- C:\Windows\System\qOXACVq.exe
  C:\Windows\System\qOXACVq.exe
  2⤵
  PID:5864
- C:\Windows\System\dFiSKKC.exe
  C:\Windows\System\dFiSKKC.exe
  2⤵
  PID:4736
- C:\Windows\System\sFhrXil.exe
  C:\Windows\System\sFhrXil.exe
  2⤵
  PID:6000
- C:\Windows\System\sPDcSLz.exe
  C:\Windows\System\sPDcSLz.exe
  2⤵
  PID:2136
- C:\Windows\System\VWZLFOZ.exe
  C:\Windows\System\VWZLFOZ.exe
  2⤵
  PID:3108
- C:\Windows\System\PBxqrfq.exe
  C:\Windows\System\PBxqrfq.exe
  2⤵
  PID:4968
- C:\Windows\System\OTBJbuI.exe
  C:\Windows\System\OTBJbuI.exe
  2⤵
  PID:5032
- C:\Windows\System\QVOtQId.exe
  C:\Windows\System\QVOtQId.exe
  2⤵
  PID:5252
- C:\Windows\System\vkCOXIO.exe
  C:\Windows\System\vkCOXIO.exe
  2⤵
  PID:5348
- C:\Windows\System\NKolhZf.exe
  C:\Windows\System\NKolhZf.exe
  2⤵
  PID:5484
- C:\Windows\System\lmhTZnv.exe
  C:\Windows\System\lmhTZnv.exe
  2⤵
  PID:3660
- C:\Windows\System\SVzsXFV.exe
  C:\Windows\System\SVzsXFV.exe
  2⤵
  PID:1672
- C:\Windows\System\DbWonpz.exe
  C:\Windows\System\DbWonpz.exe
  2⤵
  PID:4304
- C:\Windows\System\wSnQhLu.exe
  C:\Windows\System\wSnQhLu.exe
  2⤵
  PID:4800
- C:\Windows\System\ZxQjKcn.exe
  C:\Windows\System\ZxQjKcn.exe
  2⤵
  PID:4368
- C:\Windows\System\VoouLso.exe
  C:\Windows\System\VoouLso.exe
  2⤵
  PID:2468
- C:\Windows\System\qzCKvAa.exe
  C:\Windows\System\qzCKvAa.exe
  2⤵
  PID:1572
- C:\Windows\System\NMDVDWh.exe
  C:\Windows\System\NMDVDWh.exe
  2⤵
  PID:5312
- C:\Windows\System\EiTgCgz.exe
  C:\Windows\System\EiTgCgz.exe
  2⤵
  PID:5376
- C:\Windows\System\laDbOCe.exe
  C:\Windows\System\laDbOCe.exe
  2⤵
  PID:6088
- C:\Windows\System\aKAaotU.exe
  C:\Windows\System\aKAaotU.exe
  2⤵
  PID:5880
- C:\Windows\System\LcogJTp.exe
  C:\Windows\System\LcogJTp.exe
  2⤵
  PID:6116
- C:\Windows\System\YvPjiwz.exe
  C:\Windows\System\YvPjiwz.exe
  2⤵
  PID:5540
- C:\Windows\System\RMKCQJq.exe
  C:\Windows\System\RMKCQJq.exe
  2⤵
  PID:5820
- C:\Windows\System\CycndfK.exe
  C:\Windows\System\CycndfK.exe
  2⤵
  PID:4448
- C:\Windows\System\YtPImoU.exe
  C:\Windows\System\YtPImoU.exe
  2⤵
  PID:4460
- C:\Windows\System\ryFOCsX.exe
  C:\Windows\System\ryFOCsX.exe
  2⤵
  PID:6036
- C:\Windows\System\HFIkndp.exe
  C:\Windows\System\HFIkndp.exe
  2⤵
  PID:6068
- C:\Windows\System\RBIduIF.exe
  C:\Windows\System\RBIduIF.exe
  2⤵
  PID:1740
- C:\Windows\System\AmcliPW.exe
  C:\Windows\System\AmcliPW.exe
  2⤵
  PID:4656
- C:\Windows\System\uMYhVzo.exe
  C:\Windows\System\uMYhVzo.exe
  2⤵
  PID:4588
- C:\Windows\System\UTWfFAr.exe
  C:\Windows\System\UTWfFAr.exe
  2⤵
  PID:5076
- C:\Windows\System\QSrkWCJ.exe
  C:\Windows\System\QSrkWCJ.exe
  2⤵
  PID:812
- C:\Windows\System\TIlOGjT.exe
  C:\Windows\System\TIlOGjT.exe
  2⤵
  PID:4820
- C:\Windows\System\ZQJGhcl.exe
  C:\Windows\System\ZQJGhcl.exe
  2⤵
  PID:2484
- C:\Windows\System\tJRGpCp.exe
  C:\Windows\System\tJRGpCp.exe
  2⤵
  PID:4592
- C:\Windows\System\OBacYgO.exe
  C:\Windows\System\OBacYgO.exe
  2⤵
  PID:5264
- C:\Windows\System\lQGVwoT.exe
  C:\Windows\System\lQGVwoT.exe
  2⤵
  PID:1424
- C:\Windows\System\XnKvGtL.exe
  C:\Windows\System\XnKvGtL.exe
  2⤵
  PID:5360
- C:\Windows\System\MGUVkqc.exe
  C:\Windows\System\MGUVkqc.exe
  2⤵
  PID:1500
- C:\Windows\System\ZRzBooz.exe
  C:\Windows\System\ZRzBooz.exe
  2⤵
  PID:112
- C:\Windows\System\lazynGl.exe
  C:\Windows\System\lazynGl.exe
  2⤵
  PID:3944
- C:\Windows\System\iqUCShC.exe
  C:\Windows\System\iqUCShC.exe
  2⤵
  PID:540
- C:\Windows\System\xvzkvGP.exe
  C:\Windows\System\xvzkvGP.exe
  2⤵
  PID:1900
- C:\Windows\System\HerzrUi.exe
  C:\Windows\System\HerzrUi.exe
  2⤵
  PID:4816
- C:\Windows\System\RqNSUOs.exe
  C:\Windows\System\RqNSUOs.exe
  2⤵
  PID:3644
- C:\Windows\System\ZLkIHjQ.exe
  C:\Windows\System\ZLkIHjQ.exe
  2⤵
  PID:912
- C:\Windows\System\QrBLKXb.exe
  C:\Windows\System\QrBLKXb.exe
  2⤵
  PID:5628
- C:\Windows\System\cXvtmRd.exe
  C:\Windows\System\cXvtmRd.exe
  2⤵
  PID:5560
- C:\Windows\System\xJjsqkx.exe
  C:\Windows\System\xJjsqkx.exe
  2⤵
  PID:4524
- C:\Windows\System\yJwYZtW.exe
  C:\Windows\System\yJwYZtW.exe
  2⤵
  PID:5064
- C:\Windows\System\ESuGIUL.exe
  C:\Windows\System\ESuGIUL.exe
  2⤵
  PID:3484
- C:\Windows\System\HPNGExg.exe
  C:\Windows\System\HPNGExg.exe
  2⤵
  PID:5992
- C:\Windows\System\CFPAPRe.exe
  C:\Windows\System\CFPAPRe.exe
  2⤵
  PID:5112
- C:\Windows\System\OWfMMqX.exe
  C:\Windows\System\OWfMMqX.exe
  2⤵
  PID:4216
- C:\Windows\System\etZWJVl.exe
  C:\Windows\System\etZWJVl.exe
  2⤵
  PID:5796
- C:\Windows\System\hkpahvQ.exe
  C:\Windows\System\hkpahvQ.exe
  2⤵
  PID:5548
- C:\Windows\System\cYtpUjz.exe
  C:\Windows\System\cYtpUjz.exe
  2⤵
  PID:6056
- C:\Windows\System\HJjpWQn.exe
  C:\Windows\System\HJjpWQn.exe
  2⤵
  PID:404
- C:\Windows\System\XdiBnvj.exe
  C:\Windows\System\XdiBnvj.exe
  2⤵
  PID:4284
- C:\Windows\System\TulrfzH.exe
  C:\Windows\System\TulrfzH.exe
  2⤵
  PID:1600
- C:\Windows\System\zzlSDiR.exe
  C:\Windows\System\zzlSDiR.exe
  2⤵
  PID:2856
- C:\Windows\System\LzvFAlH.exe
  C:\Windows\System\LzvFAlH.exe
  2⤵
  PID:4964
- C:\Windows\System\cfmDhgd.exe
  C:\Windows\System\cfmDhgd.exe
  2⤵
  PID:4240
- C:\Windows\System\ShOASRJ.exe
  C:\Windows\System\ShOASRJ.exe
  2⤵
  PID:4752
- C:\Windows\System\CYLRoYU.exe
  C:\Windows\System\CYLRoYU.exe
  2⤵
  PID:1676
- C:\Windows\System\YKnGsHW.exe
  C:\Windows\System\YKnGsHW.exe
  2⤵
  PID:1728
- C:\Windows\System\DvtBKUF.exe
  C:\Windows\System\DvtBKUF.exe
  2⤵
  PID:2116
- C:\Windows\System\sRTxebp.exe
  C:\Windows\System\sRTxebp.exe
  2⤵
  PID:5576
- C:\Windows\System\qcwWtUa.exe
  C:\Windows\System\qcwWtUa.exe
  2⤵
  PID:2132
- C:\Windows\System\GAMhBgo.exe
  C:\Windows\System\GAMhBgo.exe
  2⤵
  PID:1656
- C:\Windows\System\etHpeox.exe
  C:\Windows\System\etHpeox.exe
  2⤵
  PID:4104
- C:\Windows\System\PCZqoGo.exe
  C:\Windows\System\PCZqoGo.exe
  2⤵
  PID:1888
- C:\Windows\System\OEqAOJY.exe
  C:\Windows\System\OEqAOJY.exe
  2⤵
  PID:5500
- C:\Windows\System\Mukdlvu.exe
  C:\Windows\System\Mukdlvu.exe
  2⤵
  PID:4356
- C:\Windows\System\NEuhLlV.exe
  C:\Windows\System\NEuhLlV.exe
  2⤵
  PID:6004
- C:\Windows\System\GNmoNEQ.exe
  C:\Windows\System\GNmoNEQ.exe
  2⤵
  PID:4420
- C:\Windows\System\bMCQcWA.exe
  C:\Windows\System\bMCQcWA.exe
  2⤵
  PID:6020
- C:\Windows\System\qopvyci.exe
  C:\Windows\System\qopvyci.exe
  2⤵
  PID:5344
- C:\Windows\System\fzpYSeO.exe
  C:\Windows\System\fzpYSeO.exe
  2⤵
  PID:3580
- C:\Windows\System\zxRvJCC.exe
  C:\Windows\System\zxRvJCC.exe
  2⤵
  PID:5768
- C:\Windows\System\kVKZwkA.exe
  C:\Windows\System\kVKZwkA.exe
  2⤵
  PID:4688
- C:\Windows\System\VEMmxIh.exe
  C:\Windows\System\VEMmxIh.exe
  2⤵
  PID:4640
- C:\Windows\System\QQdVuxU.exe
  C:\Windows\System\QQdVuxU.exe
  2⤵
  PID:1232
- C:\Windows\System\IUNlxvw.exe
  C:\Windows\System\IUNlxvw.exe
  2⤵
  PID:3472
- C:\Windows\System\dBmIDcM.exe
  C:\Windows\System\dBmIDcM.exe
  2⤵
  PID:2560
- C:\Windows\System\REPNOhs.exe
  C:\Windows\System\REPNOhs.exe
  2⤵
  PID:3228
- C:\Windows\System\nqMBrdn.exe
  C:\Windows\System\nqMBrdn.exe
  2⤵
  PID:588
- C:\Windows\System\UgZthgi.exe
  C:\Windows\System\UgZthgi.exe
  2⤵
  PID:2732
- C:\Windows\System\nbyFymD.exe
  C:\Windows\System\nbyFymD.exe
  2⤵
  PID:4184
- C:\Windows\System\anemaTC.exe
  C:\Windows\System\anemaTC.exe
  2⤵
  PID:5248
- C:\Windows\System\SRFZDoE.exe
  C:\Windows\System\SRFZDoE.exe
  2⤵
  PID:5916
- C:\Windows\System\VQjoxqR.exe
  C:\Windows\System\VQjoxqR.exe
  2⤵
  PID:5700
- C:\Windows\System\LHmWuXA.exe
  C:\Windows\System\LHmWuXA.exe
  2⤵
  PID:2604
- C:\Windows\System\kbsFKrY.exe
  C:\Windows\System\kbsFKrY.exe
  2⤵
  PID:3544
- C:\Windows\System\TXhUxZh.exe
  C:\Windows\System\TXhUxZh.exe
  2⤵
  PID:5404
- C:\Windows\System\YiphUIF.exe
  C:\Windows\System\YiphUIF.exe
  2⤵
  PID:4868
- C:\Windows\System\vVGpXUG.exe
  C:\Windows\System\vVGpXUG.exe
  2⤵
  PID:5544
- C:\Windows\System\xFtaPip.exe
  C:\Windows\System\xFtaPip.exe
  2⤵
  PID:4512
- C:\Windows\System\qcJSwgV.exe
  C:\Windows\System\qcJSwgV.exe
  2⤵
  PID:1876
- C:\Windows\System\VcuzuOa.exe
  C:\Windows\System\VcuzuOa.exe
  2⤵
  PID:5152
- C:\Windows\System\IpEKUPP.exe
  C:\Windows\System\IpEKUPP.exe
  2⤵
  PID:1372
- C:\Windows\System\ziEZGar.exe
  C:\Windows\System\ziEZGar.exe
  2⤵
  PID:2300
- C:\Windows\System\dXguKHQ.exe
  C:\Windows\System\dXguKHQ.exe
  2⤵
  PID:1724
- C:\Windows\System\fODMVOH.exe
  C:\Windows\System\fODMVOH.exe
  2⤵
  PID:4724
- C:\Windows\System\tpiyxct.exe
  C:\Windows\System\tpiyxct.exe
  2⤵
  PID:5868
- C:\Windows\System\HgTvBBL.exe
  C:\Windows\System\HgTvBBL.exe
  2⤵
  PID:5944
- C:\Windows\System\hHcKNkD.exe
  C:\Windows\System\hHcKNkD.exe
  2⤵
  PID:5392
- C:\Windows\System\MHTODug.exe
  C:\Windows\System\MHTODug.exe
  2⤵
  PID:6148
- C:\Windows\System\bUVhXps.exe
  C:\Windows\System\bUVhXps.exe
  2⤵
  PID:6164
- C:\Windows\System\xZWLXzi.exe
  C:\Windows\System\xZWLXzi.exe
  2⤵
  PID:6180
- C:\Windows\System\oBFxrNu.exe
  C:\Windows\System\oBFxrNu.exe
  2⤵
  PID:6196
- C:\Windows\System\ZHuAWiW.exe
  C:\Windows\System\ZHuAWiW.exe
  2⤵
  PID:6212
- C:\Windows\System\uROTJma.exe
  C:\Windows\System\uROTJma.exe
  2⤵
  PID:6228
- C:\Windows\System\bjUPpTT.exe
  C:\Windows\System\bjUPpTT.exe
  2⤵
  PID:6244
- C:\Windows\System\eMhIcLU.exe
  C:\Windows\System\eMhIcLU.exe
  2⤵
  PID:6260
- C:\Windows\System\lFvyRZD.exe
  C:\Windows\System\lFvyRZD.exe
  2⤵
  PID:6276
- C:\Windows\System\pIgmvAB.exe
  C:\Windows\System\pIgmvAB.exe
  2⤵
  PID:6292
- C:\Windows\System\UpeQytY.exe
  C:\Windows\System\UpeQytY.exe
  2⤵
  PID:6308
- C:\Windows\System\IDNncjO.exe
  C:\Windows\System\IDNncjO.exe
  2⤵
  PID:6324
- C:\Windows\System\KafFNdL.exe
  C:\Windows\System\KafFNdL.exe
  2⤵
  PID:6340
- C:\Windows\System\HKjrtTO.exe
  C:\Windows\System\HKjrtTO.exe
  2⤵
  PID:6356
- C:\Windows\System\PEQhyGo.exe
  C:\Windows\System\PEQhyGo.exe
  2⤵
  PID:6372
- C:\Windows\System\Oiyztxb.exe
  C:\Windows\System\Oiyztxb.exe
  2⤵
  PID:6388
- C:\Windows\System\gbhkUds.exe
  C:\Windows\System\gbhkUds.exe
  2⤵
  PID:6404
- C:\Windows\System\troLqON.exe
  C:\Windows\System\troLqON.exe
  2⤵
  PID:6420
- C:\Windows\System\kUIRdSF.exe
  C:\Windows\System\kUIRdSF.exe
  2⤵
  PID:6436
- C:\Windows\System\FlaCQxk.exe
  C:\Windows\System\FlaCQxk.exe
  2⤵
  PID:6452
- C:\Windows\System\DysbOJx.exe
  C:\Windows\System\DysbOJx.exe
  2⤵
  PID:6468
- C:\Windows\System\AkRLfQl.exe
  C:\Windows\System\AkRLfQl.exe
  2⤵
  PID:6484
- C:\Windows\System\YjJXrzO.exe
  C:\Windows\System\YjJXrzO.exe
  2⤵
  PID:6500
- C:\Windows\System\vOSGROv.exe
  C:\Windows\System\vOSGROv.exe
  2⤵
  PID:6516
- C:\Windows\System\PJetxzY.exe
  C:\Windows\System\PJetxzY.exe
  2⤵
  PID:6532
- C:\Windows\System\ePdavVu.exe
  C:\Windows\System\ePdavVu.exe
  2⤵
  PID:6548
- C:\Windows\System\DwaJOYN.exe
  C:\Windows\System\DwaJOYN.exe
  2⤵
  PID:6568
- C:\Windows\System\WWZXUjp.exe
  C:\Windows\System\WWZXUjp.exe
  2⤵
  PID:6584
- C:\Windows\System\hWaloIO.exe
  C:\Windows\System\hWaloIO.exe
  2⤵
  PID:6600
- C:\Windows\System\GkoFtgX.exe
  C:\Windows\System\GkoFtgX.exe
  2⤵
  PID:6616
- C:\Windows\System\TMiRHmY.exe
  C:\Windows\System\TMiRHmY.exe
  2⤵
  PID:6632
- C:\Windows\System\CtnZThO.exe
  C:\Windows\System\CtnZThO.exe
  2⤵
  PID:6648
- C:\Windows\System\VkbutiP.exe
  C:\Windows\System\VkbutiP.exe
  2⤵
  PID:6668
- C:\Windows\System\HSzLaNu.exe
  C:\Windows\System\HSzLaNu.exe
  2⤵
  PID:6684
- C:\Windows\System\eXoWSJn.exe
  C:\Windows\System\eXoWSJn.exe
  2⤵
  PID:6700
- C:\Windows\System\OjyVmgb.exe
  C:\Windows\System\OjyVmgb.exe
  2⤵
  PID:6716
- C:\Windows\System\mGsljtz.exe
  C:\Windows\System\mGsljtz.exe
  2⤵
  PID:6732
- C:\Windows\System\bcpTipf.exe
  C:\Windows\System\bcpTipf.exe
  2⤵
  PID:6748
- C:\Windows\System\SiHjtsd.exe
  C:\Windows\System\SiHjtsd.exe
  2⤵
  PID:6764
- C:\Windows\System\sexnWJH.exe
  C:\Windows\System\sexnWJH.exe
  2⤵
  PID:6780
- C:\Windows\System\GjSmLlR.exe
  C:\Windows\System\GjSmLlR.exe
  2⤵
  PID:6800
- C:\Windows\System\pWyctuX.exe
  C:\Windows\System\pWyctuX.exe
  2⤵
  PID:6816
- C:\Windows\System\EopsuaF.exe
  C:\Windows\System\EopsuaF.exe
  2⤵
  PID:6832
- C:\Windows\System\FMKfLIH.exe
  C:\Windows\System\FMKfLIH.exe
  2⤵
  PID:6848
- C:\Windows\System\AFMEMKm.exe
  C:\Windows\System\AFMEMKm.exe
  2⤵
  PID:6864
- C:\Windows\System\OqTLsTY.exe
  C:\Windows\System\OqTLsTY.exe
  2⤵
  PID:6880
- C:\Windows\System\UQsJZEE.exe
  C:\Windows\System\UQsJZEE.exe
  2⤵
  PID:6896
- C:\Windows\System\qENNmxs.exe
  C:\Windows\System\qENNmxs.exe
  2⤵
  PID:6912
- C:\Windows\System\krPhkHU.exe
  C:\Windows\System\krPhkHU.exe
  2⤵
  PID:6928
- C:\Windows\System\crDaBcH.exe
  C:\Windows\System\crDaBcH.exe
  2⤵
  PID:6944
- C:\Windows\System\QYjmzhV.exe
  C:\Windows\System\QYjmzhV.exe
  2⤵
  PID:6960
- C:\Windows\System\lvmfCOS.exe
  C:\Windows\System\lvmfCOS.exe
  2⤵
  PID:6976
- C:\Windows\System\GxKjVEx.exe
  C:\Windows\System\GxKjVEx.exe
  2⤵
  PID:6992
- C:\Windows\System\ingqlkQ.exe
  C:\Windows\System\ingqlkQ.exe
  2⤵
  PID:7008
- C:\Windows\System\obytSEQ.exe
  C:\Windows\System\obytSEQ.exe
  2⤵
  PID:7024
- C:\Windows\System\VjfTHDq.exe
  C:\Windows\System\VjfTHDq.exe
  2⤵
  PID:7044
- C:\Windows\System\PYYgmoo.exe
  C:\Windows\System\PYYgmoo.exe
  2⤵
  PID:7060
- C:\Windows\System\CGcYwnv.exe
  C:\Windows\System\CGcYwnv.exe
  2⤵
  PID:7076
- C:\Windows\System\pwpgqEg.exe
  C:\Windows\System\pwpgqEg.exe
  2⤵
  PID:7092
- C:\Windows\System\tQsBlwX.exe
  C:\Windows\System\tQsBlwX.exe
  2⤵
  PID:7108
- C:\Windows\System\bGWMSFH.exe
  C:\Windows\System\bGWMSFH.exe
  2⤵
  PID:7124
- C:\Windows\System\wqrsclb.exe
  C:\Windows\System\wqrsclb.exe
  2⤵
  PID:7140
- C:\Windows\System\DICHKDS.exe
  C:\Windows\System\DICHKDS.exe
  2⤵
  PID:7156
- C:\Windows\System\jGhVyfh.exe
  C:\Windows\System\jGhVyfh.exe
  2⤵
  PID:5436
- C:\Windows\System\FNAgdQx.exe
  C:\Windows\System\FNAgdQx.exe
  2⤵
  PID:6192
- C:\Windows\System\ftYVlKQ.exe
  C:\Windows\System\ftYVlKQ.exe
  2⤵
  PID:6256
- C:\Windows\System\QgKDroF.exe
  C:\Windows\System\QgKDroF.exe
  2⤵
  PID:2988
- C:\Windows\System\YHTUPiR.exe
  C:\Windows\System\YHTUPiR.exe
  2⤵
  PID:5748
- C:\Windows\System\oKjsycz.exe
  C:\Windows\System\oKjsycz.exe
  2⤵
  PID:6208
- C:\Windows\System\zidpumC.exe
  C:\Windows\System\zidpumC.exe
  2⤵
  PID:6272
- C:\Windows\System\QOBJigm.exe
  C:\Windows\System\QOBJigm.exe
  2⤵
  PID:6336
- C:\Windows\System\CCjCIvF.exe
  C:\Windows\System\CCjCIvF.exe
  2⤵
  PID:6316
- C:\Windows\System\uJDJhck.exe
  C:\Windows\System\uJDJhck.exe
  2⤵
  PID:6416
- C:\Windows\System\mOzcXpx.exe
  C:\Windows\System\mOzcXpx.exe
  2⤵
  PID:6480
- C:\Windows\System\gDLkzhu.exe
  C:\Windows\System\gDLkzhu.exe
  2⤵
  PID:6556
- C:\Windows\System\GqRqJIB.exe
  C:\Windows\System\GqRqJIB.exe
  2⤵
  PID:6492
- C:\Windows\System\BukHAkl.exe
  C:\Windows\System\BukHAkl.exe
  2⤵
  PID:6428
- C:\Windows\System\hytiMiX.exe
  C:\Windows\System\hytiMiX.exe
  2⤵
  PID:6544
- C:\Windows\System\IgrXbQb.exe
  C:\Windows\System\IgrXbQb.exe
  2⤵
  PID:6576
- C:\Windows\System\TfRCDUD.exe
  C:\Windows\System\TfRCDUD.exe
  2⤵
  PID:6640
- C:\Windows\System\tBloGaM.exe
  C:\Windows\System\tBloGaM.exe
  2⤵
  PID:6708
- C:\Windows\System\tnXIecm.exe
  C:\Windows\System\tnXIecm.exe
  2⤵
  PID:6744
- C:\Windows\System\vNgKidU.exe
  C:\Windows\System\vNgKidU.exe
  2⤵
  PID:6656
- C:\Windows\System\JAfszMa.exe
  C:\Windows\System\JAfszMa.exe
  2⤵
  PID:6692
- C:\Windows\System\JHojdbO.exe
  C:\Windows\System\JHojdbO.exe
  2⤵
  PID:6756
- C:\Windows\System\MBMPpLY.exe
  C:\Windows\System\MBMPpLY.exe
  2⤵
  PID:6796
- C:\Windows\System\fFAishQ.exe
  C:\Windows\System\fFAishQ.exe
  2⤵
  PID:6840
- C:\Windows\System\tMxLPWm.exe
  C:\Windows\System\tMxLPWm.exe
  2⤵
  PID:6844
- C:\Windows\System\eyuXFJS.exe
  C:\Windows\System\eyuXFJS.exe
  2⤵
  PID:6892
- C:\Windows\System\cttaUQH.exe
  C:\Windows\System\cttaUQH.exe
  2⤵
  PID:6956
- C:\Windows\System\agiRgAm.exe
  C:\Windows\System\agiRgAm.exe
  2⤵
  PID:7120
- C:\Windows\System\zxQYNSL.exe
  C:\Windows\System\zxQYNSL.exe
  2⤵
  PID:6288
- C:\Windows\System\oFnYdAR.exe
  C:\Windows\System\oFnYdAR.exe
  2⤵
  PID:6304
- C:\Windows\System\BxbkxHp.exe
  C:\Windows\System\BxbkxHp.exe
  2⤵
  PID:6680
- C:\Windows\System\NOOwbMx.exe
  C:\Windows\System\NOOwbMx.exe
  2⤵
  PID:6676
- C:\Windows\System\wKKSfOL.exe
  C:\Windows\System\wKKSfOL.exe
  2⤵
  PID:6460
- C:\Windows\System\sQYPOoZ.exe
  C:\Windows\System\sQYPOoZ.exe
  2⤵
  PID:6812
- C:\Windows\System\eiPLQud.exe
  C:\Windows\System\eiPLQud.exe
  2⤵
  PID:6940
- C:\Windows\System\bQRupuk.exe
  C:\Windows\System\bQRupuk.exe
  2⤵
  PID:6240
- C:\Windows\System\sJcbFYL.exe
  C:\Windows\System\sJcbFYL.exe
  2⤵
  PID:7000
- C:\Windows\System\mnVKcNx.exe
  C:\Windows\System\mnVKcNx.exe
  2⤵
  PID:7004
- C:\Windows\System\afkMyFr.exe
  C:\Windows\System\afkMyFr.exe
  2⤵
  PID:6872
- C:\Windows\System\yuuaXyA.exe
  C:\Windows\System\yuuaXyA.exe
  2⤵
  PID:6908
- C:\Windows\System\OHkxNpW.exe
  C:\Windows\System\OHkxNpW.exe
  2⤵
  PID:7068
- C:\Windows\System\TLjaDZy.exe
  C:\Windows\System\TLjaDZy.exe
  2⤵
  PID:7136
- C:\Windows\System\Kicgqdv.exe
  C:\Windows\System\Kicgqdv.exe
  2⤵
  PID:5764
- C:\Windows\System\sAheZxA.exe
  C:\Windows\System\sAheZxA.exe
  2⤵
  PID:6352
- C:\Windows\System\qwInkaK.exe
  C:\Windows\System\qwInkaK.exe
  2⤵
  PID:6788
- C:\Windows\System\FleCMRr.exe
  C:\Windows\System\FleCMRr.exe
  2⤵
  PID:7020
- C:\Windows\System\oScUUDZ.exe
  C:\Windows\System\oScUUDZ.exe
  2⤵
  PID:7116
- C:\Windows\System\inHexVE.exe
  C:\Windows\System\inHexVE.exe
  2⤵
  PID:6176
- C:\Windows\System\TDvOyvc.exe
  C:\Windows\System\TDvOyvc.exe
  2⤵
  PID:6728
- C:\Windows\System\iUzIyYS.exe
  C:\Windows\System\iUzIyYS.exe
  2⤵
  PID:6608
- C:\Windows\System\zfProuC.exe
  C:\Windows\System\zfProuC.exe
  2⤵
  PID:7180
- C:\Windows\System\ZMkaYhC.exe
  C:\Windows\System\ZMkaYhC.exe
  2⤵
  PID:7196
- C:\Windows\System\nFSPIVR.exe
  C:\Windows\System\nFSPIVR.exe
  2⤵
  PID:7212
- C:\Windows\System\Bwmsfcu.exe
  C:\Windows\System\Bwmsfcu.exe
  2⤵
  PID:7228
- C:\Windows\System\EbnFubx.exe
  C:\Windows\System\EbnFubx.exe
  2⤵
  PID:7244
- C:\Windows\System\oOTtkIN.exe
  C:\Windows\System\oOTtkIN.exe
  2⤵
  PID:7260
- C:\Windows\System\mgwIaTf.exe
  C:\Windows\System\mgwIaTf.exe
  2⤵
  PID:7276
- C:\Windows\System\eipPXMS.exe
  C:\Windows\System\eipPXMS.exe
  2⤵
  PID:7292
- C:\Windows\System\wVPuXVM.exe
  C:\Windows\System\wVPuXVM.exe
  2⤵
  PID:7308
- C:\Windows\System\NJMSNby.exe
  C:\Windows\System\NJMSNby.exe
  2⤵
  PID:7324
- C:\Windows\System\KnErGkI.exe
  C:\Windows\System\KnErGkI.exe
  2⤵
  PID:7340
- C:\Windows\System\xRcTmGs.exe
  C:\Windows\System\xRcTmGs.exe
  2⤵
  PID:7356
- C:\Windows\System\AXUktts.exe
  C:\Windows\System\AXUktts.exe
  2⤵
  PID:7372
- C:\Windows\System\btWkZoQ.exe
  C:\Windows\System\btWkZoQ.exe
  2⤵
  PID:7388
- C:\Windows\System\ucYwQfK.exe
  C:\Windows\System\ucYwQfK.exe
  2⤵
  PID:7404
- C:\Windows\System\ioqXpVA.exe
  C:\Windows\System\ioqXpVA.exe
  2⤵
  PID:7420
- C:\Windows\System\YRpFDHS.exe
  C:\Windows\System\YRpFDHS.exe
  2⤵
  PID:7436
- C:\Windows\System\nNNHyTk.exe
  C:\Windows\System\nNNHyTk.exe
  2⤵
  PID:7452
- C:\Windows\System\kPNVkui.exe
  C:\Windows\System\kPNVkui.exe
  2⤵
  PID:7468
- C:\Windows\System\ZIEQxPl.exe
  C:\Windows\System\ZIEQxPl.exe
  2⤵
  PID:7484
- C:\Windows\System\oTJtRys.exe
  C:\Windows\System\oTJtRys.exe
  2⤵
  PID:7500
- C:\Windows\System\cmflpkE.exe
  C:\Windows\System\cmflpkE.exe
  2⤵
  PID:7516
- C:\Windows\System\rOkMLsm.exe
  C:\Windows\System\rOkMLsm.exe
  2⤵
  PID:7536
- C:\Windows\System\QiDBhWE.exe
  C:\Windows\System\QiDBhWE.exe
  2⤵
  PID:7552
- C:\Windows\System\kEFKWnp.exe
  C:\Windows\System\kEFKWnp.exe
  2⤵
  PID:7568
- C:\Windows\System\RDXZEOV.exe
  C:\Windows\System\RDXZEOV.exe
  2⤵
  PID:7584
- C:\Windows\System\baWrMYX.exe
  C:\Windows\System\baWrMYX.exe
  2⤵
  PID:7600
- C:\Windows\System\hmjWHDt.exe
  C:\Windows\System\hmjWHDt.exe
  2⤵
  PID:7616
- C:\Windows\System\DLZAtsX.exe
  C:\Windows\System\DLZAtsX.exe
  2⤵
  PID:7632
- C:\Windows\System\nVlbWcE.exe
  C:\Windows\System\nVlbWcE.exe
  2⤵
  PID:7648
- C:\Windows\System\GjzlIog.exe
  C:\Windows\System\GjzlIog.exe
  2⤵
  PID:7664
- C:\Windows\System\NoSDCyj.exe
  C:\Windows\System\NoSDCyj.exe
  2⤵
  PID:7680
- C:\Windows\System\fWPpVef.exe
  C:\Windows\System\fWPpVef.exe
  2⤵
  PID:7696
- C:\Windows\System\vRCrSEb.exe
  C:\Windows\System\vRCrSEb.exe
  2⤵
  PID:7712
- C:\Windows\System\hcwQZHK.exe
  C:\Windows\System\hcwQZHK.exe
  2⤵
  PID:7728
- C:\Windows\System\efrLZTr.exe
  C:\Windows\System\efrLZTr.exe
  2⤵
  PID:7744
- C:\Windows\System\RbLOMyK.exe
  C:\Windows\System\RbLOMyK.exe
  2⤵
  PID:7760
- C:\Windows\System\iZcsSXA.exe
  C:\Windows\System\iZcsSXA.exe
  2⤵
  PID:7776
- C:\Windows\System\IFPkqGi.exe
  C:\Windows\System\IFPkqGi.exe
  2⤵
  PID:7792
- C:\Windows\System\EMuvMLL.exe
  C:\Windows\System\EMuvMLL.exe
  2⤵
  PID:7808
- C:\Windows\System\reTilEg.exe
  C:\Windows\System\reTilEg.exe
  2⤵
  PID:7824
- C:\Windows\System\TDkmVdw.exe
  C:\Windows\System\TDkmVdw.exe
  2⤵
  PID:7840
- C:\Windows\System\zUnuzcz.exe
  C:\Windows\System\zUnuzcz.exe
  2⤵
  PID:7856
- C:\Windows\System\UwuEApt.exe
  C:\Windows\System\UwuEApt.exe
  2⤵
  PID:7872
- C:\Windows\System\oDSlPBp.exe
  C:\Windows\System\oDSlPBp.exe
  2⤵
  PID:7888
- C:\Windows\System\mtGYIVc.exe
  C:\Windows\System\mtGYIVc.exe
  2⤵
  PID:7920
- C:\Windows\System\AJhHedl.exe
  C:\Windows\System\AJhHedl.exe
  2⤵
  PID:7948
- C:\Windows\System\KuKmUtO.exe
  C:\Windows\System\KuKmUtO.exe
  2⤵
  PID:7968
- C:\Windows\System\KClLKcB.exe
  C:\Windows\System\KClLKcB.exe
  2⤵
  PID:7984
- C:\Windows\System\xNtKlBR.exe
  C:\Windows\System\xNtKlBR.exe
  2⤵
  PID:8012
- C:\Windows\System\aXizBMZ.exe
  C:\Windows\System\aXizBMZ.exe
  2⤵
  PID:8028
- C:\Windows\System\jyMkJPD.exe
  C:\Windows\System\jyMkJPD.exe
  2⤵
  PID:8044
- C:\Windows\System\EDsfLBn.exe
  C:\Windows\System\EDsfLBn.exe
  2⤵
  PID:8060
- C:\Windows\System\qvibHQx.exe
  C:\Windows\System\qvibHQx.exe
  2⤵
  PID:8076
- C:\Windows\System\mnCbtre.exe
  C:\Windows\System\mnCbtre.exe
  2⤵
  PID:8092
- C:\Windows\System\IRaMAJN.exe
  C:\Windows\System\IRaMAJN.exe
  2⤵
  PID:8108
- C:\Windows\System\tQFUnmv.exe
  C:\Windows\System\tQFUnmv.exe
  2⤵
  PID:8128
- C:\Windows\System\XythABD.exe
  C:\Windows\System\XythABD.exe
  2⤵
  PID:8144
- C:\Windows\System\PNHxIAf.exe
  C:\Windows\System\PNHxIAf.exe
  2⤵
  PID:8160
- C:\Windows\System\MkztCWl.exe
  C:\Windows\System\MkztCWl.exe
  2⤵
  PID:8180
- C:\Windows\System\mntHuTg.exe
  C:\Windows\System\mntHuTg.exe
  2⤵
  PID:7032
- C:\Windows\System\YLmJKZb.exe
  C:\Windows\System\YLmJKZb.exe
  2⤵
  PID:6660
- C:\Windows\System\bIgDBNC.exe
  C:\Windows\System\bIgDBNC.exe
  2⤵
  PID:6628
- C:\Windows\System\BOFhVvO.exe
  C:\Windows\System\BOFhVvO.exe
  2⤵
  PID:6368
- C:\Windows\System\EJBALJi.exe
  C:\Windows\System\EJBALJi.exe
  2⤵
  PID:6348
- C:\Windows\System\EoMDExY.exe
  C:\Windows\System\EoMDExY.exe
  2⤵
  PID:7496
- C:\Windows\System\djcjdkz.exe
  C:\Windows\System\djcjdkz.exe
  2⤵
  PID:7336
- C:\Windows\System\yxQqIOI.exe
  C:\Windows\System\yxQqIOI.exe
  2⤵
  PID:7188
- C:\Windows\System\qAPGrxg.exe
  C:\Windows\System\qAPGrxg.exe
  2⤵
  PID:7252
- C:\Windows\System\KipPTnV.exe
  C:\Windows\System\KipPTnV.exe
  2⤵
  PID:7316
- C:\Windows\System\IdPRgAZ.exe
  C:\Windows\System\IdPRgAZ.exe
  2⤵
  PID:7352
- C:\Windows\System\UhIYKst.exe
  C:\Windows\System\UhIYKst.exe
  2⤵
  PID:7444
- C:\Windows\System\Fkphizq.exe
  C:\Windows\System\Fkphizq.exe
  2⤵
  PID:7508
- C:\Windows\System\jFKFQDI.exe
  C:\Windows\System\jFKFQDI.exe
  2⤵
  PID:7576
- C:\Windows\System\lfauFjQ.exe
  C:\Windows\System\lfauFjQ.exe
  2⤵
  PID:7644
- C:\Windows\System\RHwvBTq.exe
  C:\Windows\System\RHwvBTq.exe
  2⤵
  PID:7704
- C:\Windows\System\rGSHolQ.exe
  C:\Windows\System\rGSHolQ.exe
  2⤵
  PID:7464
- C:\Windows\System\XHmjYZd.exe
  C:\Windows\System\XHmjYZd.exe
  2⤵
  PID:7656
- C:\Windows\System\uCRjkAw.exe
  C:\Windows\System\uCRjkAw.exe
  2⤵
  PID:7688
- C:\Windows\System\CMQRPyq.exe
  C:\Windows\System\CMQRPyq.exe
  2⤵
  PID:7752
- C:\Windows\System\HEJxdmk.exe
  C:\Windows\System\HEJxdmk.exe
  2⤵
  PID:7800
- C:\Windows\System\xZbixew.exe
  C:\Windows\System\xZbixew.exe
  2⤵
  PID:7740
- C:\Windows\System\QcrpvSB.exe
  C:\Windows\System\QcrpvSB.exe
  2⤵
  PID:7848
- C:\Windows\System\kpmMYaI.exe
  C:\Windows\System\kpmMYaI.exe
  2⤵
  PID:7880
- C:\Windows\System\YuKWBFB.exe
  C:\Windows\System\YuKWBFB.exe
  2⤵
  PID:7868
- C:\Windows\System\PcNLNnl.exe
  C:\Windows\System\PcNLNnl.exe
  2⤵
  PID:7908
- C:\Windows\System\FFvKabM.exe
  C:\Windows\System\FFvKabM.exe
  2⤵
  PID:7936
- C:\Windows\System\pcfAwzm.exe
  C:\Windows\System\pcfAwzm.exe
  2⤵
  PID:7992
- C:\Windows\System\zkhwZim.exe
  C:\Windows\System\zkhwZim.exe
  2⤵
  PID:7976
- C:\Windows\System\ADKKZhw.exe
  C:\Windows\System\ADKKZhw.exe
  2⤵
  PID:7996
- C:\Windows\System\bckqknf.exe
  C:\Windows\System\bckqknf.exe
  2⤵
  PID:8068
- C:\Windows\System\npVoCwI.exe
  C:\Windows\System\npVoCwI.exe
  2⤵
  PID:8136
- C:\Windows\System\JslYbBh.exe
  C:\Windows\System\JslYbBh.exe
  2⤵
  PID:6252
- C:\Windows\System\vUFJSzZ.exe
  C:\Windows\System\vUFJSzZ.exe
  2⤵
  PID:8140
- C:\Windows\System\KyvwMyl.exe
  C:\Windows\System\KyvwMyl.exe
  2⤵
  PID:8188
- C:\Windows\System\JgvfgFV.exe
  C:\Windows\System\JgvfgFV.exe
  2⤵
  PID:8152
- C:\Windows\System\eMjevql.exe
  C:\Windows\System\eMjevql.exe
  2⤵
  PID:7084
- C:\Windows\System\lQgHaFU.exe
  C:\Windows\System\lQgHaFU.exe
  2⤵
  PID:7236
- C:\Windows\System\UemmUei.exe
  C:\Windows\System\UemmUei.exe
  2⤵
  PID:7332
- C:\Windows\System\jucvznc.exe
  C:\Windows\System\jucvznc.exe
  2⤵
  PID:6412
- C:\Windows\System\pCvCIwC.exe
  C:\Windows\System\pCvCIwC.exe
  2⤵
  PID:7364
- C:\Windows\System\FGInqYg.exe
  C:\Windows\System\FGInqYg.exe
  2⤵
  PID:6524
- C:\Windows\System\RVohYYG.exe
  C:\Windows\System\RVohYYG.exe
  2⤵
  PID:7432
- C:\Windows\System\ljHVzRi.exe
  C:\Windows\System\ljHVzRi.exe
  2⤵
  PID:6972
- C:\Windows\System\MqouuOS.exe
  C:\Windows\System\MqouuOS.exe
  2⤵
  PID:7288
- C:\Windows\System\BoajpMa.exe
  C:\Windows\System\BoajpMa.exe
  2⤵
  PID:7544
- C:\Windows\System\mpOTicv.exe
  C:\Windows\System\mpOTicv.exe
  2⤵
  PID:7528
- C:\Windows\System\HpXssvB.exe
  C:\Windows\System\HpXssvB.exe
  2⤵
  PID:7612
- C:\Windows\System\HeKYHas.exe
  C:\Windows\System\HeKYHas.exe
  2⤵
  PID:7532
- C:\Windows\System\sKWHrBe.exe
  C:\Windows\System\sKWHrBe.exe
  2⤵
  PID:7592
- C:\Windows\System\xgdIYUg.exe
  C:\Windows\System\xgdIYUg.exe
  2⤵
  PID:7476
- C:\Windows\System\IlJSssx.exe
  C:\Windows\System\IlJSssx.exe
  2⤵
  PID:7660
- C:\Windows\System\XdLXwPp.exe
  C:\Windows\System\XdLXwPp.exe
  2⤵
  PID:7804
- C:\Windows\System\KVsdLxw.exe
  C:\Windows\System\KVsdLxw.exe
  2⤵
  PID:7904
- C:\Windows\System\XbRCqXa.exe
  C:\Windows\System\XbRCqXa.exe
  2⤵
  PID:8100
- C:\Windows\System\CBqaSVW.exe
  C:\Windows\System\CBqaSVW.exe
  2⤵
  PID:7772
- C:\Windows\System\mdFLqTR.exe
  C:\Windows\System\mdFLqTR.exe
  2⤵
  PID:8124
- C:\Windows\System\hpzCEpJ.exe
  C:\Windows\System\hpzCEpJ.exe
  2⤵
  PID:7944
- C:\Windows\System\EOKdLKq.exe
  C:\Windows\System\EOKdLKq.exe
  2⤵
  PID:6904
- C:\Windows\System\FrwTIAP.exe
  C:\Windows\System\FrwTIAP.exe
  2⤵
  PID:7928
- C:\Windows\System\yyxIofY.exe
  C:\Windows\System\yyxIofY.exe
  2⤵
  PID:8040
- C:\Windows\System\igHffCK.exe
  C:\Windows\System\igHffCK.exe
  2⤵
  PID:8120
- C:\Windows\System\QfPdNsT.exe
  C:\Windows\System\QfPdNsT.exe
  2⤵
  PID:7272
- C:\Windows\System\dTqgRzT.exe
  C:\Windows\System\dTqgRzT.exe
  2⤵
  PID:6512
- C:\Windows\System\IOjvJVO.exe
  C:\Windows\System\IOjvJVO.exe
  2⤵
  PID:7412
- C:\Windows\System\ZAmuFIp.exe
  C:\Windows\System\ZAmuFIp.exe
  2⤵
  PID:7348
- C:\Windows\System\AxYMzlj.exe
  C:\Windows\System\AxYMzlj.exe
  2⤵
  PID:7900
- C:\Windows\System\GxiEdiB.exe
  C:\Windows\System\GxiEdiB.exe
  2⤵
  PID:5096
- C:\Windows\System\aXepliW.exe
  C:\Windows\System\aXepliW.exe
  2⤵
  PID:7896
- C:\Windows\System\NiuIMmq.exe
  C:\Windows\System\NiuIMmq.exe
  2⤵
  PID:7676
- C:\Windows\System\CreonlX.exe
  C:\Windows\System\CreonlX.exe
  2⤵
  PID:7284
- C:\Windows\System\ZmdQMdS.exe
  C:\Windows\System\ZmdQMdS.exe
  2⤵
  PID:7784
- C:\Windows\System\QOfdbKB.exe
  C:\Windows\System\QOfdbKB.exe
  2⤵
  PID:7964
- C:\Windows\System\BskQnmI.exe
  C:\Windows\System\BskQnmI.exe
  2⤵
  PID:8172
- C:\Windows\System\UNqvZjs.exe
  C:\Windows\System\UNqvZjs.exe
  2⤵
  PID:8088
- C:\Windows\System\NEvjDeU.exe
  C:\Windows\System\NEvjDeU.exe
  2⤵
  PID:7720
- C:\Windows\System\ytpHRjQ.exe
  C:\Windows\System\ytpHRjQ.exe
  2⤵
  PID:7268
- C:\Windows\System\igXjOcX.exe
  C:\Windows\System\igXjOcX.exe
  2⤵
  PID:8116
- C:\Windows\System\ddIEWOL.exe
  C:\Windows\System\ddIEWOL.exe
  2⤵
  PID:7956
- C:\Windows\System\qQbnkGM.exe
  C:\Windows\System\qQbnkGM.exe
  2⤵
  PID:6224
- C:\Windows\System\RhIXUTe.exe
  C:\Windows\System\RhIXUTe.exe
  2⤵
  PID:8200
- C:\Windows\System\eCbdaFw.exe
  C:\Windows\System\eCbdaFw.exe
  2⤵
  PID:8216
- C:\Windows\System\hixyJOL.exe
  C:\Windows\System\hixyJOL.exe
  2⤵
  PID:8232
- C:\Windows\System\itTdWlj.exe
  C:\Windows\System\itTdWlj.exe
  2⤵
  PID:8248
- C:\Windows\System\TzjRCFG.exe
  C:\Windows\System\TzjRCFG.exe
  2⤵
  PID:8264
- C:\Windows\System\gYvCAjN.exe
  C:\Windows\System\gYvCAjN.exe
  2⤵
  PID:8280
- C:\Windows\System\DabbjEL.exe
  C:\Windows\System\DabbjEL.exe
  2⤵
  PID:8296
- C:\Windows\System\giEMDwT.exe
  C:\Windows\System\giEMDwT.exe
  2⤵
  PID:8312
- C:\Windows\System\oTnaLXM.exe
  C:\Windows\System\oTnaLXM.exe
  2⤵
  PID:8328
- C:\Windows\System\jfgLfps.exe
  C:\Windows\System\jfgLfps.exe
  2⤵
  PID:8344
- C:\Windows\System\ugNwtOn.exe
  C:\Windows\System\ugNwtOn.exe
  2⤵
  PID:8360
- C:\Windows\System\trlNMcH.exe
  C:\Windows\System\trlNMcH.exe
  2⤵
  PID:8376
- C:\Windows\System\RjIOkan.exe
  C:\Windows\System\RjIOkan.exe
  2⤵
  PID:8392
- C:\Windows\System\dKLihQk.exe
  C:\Windows\System\dKLihQk.exe
  2⤵
  PID:8408
- C:\Windows\System\cOGbyZf.exe
  C:\Windows\System\cOGbyZf.exe
  2⤵
  PID:8424
- C:\Windows\System\SXOTcuV.exe
  C:\Windows\System\SXOTcuV.exe
  2⤵
  PID:8440
- C:\Windows\System\zXVqPVa.exe
  C:\Windows\System\zXVqPVa.exe
  2⤵
  PID:8456
- C:\Windows\System\aTBZQyg.exe
  C:\Windows\System\aTBZQyg.exe
  2⤵
  PID:8472
- C:\Windows\System\QpynxAY.exe
  C:\Windows\System\QpynxAY.exe
  2⤵
  PID:8488
- C:\Windows\System\lallIDV.exe
  C:\Windows\System\lallIDV.exe
  2⤵
  PID:8508
- C:\Windows\System\fZJPtrg.exe
  C:\Windows\System\fZJPtrg.exe
  2⤵
  PID:8524
- C:\Windows\System\cWvMtzI.exe
  C:\Windows\System\cWvMtzI.exe
  2⤵
  PID:8540
- C:\Windows\System\nccbdHz.exe
  C:\Windows\System\nccbdHz.exe
  2⤵
  PID:8556
- C:\Windows\System\rIBbqcv.exe
  C:\Windows\System\rIBbqcv.exe
  2⤵
  PID:8572
- C:\Windows\System\lefEDox.exe
  C:\Windows\System\lefEDox.exe
  2⤵
  PID:8588
- C:\Windows\System\TglFTwO.exe
  C:\Windows\System\TglFTwO.exe
  2⤵
  PID:8604
- C:\Windows\System\UgQedXX.exe
  C:\Windows\System\UgQedXX.exe
  2⤵
  PID:8620
- C:\Windows\System\jkIuZxM.exe
  C:\Windows\System\jkIuZxM.exe
  2⤵
  PID:8636
- C:\Windows\System\XZYDHgk.exe
  C:\Windows\System\XZYDHgk.exe
  2⤵
  PID:8652
- C:\Windows\System\FdmLuEJ.exe
  C:\Windows\System\FdmLuEJ.exe
  2⤵
  PID:8668
- C:\Windows\System\RbGqvUZ.exe
  C:\Windows\System\RbGqvUZ.exe
  2⤵
  PID:8684
- C:\Windows\System\fewvDTR.exe
  C:\Windows\System\fewvDTR.exe
  2⤵
  PID:8700
- C:\Windows\System\tbbiMqq.exe
  C:\Windows\System\tbbiMqq.exe
  2⤵
  PID:8716
- C:\Windows\System\dscHjIH.exe
  C:\Windows\System\dscHjIH.exe
  2⤵
  PID:8732
- C:\Windows\System\ESJBCVX.exe
  C:\Windows\System\ESJBCVX.exe
  2⤵
  PID:8748
- C:\Windows\System\GEopSDr.exe
  C:\Windows\System\GEopSDr.exe
  2⤵
  PID:8764
- C:\Windows\System\OTaXlse.exe
  C:\Windows\System\OTaXlse.exe
  2⤵
  PID:8784
- C:\Windows\System\TUSlOXP.exe
  C:\Windows\System\TUSlOXP.exe
  2⤵
  PID:8800
- C:\Windows\System\YDRzRtR.exe
  C:\Windows\System\YDRzRtR.exe
  2⤵
  PID:8816
- C:\Windows\System\PDPoCdq.exe
  C:\Windows\System\PDPoCdq.exe
  2⤵
  PID:8832
- C:\Windows\System\gQneHRG.exe
  C:\Windows\System\gQneHRG.exe
  2⤵
  PID:8852
- C:\Windows\System\UoIznxk.exe
  C:\Windows\System\UoIznxk.exe
  2⤵
  PID:8868
- C:\Windows\System\nASPOeD.exe
  C:\Windows\System\nASPOeD.exe
  2⤵
  PID:8884
- C:\Windows\System\JnIBgmP.exe
  C:\Windows\System\JnIBgmP.exe
  2⤵
  PID:8900
- C:\Windows\System\UHjlcyu.exe
  C:\Windows\System\UHjlcyu.exe
  2⤵
  PID:8916
- C:\Windows\System\zwHmBUj.exe
  C:\Windows\System\zwHmBUj.exe
  2⤵
  PID:8932
- C:\Windows\System\YCDLvgO.exe
  C:\Windows\System\YCDLvgO.exe
  2⤵
  PID:8956
- C:\Windows\System\DYIKzOS.exe
  C:\Windows\System\DYIKzOS.exe
  2⤵
  PID:8976
- C:\Windows\System\ZdauNji.exe
  C:\Windows\System\ZdauNji.exe
  2⤵
  PID:8992
- C:\Windows\System\emOVSKR.exe
  C:\Windows\System\emOVSKR.exe
  2⤵
  PID:9008
- C:\Windows\System\CJmJpmG.exe
  C:\Windows\System\CJmJpmG.exe
  2⤵
  PID:9024
- C:\Windows\System\QlZqwje.exe
  C:\Windows\System\QlZqwje.exe
  2⤵
  PID:9044
- C:\Windows\System\ZXNOvfH.exe
  C:\Windows\System\ZXNOvfH.exe
  2⤵
  PID:9060
- C:\Windows\System\jwjJLxl.exe
  C:\Windows\System\jwjJLxl.exe
  2⤵
  PID:9076
- C:\Windows\System\LMNPuGC.exe
  C:\Windows\System\LMNPuGC.exe
  2⤵
  PID:9092
- C:\Windows\System\NBIykpQ.exe
  C:\Windows\System\NBIykpQ.exe
  2⤵
  PID:9108
- C:\Windows\System\mUzbkPq.exe
  C:\Windows\System\mUzbkPq.exe
  2⤵
  PID:9124
- C:\Windows\System\LCnnOsV.exe
  C:\Windows\System\LCnnOsV.exe
  2⤵
  PID:9140
- C:\Windows\System\WcKsbqf.exe
  C:\Windows\System\WcKsbqf.exe
  2⤵
  PID:9156
- C:\Windows\System\yNvlxQh.exe
  C:\Windows\System\yNvlxQh.exe
  2⤵
  PID:9172
- C:\Windows\System\aeYJzAH.exe
  C:\Windows\System\aeYJzAH.exe
  2⤵
  PID:9188
- C:\Windows\System\KTmOsbS.exe
  C:\Windows\System\KTmOsbS.exe
  2⤵
  PID:9208
- C:\Windows\System\cPGAcjI.exe
  C:\Windows\System\cPGAcjI.exe
  2⤵
  PID:7040
- C:\Windows\System\hohyPWP.exe
  C:\Windows\System\hohyPWP.exe
  2⤵
  PID:8304
- C:\Windows\System\rSTleZP.exe
  C:\Windows\System\rSTleZP.exe
  2⤵
  PID:1296
- C:\Windows\System\sXdZBkm.exe
  C:\Windows\System\sXdZBkm.exe
  2⤵
  PID:8484
- C:\Windows\System\RCsVhVP.exe
  C:\Windows\System\RCsVhVP.exe
  2⤵
  PID:8568
- C:\Windows\System\dvXTarC.exe
  C:\Windows\System\dvXTarC.exe
  2⤵
  PID:8632
- C:\Windows\System\lwEpPWF.exe
  C:\Windows\System\lwEpPWF.exe
  2⤵
  PID:8696
- C:\Windows\System\UDCPmxy.exe
  C:\Windows\System\UDCPmxy.exe
  2⤵
  PID:8520
- C:\Windows\System\eGPnRKI.exe
  C:\Windows\System\eGPnRKI.exe
  2⤵
  PID:8616
- C:\Windows\System\NJkAVGj.exe
  C:\Windows\System\NJkAVGj.exe
  2⤵
  PID:8792
- C:\Windows\System\nEFkGAO.exe
  C:\Windows\System\nEFkGAO.exe
  2⤵
  PID:8724
- C:\Windows\System\WebavXG.exe
  C:\Windows\System\WebavXG.exe
  2⤵
  PID:8648
- C:\Windows\System\wqVWPHi.exe
  C:\Windows\System\wqVWPHi.exe
  2⤵
  PID:8892
- C:\Windows\System\JjqMNXf.exe
  C:\Windows\System\JjqMNXf.exe
  2⤵
  PID:8968
- C:\Windows\System\IqCFabB.exe
  C:\Windows\System\IqCFabB.exe
  2⤵
  PID:8972
- C:\Windows\System\PRrLpxp.exe
  C:\Windows\System\PRrLpxp.exe
  2⤵
  PID:9068
- C:\Windows\System\oaoyRaF.exe
  C:\Windows\System\oaoyRaF.exe
  2⤵
  PID:9100
- C:\Windows\System\LQBKyJe.exe
  C:\Windows\System\LQBKyJe.exe
  2⤵
  PID:8840
- C:\Windows\System\YjKewUy.exe
  C:\Windows\System\YjKewUy.exe
  2⤵
  PID:8908
- C:\Windows\System\QwObIDB.exe
  C:\Windows\System\QwObIDB.exe
  2⤵
  PID:8772
- C:\Windows\System\nCDGxwq.exe
  C:\Windows\System\nCDGxwq.exe
  2⤵
  PID:9016
- C:\Windows\System\sxwClss.exe
  C:\Windows\System\sxwClss.exe
  2⤵
  PID:8912
- C:\Windows\System\lJqgPxz.exe
  C:\Windows\System\lJqgPxz.exe
  2⤵
  PID:8952
- C:\Windows\System\pQGSYyW.exe
  C:\Windows\System\pQGSYyW.exe
  2⤵
  PID:9120
- C:\Windows\System\mbDFDPs.exe
  C:\Windows\System\mbDFDPs.exe
  2⤵
  PID:9184
- C:\Windows\System\whjjcbW.exe
  C:\Windows\System\whjjcbW.exe
  2⤵
  PID:8336
- C:\Windows\System\QYoNqUD.exe
  C:\Windows\System\QYoNqUD.exe
  2⤵
  PID:8240
- C:\Windows\System\xvHVKce.exe
  C:\Windows\System\xvHVKce.exe
  2⤵
  PID:9200
- C:\Windows\System\QzKISrk.exe
  C:\Windows\System\QzKISrk.exe
  2⤵
  PID:8368
- C:\Windows\System\gZyQIQY.exe
  C:\Windows\System\gZyQIQY.exe
  2⤵
  PID:8404
- C:\Windows\System\LgyzXXM.exe
  C:\Windows\System\LgyzXXM.exe
  2⤵
  PID:7396
- C:\Windows\System\iVoopNJ.exe
  C:\Windows\System\iVoopNJ.exe
  2⤵
  PID:7056
- C:\Windows\System\sNLLuLN.exe
  C:\Windows\System\sNLLuLN.exe
  2⤵
  PID:8224
- C:\Windows\System\sCOrGTL.exe
  C:\Windows\System\sCOrGTL.exe
  2⤵
  PID:8288
- C:\Windows\System\fIEajZu.exe
  C:\Windows\System\fIEajZu.exe
  2⤵
  PID:8356
- C:\Windows\System\VniqBvC.exe
  C:\Windows\System\VniqBvC.exe
  2⤵
  PID:8420
- C:\Windows\System\VHfKETb.exe
  C:\Windows\System\VHfKETb.exe
  2⤵
  PID:2612
- C:\Windows\System\TRMeOFj.exe
  C:\Windows\System\TRMeOFj.exe
  2⤵
  PID:8532
- C:\Windows\System\zQdLetE.exe
  C:\Windows\System\zQdLetE.exe
  2⤵
  PID:8628
- C:\Windows\System\bGyisxa.exe
  C:\Windows\System\bGyisxa.exe
  2⤵
  PID:8692
- C:\Windows\System\khlmSev.exe
  C:\Windows\System\khlmSev.exe
  2⤵
  PID:8860
- C:\Windows\System\isvSymK.exe
  C:\Windows\System\isvSymK.exe
  2⤵
  PID:8712
- C:\Windows\System\JrRENhF.exe
  C:\Windows\System\JrRENhF.exe
  2⤵
  PID:8864
- C:\Windows\System\zcNHHQF.exe
  C:\Windows\System\zcNHHQF.exe
  2⤵
  PID:8744
- C:\Windows\System\kpHSMgh.exe
  C:\Windows\System\kpHSMgh.exe
  2⤵
  PID:9072
- C:\Windows\System\xwoZXHO.exe
  C:\Windows\System\xwoZXHO.exe
  2⤵
  PID:8808
- C:\Windows\System\AIYNkik.exe
  C:\Windows\System\AIYNkik.exe
  2⤵
  PID:9056
- C:\Windows\System\GYOdiXT.exe
  C:\Windows\System\GYOdiXT.exe
  2⤵
  PID:9180
- C:\Windows\System\IicsYvn.exe
  C:\Windows\System\IicsYvn.exe
  2⤵
  PID:9132
- C:\Windows\System\rBRlcxV.exe
  C:\Windows\System\rBRlcxV.exe
  2⤵
  PID:8292
- C:\Windows\System\eaSXroJ.exe
  C:\Windows\System\eaSXroJ.exe
  2⤵
  PID:2912
- C:\Windows\System\eZrfpbE.exe
  C:\Windows\System\eZrfpbE.exe
  2⤵
  PID:8760
- C:\Windows\System\CEHSzUR.exe
  C:\Windows\System\CEHSzUR.exe
  2⤵
  PID:8584
- C:\Windows\System\lmcBosO.exe
  C:\Windows\System\lmcBosO.exe
  2⤵
  PID:8004
- C:\Windows\System\ezDABuN.exe
  C:\Windows\System\ezDABuN.exe
  2⤵
  PID:9104
- C:\Windows\System\TpviGQR.exe
  C:\Windows\System\TpviGQR.exe
  2⤵
  PID:8516
- C:\Windows\System\XeYszKk.exe
  C:\Windows\System\XeYszKk.exe
  2⤵
  PID:1996
- C:\Windows\System\XcSNgOo.exe
  C:\Windows\System\XcSNgOo.exe
  2⤵
  PID:8416
- C:\Windows\System\LFdeqSJ.exe
  C:\Windows\System\LFdeqSJ.exe
  2⤵
  PID:8828
- C:\Windows\System\MJPMitF.exe
  C:\Windows\System\MJPMitF.exe
  2⤵
  PID:9036
- C:\Windows\System\tCSSIiX.exe
  C:\Windows\System\tCSSIiX.exe
  2⤵
  PID:8324
- C:\Windows\System\rTXYtdF.exe
  C:\Windows\System\rTXYtdF.exe
  2⤵
  PID:8928
- C:\Windows\System\rqGApuq.exe
  C:\Windows\System\rqGApuq.exe
  2⤵
  PID:8780
- C:\Windows\System\FAUZSue.exe
  C:\Windows\System\FAUZSue.exe
  2⤵
  PID:8480
- C:\Windows\System\TKpCrkE.exe
  C:\Windows\System\TKpCrkE.exe
  2⤵
  PID:8372
- C:\Windows\System\BkxaCLb.exe
  C:\Windows\System\BkxaCLb.exe
  2⤵
  PID:9084
- C:\Windows\System\FUXmChr.exe
  C:\Windows\System\FUXmChr.exe
  2⤵
  PID:8256
- C:\Windows\System\vYbTuya.exe
  C:\Windows\System\vYbTuya.exe
  2⤵
  PID:8664
- C:\Windows\System\aERAZmP.exe
  C:\Windows\System\aERAZmP.exe
  2⤵
  PID:1520
- C:\Windows\System\Efzfdxz.exe
  C:\Windows\System\Efzfdxz.exe
  2⤵
  PID:8964
- C:\Windows\System\pVkZsoN.exe
  C:\Windows\System\pVkZsoN.exe
  2⤵
  PID:9228
- C:\Windows\System\nRbLccc.exe
  C:\Windows\System\nRbLccc.exe
  2⤵
  PID:9244
- C:\Windows\System\cyPJlWD.exe
  C:\Windows\System\cyPJlWD.exe
  2⤵
  PID:9260
- C:\Windows\System\xwncyRn.exe
  C:\Windows\System\xwncyRn.exe
  2⤵
  PID:9276
- C:\Windows\System\aivgrsr.exe
  C:\Windows\System\aivgrsr.exe
  2⤵
  PID:9292
- C:\Windows\System\ILfiwwP.exe
  C:\Windows\System\ILfiwwP.exe
  2⤵
  PID:9308
- C:\Windows\System\XmwdpRu.exe
  C:\Windows\System\XmwdpRu.exe
  2⤵
  PID:9348
- C:\Windows\System\lRBZlmJ.exe
  C:\Windows\System\lRBZlmJ.exe
  2⤵
  PID:9364
- C:\Windows\System\cUKjsRM.exe
  C:\Windows\System\cUKjsRM.exe
  2⤵
  PID:9380
- C:\Windows\System\GiqQFKy.exe
  C:\Windows\System\GiqQFKy.exe
  2⤵
  PID:9396
- C:\Windows\System\bWgoGGN.exe
  C:\Windows\System\bWgoGGN.exe
  2⤵
  PID:9412
- C:\Windows\System\OYbpvxU.exe
  C:\Windows\System\OYbpvxU.exe
  2⤵
  PID:9428
- C:\Windows\System\pdosDHQ.exe
  C:\Windows\System\pdosDHQ.exe
  2⤵
  PID:9444
- C:\Windows\System\zRDINkR.exe
  C:\Windows\System\zRDINkR.exe
  2⤵
  PID:9460
- C:\Windows\System\gWjhoQq.exe
  C:\Windows\System\gWjhoQq.exe
  2⤵
  PID:9476
- C:\Windows\System\XsXUMIR.exe
  C:\Windows\System\XsXUMIR.exe
  2⤵
  PID:9492
- C:\Windows\System\NllxFcL.exe
  C:\Windows\System\NllxFcL.exe
  2⤵
  PID:9508
- C:\Windows\System\UEDPfuM.exe
  C:\Windows\System\UEDPfuM.exe
  2⤵
  PID:9524
- C:\Windows\System\UkfVTLH.exe
  C:\Windows\System\UkfVTLH.exe
  2⤵
  PID:9540
- C:\Windows\System\bSlbxSJ.exe
  C:\Windows\System\bSlbxSJ.exe
  2⤵
  PID:9556
- C:\Windows\System\reyooLH.exe
  C:\Windows\System\reyooLH.exe
  2⤵
  PID:9572
- C:\Windows\System\qbNHHWe.exe
  C:\Windows\System\qbNHHWe.exe
  2⤵
  PID:9592
- C:\Windows\System\CRWNTYr.exe
  C:\Windows\System\CRWNTYr.exe
  2⤵
  PID:9684
- C:\Windows\System\QYJRcvT.exe
  C:\Windows\System\QYJRcvT.exe
  2⤵
  PID:9784
- C:\Windows\System\hBDQOIH.exe
  C:\Windows\System\hBDQOIH.exe
  2⤵
  PID:9800
- C:\Windows\System\tARBBHB.exe
  C:\Windows\System\tARBBHB.exe
  2⤵
  PID:9816
- C:\Windows\System\PVdirBc.exe
  C:\Windows\System\PVdirBc.exe
  2⤵
  PID:9836
- C:\Windows\System\fVMfYgh.exe
  C:\Windows\System\fVMfYgh.exe
  2⤵
  PID:9852
- C:\Windows\System\hOuPnrh.exe
  C:\Windows\System\hOuPnrh.exe
  2⤵
  PID:9868
- C:\Windows\System\xPoXtMw.exe
  C:\Windows\System\xPoXtMw.exe
  2⤵
  PID:9884
- C:\Windows\System\IkwjGeP.exe
  C:\Windows\System\IkwjGeP.exe
  2⤵
  PID:9900
- C:\Windows\System\MXURvyu.exe
  C:\Windows\System\MXURvyu.exe
  2⤵
  PID:9916
- C:\Windows\System\agqwmPi.exe
  C:\Windows\System\agqwmPi.exe
  2⤵
  PID:9932
- C:\Windows\System\QzJiuki.exe
  C:\Windows\System\QzJiuki.exe
  2⤵
  PID:9948
- C:\Windows\System\dwmHZSo.exe
  C:\Windows\System\dwmHZSo.exe
  2⤵
  PID:9964
- C:\Windows\System\aEVNmsH.exe
  C:\Windows\System\aEVNmsH.exe
  2⤵
  PID:9980
- C:\Windows\System\GAQvFFj.exe
  C:\Windows\System\GAQvFFj.exe
  2⤵
  PID:9996
- C:\Windows\System\tqQYyKp.exe
  C:\Windows\System\tqQYyKp.exe
  2⤵
  PID:10012
- C:\Windows\System\GakoSiv.exe
  C:\Windows\System\GakoSiv.exe
  2⤵
  PID:10064
- C:\Windows\System\ButTbAE.exe
  C:\Windows\System\ButTbAE.exe
  2⤵
  PID:10080
- C:\Windows\System\dzgCwCv.exe
  C:\Windows\System\dzgCwCv.exe
  2⤵
  PID:10096
- C:\Windows\System\THMgQLx.exe
  C:\Windows\System\THMgQLx.exe
  2⤵
  PID:10112
- C:\Windows\System\XTqmdwT.exe
  C:\Windows\System\XTqmdwT.exe
  2⤵
  PID:10132
- C:\Windows\System\hhQotSC.exe
  C:\Windows\System\hhQotSC.exe
  2⤵
  PID:10148
- C:\Windows\System\PUeTfwW.exe
  C:\Windows\System\PUeTfwW.exe
  2⤵
  PID:10164
- C:\Windows\System\mhduxbJ.exe
  C:\Windows\System\mhduxbJ.exe
  2⤵
  PID:10180
- C:\Windows\System\AGmkcQk.exe
  C:\Windows\System\AGmkcQk.exe
  2⤵
  PID:10196
- C:\Windows\System\eAbvJst.exe
  C:\Windows\System\eAbvJst.exe
  2⤵
  PID:10212
- C:\Windows\System\lCQpilL.exe
  C:\Windows\System\lCQpilL.exe
  2⤵
  PID:10228
- C:\Windows\System\ctWXElx.exe
  C:\Windows\System\ctWXElx.exe
  2⤵
  PID:8056
- C:\Windows\System\kFwQWVJ.exe
  C:\Windows\System\kFwQWVJ.exe
  2⤵
  PID:9268
- C:\Windows\System\bWfXYoQ.exe
  C:\Windows\System\bWfXYoQ.exe
  2⤵
  PID:9316
- C:\Windows\System\oKXQbBe.exe
  C:\Windows\System\oKXQbBe.exe
  2⤵
  PID:9220
- C:\Windows\System\OyUTzJs.exe
  C:\Windows\System\OyUTzJs.exe
  2⤵
  PID:9288
- C:\Windows\System\KXwDAUD.exe
  C:\Windows\System\KXwDAUD.exe
  2⤵
  PID:9388
- C:\Windows\System\kjIOSRP.exe
  C:\Windows\System\kjIOSRP.exe
  2⤵
  PID:9356
- C:\Windows\System\upuPyZW.exe
  C:\Windows\System\upuPyZW.exe
  2⤵
  PID:9484
- C:\Windows\System\tpkEzzL.exe
  C:\Windows\System\tpkEzzL.exe
  2⤵
  PID:9376
- C:\Windows\System\hrBakba.exe
  C:\Windows\System\hrBakba.exe
  2⤵
  PID:9472
- C:\Windows\System\jykrENP.exe
  C:\Windows\System\jykrENP.exe
  2⤵
  PID:9548
- C:\Windows\System\PznpPVR.exe
  C:\Windows\System\PznpPVR.exe
  2⤵
  PID:9588
- C:\Windows\System\JfeHVfW.exe
  C:\Windows\System\JfeHVfW.exe
  2⤵
  PID:9536
- C:\Windows\System\RqWEofM.exe
  C:\Windows\System\RqWEofM.exe
  2⤵
  PID:9616
- C:\Windows\System\njMJhCw.exe
  C:\Windows\System\njMJhCw.exe
  2⤵
  PID:9632
- C:\Windows\System\yUOKQfm.exe
  C:\Windows\System\yUOKQfm.exe
  2⤵
  PID:9648
- C:\Windows\System\rCrntky.exe
  C:\Windows\System\rCrntky.exe
  2⤵
  PID:9664
- C:\Windows\System\SbAxmmq.exe
  C:\Windows\System\SbAxmmq.exe
  2⤵
  PID:9680
- C:\Windows\System\GmYswCs.exe
  C:\Windows\System\GmYswCs.exe
  2⤵
  PID:9704
- C:\Windows\System\xSGjWMS.exe
  C:\Windows\System\xSGjWMS.exe
  2⤵
  PID:9340
- C:\Windows\System\ihENvHS.exe
  C:\Windows\System\ihENvHS.exe
  2⤵
  PID:9732
- C:\Windows\System\cyWQOcv.exe
  C:\Windows\System\cyWQOcv.exe
  2⤵
  PID:9744
- C:\Windows\System\InEYSwG.exe
  C:\Windows\System\InEYSwG.exe
  2⤵
  PID:9764
- C:\Windows\System\iFBylVD.exe
  C:\Windows\System\iFBylVD.exe
  2⤵
  PID:9780
- C:\Windows\System\oyHJQBA.exe
  C:\Windows\System\oyHJQBA.exe
  2⤵
  PID:9812
- C:\Windows\System\TkAPluU.exe
  C:\Windows\System\TkAPluU.exe
  2⤵
  PID:9912
- C:\Windows\System\XTXIYPm.exe
  C:\Windows\System\XTXIYPm.exe
  2⤵
  PID:9976
- C:\Windows\System\hrfMYoh.exe
  C:\Windows\System\hrfMYoh.exe
  2⤵
  PID:9796
- C:\Windows\System\pUduQME.exe
  C:\Windows\System\pUduQME.exe
  2⤵
  PID:10028
- C:\Windows\System\jCiFYCa.exe
  C:\Windows\System\jCiFYCa.exe
  2⤵
  PID:9860
- C:\Windows\System\dRLVkkh.exe
  C:\Windows\System\dRLVkkh.exe
  2⤵
  PID:9956
- C:\Windows\System\Xjvfqlk.exe
  C:\Windows\System\Xjvfqlk.exe
  2⤵
  PID:10020
- C:\Windows\System\ssvUqoq.exe
  C:\Windows\System\ssvUqoq.exe
  2⤵
  PID:10048
- C:\Windows\System\CqDohRN.exe
  C:\Windows\System\CqDohRN.exe
  2⤵
  PID:10072
- C:\Windows\System\HJBUzbi.exe
  C:\Windows\System\HJBUzbi.exe
  2⤵
  PID:10092
- C:\Windows\System\KCwwbKu.exe
  C:\Windows\System\KCwwbKu.exe
  2⤵
  PID:10144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADVDgAv.exe

Filesize
1.9MB

MD5
569ee93c3a410d27709e8b8cf15be735

SHA1
96af1715c1688349ef4f18850f984f38ef31e605

SHA256
3330e03288d7f33daa9b989dd24075fb0a3d5c95295164989eb74496e693e17c

SHA512
7795653aa9d341f8ec20f96729ff86bc6404c7269474d63bf1c31aef5e8095b19f06566780a43380c393a387e01f52a174dc7d28b8bafe4b09ffb24efc97e4d8

Download Submit
C:\Windows\system\BMlvClH.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\system\CgBQuwp.exe

Filesize
1.9MB

MD5
59c6fb484db626fdc3bddfa42d2600f6

SHA1
02fe8297ce785fc6342144f3a1057eaf31fee4dc

SHA256
4d04fdf34b47c5420ca833f200596277c5f0e816843cec00f36c5b41436b5920

SHA512
9b2af4f0864d9a29d66b6f052491a8409c77fdb1e87a6b5b58659ea43d09e453e175d822e6f1fb0b8ac5eac542f1a060219151d221688d8a98d64c3c9111588b

Download Submit
C:\Windows\system\EuxGGyW.exe

Filesize
1.9MB

MD5
9b51c6ef802389d70e9e7918c9802886

SHA1
9ff075670633500a9702a75aab656a485d20b7c5

SHA256
7d0ab620ca2d4059e08d1cfb624df93f33029af756a2dfe1b1926a6d2cbd55c8

SHA512
5130082dfc6b6eb3ecdb192ef79640cb2473c592f2ba2ed59b2a22819aab424c9e8c0251d6a968e1cd358f8a9062a04e200036969ad84e8131d5ea5146dccd07

Download Submit
C:\Windows\system\GHJYYKQ.exe

Filesize
1.9MB

MD5
e668aef6d6e70c19651884917f086a0f

SHA1
46cafd40c1a3968aed1c105e2b443b14c3b67e22

SHA256
c811cf918ccdc43993f301ccb14963bfefe431cec8832c3b850a6bfe93577fd2

SHA512
76d13e82948eb86843dfef65570788a9fb5e204abf994f7374000c4f37f766f2c7ba2390afdaacda6e0a5220057a07fa7452296b7b450862e20d88bef5f2af6f

Download Submit
C:\Windows\system\IAcPwYO.exe

Filesize
1.9MB

MD5
e717f1476092b936bb71a9668999f372

SHA1
98eaaaf69daca7b77ac2c2ea258000a692b6f3bd

SHA256
453b51e3f987cbff3d68f0923c759acc59bbd9d83c001ef0d2dade5eb593aae3

SHA512
58f538803bca925963c7a359e5175ad7ee0d217ad1d84e810b3f3e292c9a5a2514d594a033fd114c206a7ae988c7d4f72d874fd499095dc5c1870266be8b8b0c

Download Submit
C:\Windows\system\MXLJJJA.exe

Filesize
1.9MB

MD5
b698936755fa35c3ee866e693f7255d5

SHA1
b2c1b83a2ee61ee33fcc5aeac17e9d4e459412e2

SHA256
c7934119a11472372286a1bf6f39c7fcf398625acfb1d39d281fd9d23d47adc4

SHA512
ce63d31a33405915759921e9d25254022c9dd1dcd815fa5960aee402067420ecfb101e4eee7c173feea8770a3019219d47930ba2ccef0b1c05aad3c0d251925e

Download Submit
C:\Windows\system\MoFyhgV.exe

Filesize
1.9MB

MD5
ccbd30cc1a8036cbd15b28fb8dd55e3e

SHA1
0e1c21f130aebbfae744a20b61dd046c654a2509

SHA256
a21c621d77d11947922e7da6a5977676aac4e4d3ae827134f045cbfec4a5a90f

SHA512
258250e37b807b0a7b00e2d557a81d2474e9182c7e9ca79de0c0d55f0dabf5687fba4f616267e5b33bc9a132c5db6fd6d8c11f8e7a673f524c82cc402e4ce5e0

Download Submit
C:\Windows\system\NmnbBaW.exe

Filesize
1.9MB

MD5
059a397ce169a9f53740ef42da03c7af

SHA1
f1cf53adfd8b5c13709a488a0249db99a4dab17e

SHA256
1e6ba499298ae6bfa33d952637f7b052baa6c1b77ccfa68d4080c4969df4f73a

SHA512
73870f545b3a8f79cc2332852bad5bd441ae28219b5c4ae01866c917dbc6d01c38a71aef9132300b0dd44c7bc091a40e8aabfe86dccd6037eb73987f8f9138f4

Download Submit
C:\Windows\system\RZFxygO.exe

Filesize
1.9MB

MD5
70494ee3ad91440ef7c858b5a9df2561

SHA1
0e2f94f682df539ee4912bf23fa40f2f838eaa70

SHA256
b2de08d655a3651816986a709f499a91697643b1972cda819fbf7f1be9bbbcae

SHA512
a2de357426124adce9528e4abef87fe04c25ae18f3474b87fca9a88e5d1d522cee09a3fbff71b313b953a7fe9745701c9c304e74158e44325739dd73955516ea

Download Submit
C:\Windows\system\XkPFpRw.exe

Filesize
1.9MB

MD5
e25b981ef34b3ea3240fe73789c5bd44

SHA1
3256568eca46da4b280b9d1686193ccf89ebf94c

SHA256
e657632c5dc48ece0a67848b878b0338c2f9f302298db5d7cb5ea7de7b5327ad

SHA512
f5cde829ef4cfe9d2f38771b1555cb2ea47d10acee105dda4aae71cb2c4c2f1a521c601672e9a2bd8bbfa2b59ca3a752adbd6447c1e26dbe4d38d7c58ce88fc0

Download Submit
C:\Windows\system\cbPyQHL.exe

Filesize
1.9MB

MD5
94b9290ec4444acd7416a1d1a642c5ce

SHA1
dc764d7902bccc3062f98de512f3e67a29dc61cd

SHA256
886365807a6dbea73b61e4f1b1a5bf96a6eb58aca6fdd0a8d164d3653a00719c

SHA512
1758bf46b6a9d17cc22e4507ede7f8750f52a49d1de2a75da94fa7de1d77fa72e3d228ed344ce77c50d9146ad9ef57375d80d8d2d26144907be8dfe6b382fe9d

Download Submit
C:\Windows\system\iHCFNNG.exe

Filesize
1.9MB

MD5
207b123351bb9c4b4330886183a37b2e

SHA1
c0013085ab9bb0a7f8a055b6a90a75272ad4c62e

SHA256
f65bb7e8bf0e9bcd7fba18ddbd173c1bfc58d6334a8bcddb31bf6ffd9e214bd1

SHA512
c29758ab0f5ecff4def1f9258133baa9b53e269ae7374b6232364700a04882532ac87d7fd1655f1a8e2aa2b75c1e6810184ba89005559068ee7c48bbf38a81ff

Download Submit
C:\Windows\system\nhMwBBM.exe

Filesize
1.9MB

MD5
616d546a3f1a0d175a28fa6631d1318a

SHA1
ecff1bfdc90ad7bda92a920924b31bb04f1b01fe

SHA256
ae1335d4b8af60d476fead6e6264b39362fabce30d5ad510cd4a9ba604cfd32d

SHA512
a223b002417945e4c8e998d07f5033f6000f68a8016b60b52896476cdedd8e14be6a42eb5ae7bb97e310959615d6b0eb27649eb43f5ed5b780130b34890f396b

Download Submit
C:\Windows\system\qtbDFvO.exe

Filesize
1.9MB

MD5
3b5190228b171f9594f24f0003e99f39

SHA1
1240c6731f963c6f7b02ebde0cff4e159e3457d2

SHA256
53bc1bdfb92f9071360ac17810ececfaefa40d03845a2cf7b4df68e102c79bff

SHA512
0fffc07e88c23ab10995fe030c1c523873489b8f56481749ad82396ac403f9aa37f7cc0588665d7679ff98eb7ddbc171f56ec3a953c7d4b1f9242ce54b002b08

Download Submit
C:\Windows\system\vSdrRxd.exe

Filesize
1.9MB

MD5
e79fc7a444b85ddf07cba90acfdb446f

SHA1
036c18e71fe966cb79362a710dc4d4a603767517

SHA256
369f6b70c48343fd7cfc0b8f89acfbd06fbaf8764370f41117bcf7c09d09da8f

SHA512
d1a2e203098023c51a8f600cf08053959487c8bbee41ca96e7d62c0176786e32e9bcd742e460d458f99a625e5c45ad8a2d89aa706ae36249f7955780630c9bce

Download Submit
C:\Windows\system\xLXZrep.exe

Filesize
1.9MB

MD5
203b471035a5851edce1beaf575f346a

SHA1
051b221440db8aea7eb0c811c93c542254e60851

SHA256
141ccec898f569870f8afe49a7949a361c2c727c6a1d4effb9d7bd45b9248a6b

SHA512
978842bbe9f0f2e32a43e26f8aee870c4e43620f29748f61432a2dc0fcac30f99009b3ee02689942b9c10d4b4152439123f57c0be312997315a1c33b1905e3da

Download Submit
C:\Windows\system\xwxwYMc.exe

Filesize
1.9MB

MD5
b9e49d385ab90af62e9f48dc10b8614a

SHA1
a56bef48b5054b49f4074f0c8c5462b43d673422

SHA256
a5ef473103c530d0383b8a93b96dc29b8f89b529ea8c72036ea52e9d264ce6dd

SHA512
10391b133c4c3fb704c08b67ec94d8b636f99f419711f015035528fb05932b91dae01fa2af6179d4872e178351cdc2dbcaa125751c3e3af5c625ff1e990f2d4d

Download Submit
C:\Windows\system\yjuBnuP.exe

Filesize
1.9MB

MD5
44580d3da07ba58bccddc796ef2c9700

SHA1
03495f4c4bb50ac0add01fdb7e2bf9f0a8ec30b8

SHA256
72afba806acf0cfd89b284103272cea4338ee58970441bc6a8150cf1cbb9b6b2

SHA512
40def5f2aa1c377b6e9ab34f9b869be3df30ff13b0de08fd9c001f110ffb303afe848a2c3ddec4b575ceb8913d56a4b024f5e954a96f5d477eee6f6c12cd2faa

Download Submit
\Windows\system\EaCXxZM.exe

Filesize
1.9MB

MD5
a14a8610bf450bc3c1906682a5b9c1c5

SHA1
658440703dbc5a80d138904a2d7faa92f648b996

SHA256
23a282fcc25abe74316fa04dd50a84ce2b031b0812b1bc3f777a9bcf26efbc23

SHA512
3f2e50c2f7ed0942f8fedcb7d5c721eb33bc3cb3f7a9db254eacfb732b93755f3071b2b0332275d431af53fdd655a9fc7876e7516bcb8f3264c70c4c22989dd7

Download Submit
\Windows\system\KXzrzrZ.exe

Filesize
1.9MB

MD5
f6997a1b9a6505424f464e00460c084d

SHA1
9f579763a421f5c5190b10cd5a7527594b43aa77

SHA256
9c51f46ee6b28280c3e3062f1040e7cdc1fb1792f111ecf2dc731c5167dc39de

SHA512
c5ba51f9da98eb23e525f20514bf45e407bfa5cacf607920d5f39688c04744282f0f6ae9272019da5a27b364da24be72960e25ce63c73369920c9faab33940dc

Download Submit
\Windows\system\PXmegor.exe

Filesize
1.9MB

MD5
9fe1c177cd859997e2c7552fe2af8f3e

SHA1
5e7d4b40e1e257240d4ba4ddb77494c58ea31d6b

SHA256
ead2cfdcc486c017b948bc68f9e27f265cfce72ab1fa1dedd75356b06bb5fae1

SHA512
670acbc8d32defc60c4fa672ea5a021138f182e54ceb17d37ef84287efabb70cb282dbd93b8cc4e62ff353d8b6834be0855d96954f591dec23f5f9f42cb2dada

Download Submit
\Windows\system\ThiYssh.exe

Filesize
1.9MB

MD5
7c1ffb35255937ef859da2ed5509a0ca

SHA1
8e2af5fbca68a405cebe8c43e854864580579540

SHA256
8b381f3330daa8289d697b2e46992bd6e4d94e513d30489652a38f1a4652d6d8

SHA512
004123f8af58c3eba8c0d030151af1b965b7f3f4b90bcd207c41e1495108f4f693996a9148843ad54b02f4f450f7dcce05912ee96439744d6ef8ac3e8acfee04

Download Submit
\Windows\system\YmzvIIF.exe

Filesize
1.9MB

MD5
2a7f958a74ceb8f748473fe6629ee514

SHA1
6c80a0eca734ca2c2eecd578311711850789e8ee

SHA256
0c68542287e6af644a63de537922a8008cee8b596b50ac75d2c93992f9411f5d

SHA512
1cbc253dd9490b88a0c443f0b2e4b44c98dd97563286bc649d741b082c2237283a5b669d38f720235de4d184570ba491c78b7e6535de40ea23f71b26fe60234c

Download Submit
\Windows\system\YtYRphe.exe

Filesize
1.9MB

MD5
98d147e787bf9e32055cbf97600325ce

SHA1
a636b00093a8c8021460fc30d8f6256fcdb012f9

SHA256
3b3c0b922276c04ba3ac7118e53210c3e1d3d90fd5519d5653505bce825317e6

SHA512
960535eaf94d5e3119f454e5bd92834c6c87baf00b143b4d909b74db4b8e850a9efeaac07449cc1176dc98bc62c11bcbe6daf7ead33aae914373e6058717c9c0

Download Submit
\Windows\system\ZLVPLNf.exe

Filesize
1.9MB

MD5
e08d225ac80d2c1dbf8dc8f1733a10b3

SHA1
55faa1c75a9300b01a50377e0e053e3a88883da1

SHA256
8222fe2074f17ca7cd25a8d0531b9b8112661c8efd870b48404bbe635021708a

SHA512
9f1084436a8211bd96a08a200436a6dc55e56f055b826927c8a477bf84d88c213b30d203338d643ddb81a426f0fbc9311acc063a4f81c74009a0e4ddc6792e09

Download Submit
\Windows\system\ZyrVtZu.exe

Filesize
1.9MB

MD5
586a1766a1aded049beac22a08ca5b4e

SHA1
0ced27facfc1c2de0399e7b5c53c8203d16e52b3

SHA256
4e2c3a6b23e7965409990b889f939bdc3dea0df9527bad0eb0c07a901892d5b2

SHA512
fb33c2c8ada4f240749a3a1e5d682a22a4a8a4288bb7d5301c1c07e0cd63fa6d7898fdb95a04df462a9619751fb69c07f0d1fd1899d543839d6120f16213f2d2

Download Submit
\Windows\system\iJgyNUl.exe

Filesize
1.9MB

MD5
b1cf71261da1ad11610f91956e3f9ad7

SHA1
817ac4887a659084b43c43300b1b55e008c9f41c

SHA256
cd5436b89a6b276dc0f827e2e2292b1dfd4c032ef498ece6dc2782e5532518a7

SHA512
766b3ef0a03a4474e0a1d023b055f67c4fc5e58d0bbe4896e7e580ed732508852b88794d620256e1fb124353217851b10865729abaea5d4ecf691c76983a570f

Download Submit
\Windows\system\iPaoFci.exe

Filesize
1.9MB

MD5
6fb69f6459561d0bfdb699bc29b11cb5

SHA1
7dfc6653ae714b126c937f8ca77a5a8e0211f8ea

SHA256
7132359cfeaf81e0390148ab60b9c07676c22f750acc6f5330e04a92a78bb5ab

SHA512
733a1aabab6905f3e512980cc533d404892263ba8b54d6fec269d85bf86a50cfc7f26e5aacc709af2d4cdaec537800af874661caf08f15890c28d11fe0ef3268

Download Submit
\Windows\system\lIDaBEC.exe

Filesize
1.9MB

MD5
402617879197c7db41b2c1d9132f575f

SHA1
eec60a12efe0ca20dc0207a5df40e900b0df5da5

SHA256
8a63e5f150d99877e5267c848aa75c2134f7a3bc654bf36d9a41f5a6274166fa

SHA512
734ff01a8221155f8f32b25c37c498653657b6bdb49ccdea59f328b0f382a2f9f493f340788b9d16c3e31a82912bf0a4cb6efd263fbd249444d940718d0bf6b9

Download Submit
\Windows\system\ptyUkdK.exe

Filesize
1.9MB

MD5
8e3054463c4eb01afcc5a4bf9592b05a

SHA1
0596be05d18450936e6417e11217a54b316f2a90

SHA256
7a98f941b5848e34a42c9db2c78991075465ed2b287ab1cbe78417e9154dc902

SHA512
c3785c700063182e337cd2ffd863bfa2b1e575fc2698185a3ce5a5d5eea4d29de0d78b5800632fe04d796fe389501a66597c1d87c9fdd1ea23f2d4c8641f11d7

Download Submit
\Windows\system\qIIVUPu.exe

Filesize
1.9MB

MD5
19a95a6ab1b67447eb77be168d131f6a

SHA1
c2c1bc8d70b86467efd0b54a3d3d90317dd51935

SHA256
3ec44981b38f2b63d6d610f2d25ed5e3a559fed474bcd18c9f09c74748894a51

SHA512
363de1812468b98174f964f86a60d8e01574323d1a9650fb026337839b210ede4b14dcb9c5d925c88a3777223642c269d53a4251fa8150b31df263d6cee28088

Download Submit
\Windows\system\rkOevcO.exe

Filesize
1.9MB

MD5
a3d701a969fd12c5679c243478df75d1

SHA1
d8287cc0d07d76cfc0e224e09397960f144df52b

SHA256
70bd9f5e76d78b9af7350d0b8557bbca14d506260b67516c879fb89397492014

SHA512
898de78f5525e31b4f178a13e2f2281ac25341db14017c94e24dda0e52e9d54ec580e9f727a2a990cbdf7086af232c1738dbf94ac40478f00618c0c304343b60

Download Submit
\Windows\system\rqqtLhZ.exe

Filesize
1.9MB

MD5
96029eeb5242bcaa5f40755e3048e6e5

SHA1
e596b270084b5545ca3d761c15655c17819f3a5a

SHA256
96a5b27885bc6141dc1260f0a4cb11ca3d812d9f3fb5e677d1ef593c40484e92

SHA512
2ee7514a7749b725889ba197e3de189b9447586d1aa146df4722ec074d3510d1e80a7460f05fb5ad843c7de94f48625ec73d40c8317f36f54a13998fb408e68a

Download Submit
\Windows\system\tKJpYXb.exe

Filesize
1.9MB

MD5
43203a458b16fbceed381a65a6652ce7

SHA1
2c2eae934c9505427d81e84247517f5ab12ee485

SHA256
074a2fcdf4895e0689517ddfba4806e7b2a14cc6cd9b0729de60fb37c9b4fe84

SHA512
041f228bbcc22f3ae5935f1a81a84d3913d41dbef0a7f84070b20a50ba79839b01283d75914cc09c1c458e62bf352dceb868ffd6693a753a9fb4fa05059c030f

Download Submit
\Windows\system\uJXQLMY.exe

Filesize
1.9MB

MD5
dd937e7e5505af36e0c205115fb9b921

SHA1
cdd4b4b0c09e9f29aa0d5b2c33691a135af578c7

SHA256
ddba3c668c8d33119cc87a1500855369caa5e1dd084b9892296fbd8f6a7d895b

SHA512
8adba96cc614ed78f4ce944d2eb98207e242b278a4e893ee5ba26df2c71f964a0ead21cec0aa44611d10b0113fd362762da671d10750907fd11c8e1dd2582b63

Download Submit
\Windows\system\wLbLtFm.exe

Filesize
1.9MB

MD5
3a4f767853bca7616d416cf6f2f01a4a

SHA1
e15699f54b3108e79f97a5f5bd156968498c4fe7

SHA256
85e995d70ae292983e27b717fdb484764f42703faee2ffc73ad6a4e95be031e6

SHA512
805527b44fd17256b9f487edbd134736e958ba86d51221ca799eae64c1af268289377df0d72c3b9f888ef0c9b8fd3ffbc63cda23695cddfd1b04ed67db5eca38

Download Submit
\Windows\system\wnLcsZT.exe

Filesize
1.9MB

MD5
9853697e18656c02652883f17db2ef87

SHA1
cfc970711d1e13e723f54bc38bbce240d97762e7

SHA256
3dd6310f80eebaa67ea28d1ecad7aae8ee89da8f99075145c2d1f33f2eefe5b4

SHA512
9751169ba1cdec612f8e4357ebed06c6258fe8ea66784067431167052cdfef9afc1d217b4332631ffe531886109dccc8ad4912399bfbfcca4ba922dd289982cd

Download Submit
\Windows\system\wzJmPCR.exe

Filesize
1.9MB

MD5
eacbcc393eed059acc9bb1fc13aec478

SHA1
e4c9e72c07e0c23ee0fd0f27bd0c7fb79123e37e

SHA256
69c10ba0b5cc88abd827b012ee0f3cbe65877f3deb68bda24f485ae43d0c4821

SHA512
73b20a97acff626d6ed8c8f25b8d594cbd9128dc8b0fdb124b0a78e775962f34deba933ce4df99ea47b155c6a20c8bc3b57a37d74981d528793c0ac4f7a9af7f

Download Submit
\Windows\system\yYQAWGh.exe

Filesize
1.9MB

MD5
61072fcb0fe65e738efdbe0a5f7a905e

SHA1
ac5cbb299c16f68bb8033a80291322700a34c257

SHA256
7bfd5a103165415c29e560faa25562091cbb38b2b6c3bd1e8711793942519504

SHA512
5f1b1913fd0f3a4f049cd24e26102a737b2bd8801ad3d08e23efed74a1a4161c708a99d00d941fa50699f9010509772271f4706a477e919e18fe39c4961cdb3c

Download Submit
\Windows\system\zypZrIh.exe

Filesize
1.9MB

MD5
cbb4713c5db16ce4cd07ba87fad7ebfb

SHA1
ef9e0fc47df8555257d253df0a0f1d0af191c30b

SHA256
4e3e7675eb71595e622185d378669e27451ecf150160cc87233fcedc791650df

SHA512
5613da0a0e6e579ea9510c1433c870d291a1dce56d84c204ac0aa0ee463009924558c06f4565d2ba601400870833257b84fee505eef4a6c41e6845c1dfcc41a2

Download Submit
memory/1624-49-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/1624-5382-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2208-5249-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-39-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-112-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2216-118-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2316-83-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-5390-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-50-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2500-5252-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2516-5251-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2516-34-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2528-151-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-5387-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-162-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5393-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-160-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-63-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2824-2-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-28-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2824-30-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2824-41-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-89-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-12-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2824-163-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-47-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2824-11379-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2824-57-0x0000000003120000-0x0000000003512000-memory.dmp

Filesize
3.9MB

Download
memory/2824-161-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2824-96-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2824-97-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2824-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2824-164-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-21-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2948-5241-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download