xmrig | f7e60c8b980daeed2c2cf9bd21b84366b4ec709817d162f2a10d0aa96bccd247

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
Size

1.9MB
MD5

9b88f2bb9c66b2500b57373fe6627440
SHA1

001d399980291234a614d020c95deae9bf32e3bb
SHA256

f7e60c8b980daeed2c2cf9bd21b84366b4ec709817d162f2a10d0aa96bccd247
SHA512

12eb76350b2f4a66d159854d7db53f02dcf8ea2dbfbd6a20dc4da451c4d9d7534b5aa1996eeb2db1d8d586dc5a9f89d0bc30868fad523d47fb0ac4baf16f7baa
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc3Ukwf:NABb

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/3492-35-0x00007FF63AF80000-0x00007FF63B372000-memory.dmp	xmrig
behavioral2/memory/3904-292-0x00007FF7E0540000-0x00007FF7E0932000-memory.dmp	xmrig
behavioral2/memory/1200-340-0x00007FF757400000-0x00007FF7577F2000-memory.dmp	xmrig
behavioral2/memory/4644-518-0x00007FF6E3C00000-0x00007FF6E3FF2000-memory.dmp	xmrig
behavioral2/memory/3200-562-0x00007FF68CC00000-0x00007FF68CFF2000-memory.dmp	xmrig
behavioral2/memory/4820-1037-0x00007FF734820000-0x00007FF734C12000-memory.dmp	xmrig
behavioral2/memory/4900-1040-0x00007FF72FA30000-0x00007FF72FE22000-memory.dmp	xmrig
behavioral2/memory/1116-782-0x00007FF73EDF0000-0x00007FF73F1E2000-memory.dmp	xmrig
behavioral2/memory/212-665-0x00007FF706150000-0x00007FF706542000-memory.dmp	xmrig
behavioral2/memory/2724-664-0x00007FF7D4590000-0x00007FF7D4982000-memory.dmp	xmrig
behavioral2/memory/1304-423-0x00007FF7F0920000-0x00007FF7F0D12000-memory.dmp	xmrig
behavioral2/memory/3964-346-0x00007FF79C780000-0x00007FF79CB72000-memory.dmp	xmrig
behavioral2/memory/1480-345-0x00007FF6D1A30000-0x00007FF6D1E22000-memory.dmp	xmrig
behavioral2/memory/4956-343-0x00007FF736350000-0x00007FF736742000-memory.dmp	xmrig
behavioral2/memory/4508-342-0x00007FF663100000-0x00007FF6634F2000-memory.dmp	xmrig
behavioral2/memory/4580-253-0x00007FF6C57E0000-0x00007FF6C5BD2000-memory.dmp	xmrig
behavioral2/memory/4436-240-0x00007FF764820000-0x00007FF764C12000-memory.dmp	xmrig
behavioral2/memory/2388-204-0x00007FF78E920000-0x00007FF78ED12000-memory.dmp	xmrig
behavioral2/memory/1052-156-0x00007FF60DC00000-0x00007FF60DFF2000-memory.dmp	xmrig
behavioral2/memory/872-155-0x00007FF714630000-0x00007FF714A22000-memory.dmp	xmrig
behavioral2/memory/5016-117-0x00007FF7C8180000-0x00007FF7C8572000-memory.dmp	xmrig
behavioral2/memory/1788-87-0x00007FF69F1F0000-0x00007FF69F5E2000-memory.dmp	xmrig
behavioral2/memory/2312-3751-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp	xmrig
behavioral2/memory/2312-3785-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp	xmrig
behavioral2/memory/3492-3787-0x00007FF63AF80000-0x00007FF63B372000-memory.dmp	xmrig
behavioral2/memory/5016-3792-0x00007FF7C8180000-0x00007FF7C8572000-memory.dmp	xmrig
behavioral2/memory/872-3793-0x00007FF714630000-0x00007FF714A22000-memory.dmp	xmrig
behavioral2/memory/1788-3795-0x00007FF69F1F0000-0x00007FF69F5E2000-memory.dmp	xmrig
behavioral2/memory/2364-3790-0x00007FF714430000-0x00007FF714822000-memory.dmp	xmrig
behavioral2/memory/4580-3811-0x00007FF6C57E0000-0x00007FF6C5BD2000-memory.dmp	xmrig
behavioral2/memory/4900-3802-0x00007FF72FA30000-0x00007FF72FE22000-memory.dmp	xmrig
behavioral2/memory/1052-3797-0x00007FF60DC00000-0x00007FF60DFF2000-memory.dmp	xmrig
behavioral2/memory/4820-3812-0x00007FF734820000-0x00007FF734C12000-memory.dmp	xmrig
behavioral2/memory/3904-3824-0x00007FF7E0540000-0x00007FF7E0932000-memory.dmp	xmrig
behavioral2/memory/2724-3828-0x00007FF7D4590000-0x00007FF7D4982000-memory.dmp	xmrig
behavioral2/memory/4644-3831-0x00007FF6E3C00000-0x00007FF6E3FF2000-memory.dmp	xmrig
behavioral2/memory/4508-3833-0x00007FF663100000-0x00007FF6634F2000-memory.dmp	xmrig
behavioral2/memory/3200-3835-0x00007FF68CC00000-0x00007FF68CFF2000-memory.dmp	xmrig
behavioral2/memory/212-3826-0x00007FF706150000-0x00007FF706542000-memory.dmp	xmrig
behavioral2/memory/4436-3823-0x00007FF764820000-0x00007FF764C12000-memory.dmp	xmrig
behavioral2/memory/2388-3821-0x00007FF78E920000-0x00007FF78ED12000-memory.dmp	xmrig
behavioral2/memory/3964-3819-0x00007FF79C780000-0x00007FF79CB72000-memory.dmp	xmrig
behavioral2/memory/1480-3816-0x00007FF6D1A30000-0x00007FF6D1E22000-memory.dmp	xmrig
behavioral2/memory/1304-3809-0x00007FF7F0920000-0x00007FF7F0D12000-memory.dmp	xmrig
behavioral2/memory/1200-3806-0x00007FF757400000-0x00007FF7577F2000-memory.dmp	xmrig
behavioral2/memory/4956-3804-0x00007FF736350000-0x00007FF736742000-memory.dmp	xmrig
behavioral2/memory/1116-3814-0x00007FF73EDF0000-0x00007FF73F1E2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3268	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2312	UPSbPeK.exe
3492	PYTCuuN.exe
2364	jjFJLrj.exe
1788	YHeatJH.exe
5016	RJwVYeo.exe
872	DbAGrxG.exe
1116	IHYqrUC.exe
1052	cmWoxCg.exe
2388	JXcqCKX.exe
4436	woOwkEf.exe
4820	YXznOsi.exe
4580	bMVGzAm.exe
3904	meajDTe.exe
1200	fzjJLUx.exe
4508	IYGVvkb.exe
4956	VbAikwy.exe
4900	JAWPhAt.exe
1480	IQcsKwC.exe
3964	gHvJrlH.exe
1304	bDwoeqW.exe
4644	tdJxenk.exe
3200	TSrynJA.exe
2724	yxzizgQ.exe
212	LhfAIUj.exe
1652	rFPvITV.exe
3672	FjXMMgO.exe
1236	XTxsALe.exe
5004	wJEdYld.exe
2932	bpcBHtS.exe
4584	cPJjymt.exe
3960	wzQNWEX.exe
3172	pKnFIvi.exe
1056	QwCbNTY.exe
4664	yanWjTf.exe
2788	yGGWVsS.exe
2764	fIOQeTd.exe
4676	YdapEkG.exe
336	zOdxDBB.exe
1752	PAQNuer.exe
4804	KTGazrn.exe
1448	QscrNek.exe
5088	NwzxCkw.exe
5096	tPEJdmk.exe
4560	AtBpJYF.exe
2868	ZDATxNy.exe
4672	AfsgxCC.exe
4748	ghowLMN.exe
4904	iSnBHoO.exe
1892	yitMTUl.exe
4036	nlVEIFs.exe
2036	FURgaok.exe
2636	ZTAucVB.exe
4936	jHjvSJb.exe
4616	NqjRHYh.exe
4380	alCknIQ.exe
4284	JxXTgXE.exe
2244	YEVGDAL.exe
5092	SFBAfwG.exe
4968	BDfrUDX.exe
5140	KjxhYvr.exe
5156	lTZsnGl.exe
5180	CBIGzvX.exe
5196	nHBUifk.exe
5212	kYunoXa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/624-0-0x00007FF68C7B0000-0x00007FF68CBA2000-memory.dmp	upx
behavioral2/files/0x00090000000235f6-5.dat	upx
behavioral2/files/0x00080000000235fc-7.dat	upx
behavioral2/memory/3492-35-0x00007FF63AF80000-0x00007FF63B372000-memory.dmp	upx
behavioral2/memory/2364-52-0x00007FF714430000-0x00007FF714822000-memory.dmp	upx
behavioral2/files/0x00080000000235f9-60.dat	upx
behavioral2/files/0x0007000000023605-81.dat	upx
behavioral2/files/0x0007000000023610-178.dat	upx
behavioral2/memory/3904-292-0x00007FF7E0540000-0x00007FF7E0932000-memory.dmp	upx
behavioral2/memory/1200-340-0x00007FF757400000-0x00007FF7577F2000-memory.dmp	upx
behavioral2/memory/4644-518-0x00007FF6E3C00000-0x00007FF6E3FF2000-memory.dmp	upx
behavioral2/memory/3200-562-0x00007FF68CC00000-0x00007FF68CFF2000-memory.dmp	upx
behavioral2/memory/4820-1037-0x00007FF734820000-0x00007FF734C12000-memory.dmp	upx
behavioral2/memory/4900-1040-0x00007FF72FA30000-0x00007FF72FE22000-memory.dmp	upx
behavioral2/memory/1116-782-0x00007FF73EDF0000-0x00007FF73F1E2000-memory.dmp	upx
behavioral2/memory/212-665-0x00007FF706150000-0x00007FF706542000-memory.dmp	upx
behavioral2/memory/2724-664-0x00007FF7D4590000-0x00007FF7D4982000-memory.dmp	upx
behavioral2/memory/1304-423-0x00007FF7F0920000-0x00007FF7F0D12000-memory.dmp	upx
behavioral2/memory/3964-346-0x00007FF79C780000-0x00007FF79CB72000-memory.dmp	upx
behavioral2/memory/1480-345-0x00007FF6D1A30000-0x00007FF6D1E22000-memory.dmp	upx
behavioral2/memory/4956-343-0x00007FF736350000-0x00007FF736742000-memory.dmp	upx
behavioral2/memory/4508-342-0x00007FF663100000-0x00007FF6634F2000-memory.dmp	upx
behavioral2/memory/4580-253-0x00007FF6C57E0000-0x00007FF6C5BD2000-memory.dmp	upx
behavioral2/memory/4436-240-0x00007FF764820000-0x00007FF764C12000-memory.dmp	upx
behavioral2/files/0x00080000000235fa-212.dat	upx
behavioral2/files/0x0007000000023615-208.dat	upx
behavioral2/memory/2388-204-0x00007FF78E920000-0x00007FF78ED12000-memory.dmp	upx
behavioral2/files/0x000700000002361d-199.dat	upx
behavioral2/files/0x0007000000023612-191.dat	upx
behavioral2/files/0x0007000000023611-188.dat	upx
behavioral2/files/0x000700000002361c-187.dat	upx
behavioral2/files/0x0007000000023619-183.dat	upx
behavioral2/files/0x000700000002360f-177.dat	upx
behavioral2/files/0x0007000000023618-174.dat	upx
behavioral2/files/0x0007000000023617-173.dat	upx
behavioral2/files/0x000700000002360e-167.dat	upx
behavioral2/files/0x0007000000023616-165.dat	upx
behavioral2/files/0x0007000000023614-159.dat	upx
behavioral2/memory/1052-156-0x00007FF60DC00000-0x00007FF60DFF2000-memory.dmp	upx
behavioral2/memory/872-155-0x00007FF714630000-0x00007FF714A22000-memory.dmp	upx
behavioral2/files/0x000700000002360b-153.dat	upx
behavioral2/files/0x0007000000023609-132.dat	upx
behavioral2/files/0x0007000000023608-128.dat	upx
behavioral2/files/0x0007000000023613-120.dat	upx
behavioral2/files/0x000700000002360c-119.dat	upx
behavioral2/memory/5016-117-0x00007FF7C8180000-0x00007FF7C8572000-memory.dmp	upx
behavioral2/files/0x000700000002360a-151.dat	upx
behavioral2/files/0x0007000000023606-113.dat	upx
behavioral2/files/0x0007000000023607-129.dat	upx
behavioral2/files/0x0007000000023602-103.dat	upx
behavioral2/files/0x000700000002360d-101.dat	upx
behavioral2/files/0x0007000000023604-100.dat	upx
behavioral2/memory/1788-87-0x00007FF69F1F0000-0x00007FF69F5E2000-memory.dmp	upx
behavioral2/files/0x0007000000023600-69.dat	upx
behavioral2/files/0x0007000000023603-75.dat	upx
behavioral2/files/0x0007000000023601-66.dat	upx
behavioral2/files/0x00070000000235fe-48.dat	upx
behavioral2/files/0x00070000000235fd-41.dat	upx
behavioral2/files/0x00070000000235ff-34.dat	upx
behavioral2/memory/2312-14-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp	upx
behavioral2/memory/2312-3751-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp	upx
behavioral2/memory/2312-3785-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp	upx
behavioral2/memory/3492-3787-0x00007FF63AF80000-0x00007FF63B372000-memory.dmp	upx
behavioral2/memory/5016-3792-0x00007FF7C8180000-0x00007FF7C8572000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PpSnOhi.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\nxHTmIC.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gFkgxsj.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gXxAnrl.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\DGEHbCP.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\jPsfjLQ.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\sErQIhW.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\itajExM.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\VkyGNPV.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\fIOQeTd.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\kmRJwYw.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\dkYRWAO.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\XTxsALe.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\KkSOtqg.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\SItFGHc.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\xsSZhZi.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\akFhjdV.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\hsdkuoX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\YwlZPJs.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\vdsHeKT.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\lAIrwjd.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\bYktlPS.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\GhzEerX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\HlsBtPe.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\QwCbNTY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\lNRWBHk.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\cArZukG.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\PevsKFZ.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\DwSiJIY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\wktWRPY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\bDwoeqW.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\zNYXhVa.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\FChviOX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\zRHHIIj.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\gOpMVfa.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\FURgaok.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\pbHmfZI.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\TaziTTS.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\JyeEhQS.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\WpSKLSD.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\tCibaWJ.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\VpWiCNM.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\PmWhlEk.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\MdiIXmK.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\iKMguYU.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\wBeaVOh.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\btWfLIX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\sCxnMYY.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\QMKMvhc.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\bluxBMq.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\nDxrrto.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\qtgfAty.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\vKiYtIp.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\ICVHXzb.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\xLUPFGz.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\WekcGnG.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\JvCpZzV.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\LczmVcb.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\coAFHLg.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\wpfDRUk.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\TqbDDEX.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\iAZTaHx.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\NPMwYsb.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
File created	C:\Windows\System\vNNKLjf.exe	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeLockMemoryPrivilege	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
Token: SeLockMemoryPrivilege	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3268	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	88
PID 624 wrote to memory of 3268	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	88
PID 624 wrote to memory of 2312	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	89
PID 624 wrote to memory of 2312	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	89
PID 624 wrote to memory of 2364	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	90
PID 624 wrote to memory of 2364	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	90
PID 624 wrote to memory of 3492	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	91
PID 624 wrote to memory of 3492	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	91
PID 624 wrote to memory of 1788	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	92
PID 624 wrote to memory of 1788	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	92
PID 624 wrote to memory of 5016	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	93
PID 624 wrote to memory of 5016	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	93
PID 624 wrote to memory of 872	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	94
PID 624 wrote to memory of 872	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	94
PID 624 wrote to memory of 1052	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	95
PID 624 wrote to memory of 1052	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	95
PID 624 wrote to memory of 1116	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	96
PID 624 wrote to memory of 1116	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	96
PID 624 wrote to memory of 3904	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	97
PID 624 wrote to memory of 3904	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	97
PID 624 wrote to memory of 2388	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	98
PID 624 wrote to memory of 2388	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	98
PID 624 wrote to memory of 4436	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	99
PID 624 wrote to memory of 4436	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	99
PID 624 wrote to memory of 4820	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	100
PID 624 wrote to memory of 4820	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	100
PID 624 wrote to memory of 4580	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	101
PID 624 wrote to memory of 4580	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	101
PID 624 wrote to memory of 1200	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	102
PID 624 wrote to memory of 1200	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	102
PID 624 wrote to memory of 4508	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	103
PID 624 wrote to memory of 4508	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	103
PID 624 wrote to memory of 4956	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	104
PID 624 wrote to memory of 4956	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	104
PID 624 wrote to memory of 4900	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	105
PID 624 wrote to memory of 4900	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	105
PID 624 wrote to memory of 1480	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	106
PID 624 wrote to memory of 1480	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	106
PID 624 wrote to memory of 3964	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	107
PID 624 wrote to memory of 3964	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	107
PID 624 wrote to memory of 1304	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	108
PID 624 wrote to memory of 1304	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	108
PID 624 wrote to memory of 4644	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	109
PID 624 wrote to memory of 4644	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	109
PID 624 wrote to memory of 3200	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	110
PID 624 wrote to memory of 3200	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	110
PID 624 wrote to memory of 2724	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	111
PID 624 wrote to memory of 2724	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	111
PID 624 wrote to memory of 212	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	112
PID 624 wrote to memory of 212	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	112
PID 624 wrote to memory of 1652	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	113
PID 624 wrote to memory of 1652	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	113
PID 624 wrote to memory of 3672	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	114
PID 624 wrote to memory of 3672	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	114
PID 624 wrote to memory of 1236	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	115
PID 624 wrote to memory of 1236	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	115
PID 624 wrote to memory of 5004	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	116
PID 624 wrote to memory of 5004	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	116
PID 624 wrote to memory of 2932	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	117
PID 624 wrote to memory of 2932	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	117
PID 624 wrote to memory of 4584	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	118
PID 624 wrote to memory of 4584	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	118
PID 624 wrote to memory of 3960	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	119
PID 624 wrote to memory of 3960	624	9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe	119

C:\Users\Admin\AppData\Local\Temp\9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\9b88f2bb9c66b2500b57373fe6627440_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Windows\System\UPSbPeK.exe
  C:\Windows\System\UPSbPeK.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\jjFJLrj.exe
  C:\Windows\System\jjFJLrj.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\PYTCuuN.exe
  C:\Windows\System\PYTCuuN.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\YHeatJH.exe
  C:\Windows\System\YHeatJH.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\RJwVYeo.exe
  C:\Windows\System\RJwVYeo.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\DbAGrxG.exe
  C:\Windows\System\DbAGrxG.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\cmWoxCg.exe
  C:\Windows\System\cmWoxCg.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\IHYqrUC.exe
  C:\Windows\System\IHYqrUC.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\meajDTe.exe
  C:\Windows\System\meajDTe.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\JXcqCKX.exe
  C:\Windows\System\JXcqCKX.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\woOwkEf.exe
  C:\Windows\System\woOwkEf.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\YXznOsi.exe
  C:\Windows\System\YXznOsi.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\bMVGzAm.exe
  C:\Windows\System\bMVGzAm.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\fzjJLUx.exe
  C:\Windows\System\fzjJLUx.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\IYGVvkb.exe
  C:\Windows\System\IYGVvkb.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\VbAikwy.exe
  C:\Windows\System\VbAikwy.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\JAWPhAt.exe
  C:\Windows\System\JAWPhAt.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\IQcsKwC.exe
  C:\Windows\System\IQcsKwC.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\gHvJrlH.exe
  C:\Windows\System\gHvJrlH.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\bDwoeqW.exe
  C:\Windows\System\bDwoeqW.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\tdJxenk.exe
  C:\Windows\System\tdJxenk.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\TSrynJA.exe
  C:\Windows\System\TSrynJA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\yxzizgQ.exe
  C:\Windows\System\yxzizgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\LhfAIUj.exe
  C:\Windows\System\LhfAIUj.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\rFPvITV.exe
  C:\Windows\System\rFPvITV.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\FjXMMgO.exe
  C:\Windows\System\FjXMMgO.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\XTxsALe.exe
  C:\Windows\System\XTxsALe.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\wJEdYld.exe
  C:\Windows\System\wJEdYld.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\bpcBHtS.exe
  C:\Windows\System\bpcBHtS.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cPJjymt.exe
  C:\Windows\System\cPJjymt.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\wzQNWEX.exe
  C:\Windows\System\wzQNWEX.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\pKnFIvi.exe
  C:\Windows\System\pKnFIvi.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\QwCbNTY.exe
  C:\Windows\System\QwCbNTY.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\yanWjTf.exe
  C:\Windows\System\yanWjTf.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\yGGWVsS.exe
  C:\Windows\System\yGGWVsS.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\fIOQeTd.exe
  C:\Windows\System\fIOQeTd.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\YdapEkG.exe
  C:\Windows\System\YdapEkG.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\zOdxDBB.exe
  C:\Windows\System\zOdxDBB.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\PAQNuer.exe
  C:\Windows\System\PAQNuer.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\KTGazrn.exe
  C:\Windows\System\KTGazrn.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\QscrNek.exe
  C:\Windows\System\QscrNek.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\NwzxCkw.exe
  C:\Windows\System\NwzxCkw.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\tPEJdmk.exe
  C:\Windows\System\tPEJdmk.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\AtBpJYF.exe
  C:\Windows\System\AtBpJYF.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\ZDATxNy.exe
  C:\Windows\System\ZDATxNy.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\AfsgxCC.exe
  C:\Windows\System\AfsgxCC.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\ghowLMN.exe
  C:\Windows\System\ghowLMN.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\iSnBHoO.exe
  C:\Windows\System\iSnBHoO.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\yitMTUl.exe
  C:\Windows\System\yitMTUl.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\nlVEIFs.exe
  C:\Windows\System\nlVEIFs.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\FURgaok.exe
  C:\Windows\System\FURgaok.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ZTAucVB.exe
  C:\Windows\System\ZTAucVB.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\jHjvSJb.exe
  C:\Windows\System\jHjvSJb.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\NqjRHYh.exe
  C:\Windows\System\NqjRHYh.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\alCknIQ.exe
  C:\Windows\System\alCknIQ.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\JxXTgXE.exe
  C:\Windows\System\JxXTgXE.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\YEVGDAL.exe
  C:\Windows\System\YEVGDAL.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\SFBAfwG.exe
  C:\Windows\System\SFBAfwG.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\BDfrUDX.exe
  C:\Windows\System\BDfrUDX.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\KjxhYvr.exe
  C:\Windows\System\KjxhYvr.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\lTZsnGl.exe
  C:\Windows\System\lTZsnGl.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\CBIGzvX.exe
  C:\Windows\System\CBIGzvX.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\nHBUifk.exe
  C:\Windows\System\nHBUifk.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\kYunoXa.exe
  C:\Windows\System\kYunoXa.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\ABQtYIY.exe
  C:\Windows\System\ABQtYIY.exe
  2⤵
  PID:5228
- C:\Windows\System\DzrOldK.exe
  C:\Windows\System\DzrOldK.exe
  2⤵
  PID:5244
- C:\Windows\System\TCbQrwK.exe
  C:\Windows\System\TCbQrwK.exe
  2⤵
  PID:5260
- C:\Windows\System\DicuFte.exe
  C:\Windows\System\DicuFte.exe
  2⤵
  PID:5276
- C:\Windows\System\JPZjljL.exe
  C:\Windows\System\JPZjljL.exe
  2⤵
  PID:5308
- C:\Windows\System\pxMBMTK.exe
  C:\Windows\System\pxMBMTK.exe
  2⤵
  PID:5328
- C:\Windows\System\DqXScEM.exe
  C:\Windows\System\DqXScEM.exe
  2⤵
  PID:5356
- C:\Windows\System\zNYXhVa.exe
  C:\Windows\System\zNYXhVa.exe
  2⤵
  PID:5372
- C:\Windows\System\lELtKCT.exe
  C:\Windows\System\lELtKCT.exe
  2⤵
  PID:5392
- C:\Windows\System\bNVMUch.exe
  C:\Windows\System\bNVMUch.exe
  2⤵
  PID:5440
- C:\Windows\System\YwlZPJs.exe
  C:\Windows\System\YwlZPJs.exe
  2⤵
  PID:5456
- C:\Windows\System\kSEKRaF.exe
  C:\Windows\System\kSEKRaF.exe
  2⤵
  PID:5476
- C:\Windows\System\ZmBTFfE.exe
  C:\Windows\System\ZmBTFfE.exe
  2⤵
  PID:5496
- C:\Windows\System\QcYkGnK.exe
  C:\Windows\System\QcYkGnK.exe
  2⤵
  PID:5512
- C:\Windows\System\EZjafGD.exe
  C:\Windows\System\EZjafGD.exe
  2⤵
  PID:5528
- C:\Windows\System\ihSJpyd.exe
  C:\Windows\System\ihSJpyd.exe
  2⤵
  PID:5544
- C:\Windows\System\LPUTpmf.exe
  C:\Windows\System\LPUTpmf.exe
  2⤵
  PID:5564
- C:\Windows\System\akWlDZN.exe
  C:\Windows\System\akWlDZN.exe
  2⤵
  PID:5592
- C:\Windows\System\uvohJze.exe
  C:\Windows\System\uvohJze.exe
  2⤵
  PID:5628
- C:\Windows\System\qlvjiNU.exe
  C:\Windows\System\qlvjiNU.exe
  2⤵
  PID:5644
- C:\Windows\System\XCNeNFu.exe
  C:\Windows\System\XCNeNFu.exe
  2⤵
  PID:5692
- C:\Windows\System\vFqAHfD.exe
  C:\Windows\System\vFqAHfD.exe
  2⤵
  PID:5712
- C:\Windows\System\RbkIWEw.exe
  C:\Windows\System\RbkIWEw.exe
  2⤵
  PID:5740
- C:\Windows\System\IvGBFQE.exe
  C:\Windows\System\IvGBFQE.exe
  2⤵
  PID:5764
- C:\Windows\System\umcZvjb.exe
  C:\Windows\System\umcZvjb.exe
  2⤵
  PID:5784
- C:\Windows\System\rhZbKMZ.exe
  C:\Windows\System\rhZbKMZ.exe
  2⤵
  PID:5808
- C:\Windows\System\bgRCDeB.exe
  C:\Windows\System\bgRCDeB.exe
  2⤵
  PID:5824
- C:\Windows\System\ziJvDAB.exe
  C:\Windows\System\ziJvDAB.exe
  2⤵
  PID:5848
- C:\Windows\System\jDYpozY.exe
  C:\Windows\System\jDYpozY.exe
  2⤵
  PID:5872
- C:\Windows\System\cfbBRyH.exe
  C:\Windows\System\cfbBRyH.exe
  2⤵
  PID:5892
- C:\Windows\System\zPpAwKH.exe
  C:\Windows\System\zPpAwKH.exe
  2⤵
  PID:5916
- C:\Windows\System\TDvDcDA.exe
  C:\Windows\System\TDvDcDA.exe
  2⤵
  PID:5932
- C:\Windows\System\mKFPpvQ.exe
  C:\Windows\System\mKFPpvQ.exe
  2⤵
  PID:5952
- C:\Windows\System\tIfKZxQ.exe
  C:\Windows\System\tIfKZxQ.exe
  2⤵
  PID:5968
- C:\Windows\System\uyPyypi.exe
  C:\Windows\System\uyPyypi.exe
  2⤵
  PID:5988
- C:\Windows\System\soIMtae.exe
  C:\Windows\System\soIMtae.exe
  2⤵
  PID:6004
- C:\Windows\System\VPCPjrF.exe
  C:\Windows\System\VPCPjrF.exe
  2⤵
  PID:6020
- C:\Windows\System\DZCXYJi.exe
  C:\Windows\System\DZCXYJi.exe
  2⤵
  PID:3460
- C:\Windows\System\DqbvXwG.exe
  C:\Windows\System\DqbvXwG.exe
  2⤵
  PID:1244
- C:\Windows\System\IXfyqcG.exe
  C:\Windows\System\IXfyqcG.exe
  2⤵
  PID:5384
- C:\Windows\System\ABIFFSJ.exe
  C:\Windows\System\ABIFFSJ.exe
  2⤵
  PID:1596
- C:\Windows\System\YKfLOCy.exe
  C:\Windows\System\YKfLOCy.exe
  2⤵
  PID:3660
- C:\Windows\System\LPYbKUr.exe
  C:\Windows\System\LPYbKUr.exe
  2⤵
  PID:5448
- C:\Windows\System\RHtYOys.exe
  C:\Windows\System\RHtYOys.exe
  2⤵
  PID:5136
- C:\Windows\System\KwNSHji.exe
  C:\Windows\System\KwNSHji.exe
  2⤵
  PID:2692
- C:\Windows\System\RDAPBlL.exe
  C:\Windows\System\RDAPBlL.exe
  2⤵
  PID:4008
- C:\Windows\System\wcKjudn.exe
  C:\Windows\System\wcKjudn.exe
  2⤵
  PID:3864
- C:\Windows\System\gXxAnrl.exe
  C:\Windows\System\gXxAnrl.exe
  2⤵
  PID:2696
- C:\Windows\System\fmLxzcV.exe
  C:\Windows\System\fmLxzcV.exe
  2⤵
  PID:5268
- C:\Windows\System\tvUoVVO.exe
  C:\Windows\System\tvUoVVO.exe
  2⤵
  PID:5316
- C:\Windows\System\ePUjEmu.exe
  C:\Windows\System\ePUjEmu.exe
  2⤵
  PID:5340
- C:\Windows\System\fqTGPKs.exe
  C:\Windows\System\fqTGPKs.exe
  2⤵
  PID:5380
- C:\Windows\System\dAydEFd.exe
  C:\Windows\System\dAydEFd.exe
  2⤵
  PID:5452
- C:\Windows\System\nvHBrIj.exe
  C:\Windows\System\nvHBrIj.exe
  2⤵
  PID:5520
- C:\Windows\System\ZumJPUs.exe
  C:\Windows\System\ZumJPUs.exe
  2⤵
  PID:5556
- C:\Windows\System\WpFTNKM.exe
  C:\Windows\System\WpFTNKM.exe
  2⤵
  PID:5600
- C:\Windows\System\PLFHzJF.exe
  C:\Windows\System\PLFHzJF.exe
  2⤵
  PID:5636
- C:\Windows\System\JYbfXuC.exe
  C:\Windows\System\JYbfXuC.exe
  2⤵
  PID:5664
- C:\Windows\System\LczmVcb.exe
  C:\Windows\System\LczmVcb.exe
  2⤵
  PID:5700
- C:\Windows\System\mLxvMin.exe
  C:\Windows\System\mLxvMin.exe
  2⤵
  PID:5756
- C:\Windows\System\FrPDhXy.exe
  C:\Windows\System\FrPDhXy.exe
  2⤵
  PID:5780
- C:\Windows\System\ywIYPDJ.exe
  C:\Windows\System\ywIYPDJ.exe
  2⤵
  PID:5820
- C:\Windows\System\prucQsx.exe
  C:\Windows\System\prucQsx.exe
  2⤵
  PID:5856
- C:\Windows\System\kISlWcx.exe
  C:\Windows\System\kISlWcx.exe
  2⤵
  PID:5900
- C:\Windows\System\QYMGshW.exe
  C:\Windows\System\QYMGshW.exe
  2⤵
  PID:5948
- C:\Windows\System\BbRMjeq.exe
  C:\Windows\System\BbRMjeq.exe
  2⤵
  PID:5996
- C:\Windows\System\DdaDkAF.exe
  C:\Windows\System\DdaDkAF.exe
  2⤵
  PID:6152
- C:\Windows\System\vbjgfWh.exe
  C:\Windows\System\vbjgfWh.exe
  2⤵
  PID:6172
- C:\Windows\System\fdKefXm.exe
  C:\Windows\System\fdKefXm.exe
  2⤵
  PID:6192
- C:\Windows\System\HRukZGl.exe
  C:\Windows\System\HRukZGl.exe
  2⤵
  PID:6216
- C:\Windows\System\TrVfijL.exe
  C:\Windows\System\TrVfijL.exe
  2⤵
  PID:6236
- C:\Windows\System\pbHmfZI.exe
  C:\Windows\System\pbHmfZI.exe
  2⤵
  PID:6260
- C:\Windows\System\ZsJrQxX.exe
  C:\Windows\System\ZsJrQxX.exe
  2⤵
  PID:6276
- C:\Windows\System\sPRqrvY.exe
  C:\Windows\System\sPRqrvY.exe
  2⤵
  PID:6308
- C:\Windows\System\LURXSTP.exe
  C:\Windows\System\LURXSTP.exe
  2⤵
  PID:6324
- C:\Windows\System\xXnpLII.exe
  C:\Windows\System\xXnpLII.exe
  2⤵
  PID:6348
- C:\Windows\System\FQZsooX.exe
  C:\Windows\System\FQZsooX.exe
  2⤵
  PID:6364
- C:\Windows\System\hknfreT.exe
  C:\Windows\System\hknfreT.exe
  2⤵
  PID:6388
- C:\Windows\System\mJSKVMH.exe
  C:\Windows\System\mJSKVMH.exe
  2⤵
  PID:6420
- C:\Windows\System\hSLcsvG.exe
  C:\Windows\System\hSLcsvG.exe
  2⤵
  PID:6436
- C:\Windows\System\tQbSAjZ.exe
  C:\Windows\System\tQbSAjZ.exe
  2⤵
  PID:6456
- C:\Windows\System\wQEswUR.exe
  C:\Windows\System\wQEswUR.exe
  2⤵
  PID:6480
- C:\Windows\System\qIhSEcv.exe
  C:\Windows\System\qIhSEcv.exe
  2⤵
  PID:6500
- C:\Windows\System\iNwVpIk.exe
  C:\Windows\System\iNwVpIk.exe
  2⤵
  PID:6524
- C:\Windows\System\qbYUZXd.exe
  C:\Windows\System\qbYUZXd.exe
  2⤵
  PID:6544
- C:\Windows\System\rbzAOhu.exe
  C:\Windows\System\rbzAOhu.exe
  2⤵
  PID:6564
- C:\Windows\System\QPHMbfU.exe
  C:\Windows\System\QPHMbfU.exe
  2⤵
  PID:6588
- C:\Windows\System\VexEbGv.exe
  C:\Windows\System\VexEbGv.exe
  2⤵
  PID:6604
- C:\Windows\System\hondAMg.exe
  C:\Windows\System\hondAMg.exe
  2⤵
  PID:6632
- C:\Windows\System\zgauxXm.exe
  C:\Windows\System\zgauxXm.exe
  2⤵
  PID:6656
- C:\Windows\System\FUxuaQV.exe
  C:\Windows\System\FUxuaQV.exe
  2⤵
  PID:6672
- C:\Windows\System\DqNVcgF.exe
  C:\Windows\System\DqNVcgF.exe
  2⤵
  PID:6696
- C:\Windows\System\jZnrBqU.exe
  C:\Windows\System\jZnrBqU.exe
  2⤵
  PID:6712
- C:\Windows\System\oRLGKNR.exe
  C:\Windows\System\oRLGKNR.exe
  2⤵
  PID:6736
- C:\Windows\System\LgHaVwz.exe
  C:\Windows\System\LgHaVwz.exe
  2⤵
  PID:6760
- C:\Windows\System\RPLKVFQ.exe
  C:\Windows\System\RPLKVFQ.exe
  2⤵
  PID:6776
- C:\Windows\System\gbKxUCI.exe
  C:\Windows\System\gbKxUCI.exe
  2⤵
  PID:6792
- C:\Windows\System\nqmfjcL.exe
  C:\Windows\System\nqmfjcL.exe
  2⤵
  PID:6808
- C:\Windows\System\NPMwYsb.exe
  C:\Windows\System\NPMwYsb.exe
  2⤵
  PID:6824
- C:\Windows\System\KuQweNX.exe
  C:\Windows\System\KuQweNX.exe
  2⤵
  PID:6840
- C:\Windows\System\pVzzbrK.exe
  C:\Windows\System\pVzzbrK.exe
  2⤵
  PID:6856
- C:\Windows\System\QKcXIZf.exe
  C:\Windows\System\QKcXIZf.exe
  2⤵
  PID:6872
- C:\Windows\System\jTokqrp.exe
  C:\Windows\System\jTokqrp.exe
  2⤵
  PID:6908
- C:\Windows\System\xLUPFGz.exe
  C:\Windows\System\xLUPFGz.exe
  2⤵
  PID:6932
- C:\Windows\System\sQtqghu.exe
  C:\Windows\System\sQtqghu.exe
  2⤵
  PID:6960
- C:\Windows\System\ukPxLjC.exe
  C:\Windows\System\ukPxLjC.exe
  2⤵
  PID:6976
- C:\Windows\System\TaziTTS.exe
  C:\Windows\System\TaziTTS.exe
  2⤵
  PID:7000
- C:\Windows\System\ifvytob.exe
  C:\Windows\System\ifvytob.exe
  2⤵
  PID:7024
- C:\Windows\System\SgvqOXs.exe
  C:\Windows\System\SgvqOXs.exe
  2⤵
  PID:7044
- C:\Windows\System\LiGdgTH.exe
  C:\Windows\System\LiGdgTH.exe
  2⤵
  PID:7076
- C:\Windows\System\DJmovdA.exe
  C:\Windows\System\DJmovdA.exe
  2⤵
  PID:7092
- C:\Windows\System\dhuoQlz.exe
  C:\Windows\System\dhuoQlz.exe
  2⤵
  PID:7120
- C:\Windows\System\bsnBwnZ.exe
  C:\Windows\System\bsnBwnZ.exe
  2⤵
  PID:7136
- C:\Windows\System\atYtPfS.exe
  C:\Windows\System\atYtPfS.exe
  2⤵
  PID:7156
- C:\Windows\System\FdXnLFW.exe
  C:\Windows\System\FdXnLFW.exe
  2⤵
  PID:1976
- C:\Windows\System\VTZuyDe.exe
  C:\Windows\System\VTZuyDe.exe
  2⤵
  PID:4552
- C:\Windows\System\uFqgebh.exe
  C:\Windows\System\uFqgebh.exe
  2⤵
  PID:5132
- C:\Windows\System\umYbhkP.exe
  C:\Windows\System\umYbhkP.exe
  2⤵
  PID:3068
- C:\Windows\System\IxQVKPo.exe
  C:\Windows\System\IxQVKPo.exe
  2⤵
  PID:5944
- C:\Windows\System\ORJUzwp.exe
  C:\Windows\System\ORJUzwp.exe
  2⤵
  PID:2400
- C:\Windows\System\PpSnOhi.exe
  C:\Windows\System\PpSnOhi.exe
  2⤵
  PID:6516
- C:\Windows\System\WOMwUiU.exe
  C:\Windows\System\WOMwUiU.exe
  2⤵
  PID:6560
- C:\Windows\System\uhbyDnQ.exe
  C:\Windows\System\uhbyDnQ.exe
  2⤵
  PID:6612
- C:\Windows\System\CuYMXxL.exe
  C:\Windows\System\CuYMXxL.exe
  2⤵
  PID:3724
- C:\Windows\System\UUMbzpQ.exe
  C:\Windows\System\UUMbzpQ.exe
  2⤵
  PID:6640
- C:\Windows\System\TlSpmez.exe
  C:\Windows\System\TlSpmez.exe
  2⤵
  PID:6784
- C:\Windows\System\HKVIwEX.exe
  C:\Windows\System\HKVIwEX.exe
  2⤵
  PID:6848
- C:\Windows\System\KkSxBTB.exe
  C:\Windows\System\KkSxBTB.exe
  2⤵
  PID:7020
- C:\Windows\System\paGWuXU.exe
  C:\Windows\System\paGWuXU.exe
  2⤵
  PID:7176
- C:\Windows\System\qHisqcc.exe
  C:\Windows\System\qHisqcc.exe
  2⤵
  PID:7196
- C:\Windows\System\hTBbiGt.exe
  C:\Windows\System\hTBbiGt.exe
  2⤵
  PID:7216
- C:\Windows\System\XizWITI.exe
  C:\Windows\System\XizWITI.exe
  2⤵
  PID:7236
- C:\Windows\System\THSOhMQ.exe
  C:\Windows\System\THSOhMQ.exe
  2⤵
  PID:7256
- C:\Windows\System\agpHgEM.exe
  C:\Windows\System\agpHgEM.exe
  2⤵
  PID:7272
- C:\Windows\System\XWZIfdZ.exe
  C:\Windows\System\XWZIfdZ.exe
  2⤵
  PID:7296
- C:\Windows\System\pleFWbI.exe
  C:\Windows\System\pleFWbI.exe
  2⤵
  PID:7312
- C:\Windows\System\mmRvExo.exe
  C:\Windows\System\mmRvExo.exe
  2⤵
  PID:7336
- C:\Windows\System\LFNtKdB.exe
  C:\Windows\System\LFNtKdB.exe
  2⤵
  PID:7352
- C:\Windows\System\cPgDmsg.exe
  C:\Windows\System\cPgDmsg.exe
  2⤵
  PID:7376
- C:\Windows\System\DGEHbCP.exe
  C:\Windows\System\DGEHbCP.exe
  2⤵
  PID:7400
- C:\Windows\System\FPojfck.exe
  C:\Windows\System\FPojfck.exe
  2⤵
  PID:7420
- C:\Windows\System\zxcNbFw.exe
  C:\Windows\System\zxcNbFw.exe
  2⤵
  PID:7440
- C:\Windows\System\ofiVlvy.exe
  C:\Windows\System\ofiVlvy.exe
  2⤵
  PID:7456
- C:\Windows\System\zUkNTdY.exe
  C:\Windows\System\zUkNTdY.exe
  2⤵
  PID:7472
- C:\Windows\System\kDEMUxe.exe
  C:\Windows\System\kDEMUxe.exe
  2⤵
  PID:7496
- C:\Windows\System\rgRAGhQ.exe
  C:\Windows\System\rgRAGhQ.exe
  2⤵
  PID:7528
- C:\Windows\System\UceRvCq.exe
  C:\Windows\System\UceRvCq.exe
  2⤵
  PID:7552
- C:\Windows\System\Lseuizp.exe
  C:\Windows\System\Lseuizp.exe
  2⤵
  PID:7572
- C:\Windows\System\xwLIyOO.exe
  C:\Windows\System\xwLIyOO.exe
  2⤵
  PID:7596
- C:\Windows\System\ZjycIMx.exe
  C:\Windows\System\ZjycIMx.exe
  2⤵
  PID:7612
- C:\Windows\System\XpcfQHU.exe
  C:\Windows\System\XpcfQHU.exe
  2⤵
  PID:7636
- C:\Windows\System\IIYEZXf.exe
  C:\Windows\System\IIYEZXf.exe
  2⤵
  PID:7660
- C:\Windows\System\VhXwVEG.exe
  C:\Windows\System\VhXwVEG.exe
  2⤵
  PID:7684
- C:\Windows\System\urrbxUk.exe
  C:\Windows\System\urrbxUk.exe
  2⤵
  PID:7700
- C:\Windows\System\ONVnWpf.exe
  C:\Windows\System\ONVnWpf.exe
  2⤵
  PID:7724
- C:\Windows\System\IbeBYrt.exe
  C:\Windows\System\IbeBYrt.exe
  2⤵
  PID:7824
- C:\Windows\System\RLHZwMN.exe
  C:\Windows\System\RLHZwMN.exe
  2⤵
  PID:7860
- C:\Windows\System\JhLnquO.exe
  C:\Windows\System\JhLnquO.exe
  2⤵
  PID:7892
- C:\Windows\System\bwjnsni.exe
  C:\Windows\System\bwjnsni.exe
  2⤵
  PID:7912
- C:\Windows\System\kMreyhJ.exe
  C:\Windows\System\kMreyhJ.exe
  2⤵
  PID:7932
- C:\Windows\System\vdsHeKT.exe
  C:\Windows\System\vdsHeKT.exe
  2⤵
  PID:7960
- C:\Windows\System\DwdJruk.exe
  C:\Windows\System\DwdJruk.exe
  2⤵
  PID:7980
- C:\Windows\System\GTpGLlO.exe
  C:\Windows\System\GTpGLlO.exe
  2⤵
  PID:8008
- C:\Windows\System\FiVYfQf.exe
  C:\Windows\System\FiVYfQf.exe
  2⤵
  PID:8024
- C:\Windows\System\LzbPoqI.exe
  C:\Windows\System\LzbPoqI.exe
  2⤵
  PID:8048
- C:\Windows\System\ulATaaM.exe
  C:\Windows\System\ulATaaM.exe
  2⤵
  PID:8072
- C:\Windows\System\ztnwAWL.exe
  C:\Windows\System\ztnwAWL.exe
  2⤵
  PID:8092
- C:\Windows\System\Vgkxcze.exe
  C:\Windows\System\Vgkxcze.exe
  2⤵
  PID:8116
- C:\Windows\System\WmMaaMe.exe
  C:\Windows\System\WmMaaMe.exe
  2⤵
  PID:8136
- C:\Windows\System\HWztptk.exe
  C:\Windows\System\HWztptk.exe
  2⤵
  PID:8156
- C:\Windows\System\uWOSCVI.exe
  C:\Windows\System\uWOSCVI.exe
  2⤵
  PID:8180
- C:\Windows\System\cViDfaV.exe
  C:\Windows\System\cViDfaV.exe
  2⤵
  PID:7104
- C:\Windows\System\VAYLiRE.exe
  C:\Windows\System\VAYLiRE.exe
  2⤵
  PID:772
- C:\Windows\System\pSZqdzs.exe
  C:\Windows\System\pSZqdzs.exe
  2⤵
  PID:2768
- C:\Windows\System\AArFzlN.exe
  C:\Windows\System\AArFzlN.exe
  2⤵
  PID:6648
- C:\Windows\System\EavOFUS.exe
  C:\Windows\System\EavOFUS.exe
  2⤵
  PID:4724
- C:\Windows\System\RdtxwfF.exe
  C:\Windows\System\RdtxwfF.exe
  2⤵
  PID:2328
- C:\Windows\System\BHvnqrP.exe
  C:\Windows\System\BHvnqrP.exe
  2⤵
  PID:5240
- C:\Windows\System\nAKonnk.exe
  C:\Windows\System\nAKonnk.exe
  2⤵
  PID:5324
- C:\Windows\System\DPnBCgc.exe
  C:\Windows\System\DPnBCgc.exe
  2⤵
  PID:5488
- C:\Windows\System\OXRQBHX.exe
  C:\Windows\System\OXRQBHX.exe
  2⤵
  PID:5616
- C:\Windows\System\iKMguYU.exe
  C:\Windows\System\iKMguYU.exe
  2⤵
  PID:5708
- C:\Windows\System\UCHAkLr.exe
  C:\Windows\System\UCHAkLr.exe
  2⤵
  PID:5804
- C:\Windows\System\cyWuePA.exe
  C:\Windows\System\cyWuePA.exe
  2⤵
  PID:5928
- C:\Windows\System\rhZestr.exe
  C:\Windows\System\rhZestr.exe
  2⤵
  PID:6464
- C:\Windows\System\fxINGgr.exe
  C:\Windows\System\fxINGgr.exe
  2⤵
  PID:6988
- C:\Windows\System\tajEJIX.exe
  C:\Windows\System\tajEJIX.exe
  2⤵
  PID:5172
- C:\Windows\System\TKLwchq.exe
  C:\Windows\System\TKLwchq.exe
  2⤵
  PID:6816
- C:\Windows\System\JwitByI.exe
  C:\Windows\System\JwitByI.exe
  2⤵
  PID:7116
- C:\Windows\System\EImRTPg.exe
  C:\Windows\System\EImRTPg.exe
  2⤵
  PID:3004
- C:\Windows\System\FyWWiMk.exe
  C:\Windows\System\FyWWiMk.exe
  2⤵
  PID:7360
- C:\Windows\System\rZGqUMk.exe
  C:\Windows\System\rZGqUMk.exe
  2⤵
  PID:7428
- C:\Windows\System\juRZvcJ.exe
  C:\Windows\System\juRZvcJ.exe
  2⤵
  PID:7452
- C:\Windows\System\qbrVaBz.exe
  C:\Windows\System\qbrVaBz.exe
  2⤵
  PID:7512
- C:\Windows\System\xSbRlGD.exe
  C:\Windows\System\xSbRlGD.exe
  2⤵
  PID:8220
- C:\Windows\System\gXCyHIS.exe
  C:\Windows\System\gXCyHIS.exe
  2⤵
  PID:8244
- C:\Windows\System\blxrwAj.exe
  C:\Windows\System\blxrwAj.exe
  2⤵
  PID:8260
- C:\Windows\System\eoqEiWG.exe
  C:\Windows\System\eoqEiWG.exe
  2⤵
  PID:8300
- C:\Windows\System\goKouYr.exe
  C:\Windows\System\goKouYr.exe
  2⤵
  PID:8748
- C:\Windows\System\IDYWazN.exe
  C:\Windows\System\IDYWazN.exe
  2⤵
  PID:8772
- C:\Windows\System\LaijvYY.exe
  C:\Windows\System\LaijvYY.exe
  2⤵
  PID:8788
- C:\Windows\System\NbpqCsz.exe
  C:\Windows\System\NbpqCsz.exe
  2⤵
  PID:8804
- C:\Windows\System\dHmLOTq.exe
  C:\Windows\System\dHmLOTq.exe
  2⤵
  PID:8820
- C:\Windows\System\pHqseRh.exe
  C:\Windows\System\pHqseRh.exe
  2⤵
  PID:8836
- C:\Windows\System\zhfqndf.exe
  C:\Windows\System\zhfqndf.exe
  2⤵
  PID:8852
- C:\Windows\System\qhGSWgo.exe
  C:\Windows\System\qhGSWgo.exe
  2⤵
  PID:8868
- C:\Windows\System\zfAMlpN.exe
  C:\Windows\System\zfAMlpN.exe
  2⤵
  PID:8884
- C:\Windows\System\AFRLqqM.exe
  C:\Windows\System\AFRLqqM.exe
  2⤵
  PID:8912
- C:\Windows\System\ExylELk.exe
  C:\Windows\System\ExylELk.exe
  2⤵
  PID:8964
- C:\Windows\System\eAqsJcL.exe
  C:\Windows\System\eAqsJcL.exe
  2⤵
  PID:9000
- C:\Windows\System\yhvwDvK.exe
  C:\Windows\System\yhvwDvK.exe
  2⤵
  PID:9024
- C:\Windows\System\nwdnuSd.exe
  C:\Windows\System\nwdnuSd.exe
  2⤵
  PID:9044
- C:\Windows\System\WJecXrU.exe
  C:\Windows\System\WJecXrU.exe
  2⤵
  PID:9068
- C:\Windows\System\LAqHUKn.exe
  C:\Windows\System\LAqHUKn.exe
  2⤵
  PID:9092
- C:\Windows\System\vNNKLjf.exe
  C:\Windows\System\vNNKLjf.exe
  2⤵
  PID:9108
- C:\Windows\System\OuqkYlo.exe
  C:\Windows\System\OuqkYlo.exe
  2⤵
  PID:9136
- C:\Windows\System\hglrXpe.exe
  C:\Windows\System\hglrXpe.exe
  2⤵
  PID:9160
- C:\Windows\System\cisdhck.exe
  C:\Windows\System\cisdhck.exe
  2⤵
  PID:9180
- C:\Windows\System\aaVBfrr.exe
  C:\Windows\System\aaVBfrr.exe
  2⤵
  PID:9200
- C:\Windows\System\BPUpXmQ.exe
  C:\Windows\System\BPUpXmQ.exe
  2⤵
  PID:6804
- C:\Windows\System\eKhFrEs.exe
  C:\Windows\System\eKhFrEs.exe
  2⤵
  PID:6888
- C:\Windows\System\LDyPomT.exe
  C:\Windows\System\LDyPomT.exe
  2⤵
  PID:6344
- C:\Windows\System\oxILKlR.exe
  C:\Windows\System\oxILKlR.exe
  2⤵
  PID:7880
- C:\Windows\System\GYjDkjl.exe
  C:\Windows\System\GYjDkjl.exe
  2⤵
  PID:8064
- C:\Windows\System\baYgKGO.exe
  C:\Windows\System\baYgKGO.exe
  2⤵
  PID:7040
- C:\Windows\System\zCUsHqu.exe
  C:\Windows\System\zCUsHqu.exe
  2⤵
  PID:6692
- C:\Windows\System\mglOulr.exe
  C:\Windows\System\mglOulr.exe
  2⤵
  PID:5204
- C:\Windows\System\gssGhfv.exe
  C:\Windows\System\gssGhfv.exe
  2⤵
  PID:4564
- C:\Windows\System\EpChNjM.exe
  C:\Windows\System\EpChNjM.exe
  2⤵
  PID:6228
- C:\Windows\System\YDSuzqE.exe
  C:\Windows\System\YDSuzqE.exe
  2⤵
  PID:7084
- C:\Windows\System\VGPrpxV.exe
  C:\Windows\System\VGPrpxV.exe
  2⤵
  PID:8200
- C:\Windows\System\XMMsEju.exe
  C:\Windows\System\XMMsEju.exe
  2⤵
  PID:7536
- C:\Windows\System\LhAWuYG.exe
  C:\Windows\System\LhAWuYG.exe
  2⤵
  PID:8308
- C:\Windows\System\qUDKHOv.exe
  C:\Windows\System\qUDKHOv.exe
  2⤵
  PID:6992
- C:\Windows\System\ciYDElz.exe
  C:\Windows\System\ciYDElz.exe
  2⤵
  PID:7524
- C:\Windows\System\ahbELdD.exe
  C:\Windows\System\ahbELdD.exe
  2⤵
  PID:3332
- C:\Windows\System\aVVFOGB.exe
  C:\Windows\System\aVVFOGB.exe
  2⤵
  PID:2608
- C:\Windows\System\AVynJak.exe
  C:\Windows\System\AVynJak.exe
  2⤵
  PID:5168
- C:\Windows\System\BlONWaC.exe
  C:\Windows\System\BlONWaC.exe
  2⤵
  PID:5884
- C:\Windows\System\KkvALWW.exe
  C:\Windows\System\KkvALWW.exe
  2⤵
  PID:7748
- C:\Windows\System\jPsfjLQ.exe
  C:\Windows\System\jPsfjLQ.exe
  2⤵
  PID:8128
- C:\Windows\System\jahvpVt.exe
  C:\Windows\System\jahvpVt.exe
  2⤵
  PID:7948
- C:\Windows\System\QjEmnTz.exe
  C:\Windows\System\QjEmnTz.exe
  2⤵
  PID:8276
- C:\Windows\System\DlgniNG.exe
  C:\Windows\System\DlgniNG.exe
  2⤵
  PID:7268
- C:\Windows\System\skPpwSq.exe
  C:\Windows\System\skPpwSq.exe
  2⤵
  PID:5552
- C:\Windows\System\SJVFiFo.exe
  C:\Windows\System\SJVFiFo.exe
  2⤵
  PID:8412
- C:\Windows\System\MBIWgzq.exe
  C:\Windows\System\MBIWgzq.exe
  2⤵
  PID:8320
- C:\Windows\System\tCGGJds.exe
  C:\Windows\System\tCGGJds.exe
  2⤵
  PID:8164
- C:\Windows\System\QiSkbyM.exe
  C:\Windows\System\QiSkbyM.exe
  2⤵
  PID:7244
- C:\Windows\System\ZIFzIYX.exe
  C:\Windows\System\ZIFzIYX.exe
  2⤵
  PID:6752
- C:\Windows\System\mXDqgsY.exe
  C:\Windows\System\mXDqgsY.exe
  2⤵
  PID:8640
- C:\Windows\System\lxFTkQt.exe
  C:\Windows\System\lxFTkQt.exe
  2⤵
  PID:8212
- C:\Windows\System\ZhenQlS.exe
  C:\Windows\System\ZhenQlS.exe
  2⤵
  PID:2012
- C:\Windows\System\uWbYKDV.exe
  C:\Windows\System\uWbYKDV.exe
  2⤵
  PID:2260
- C:\Windows\System\FZQEMZs.exe
  C:\Windows\System\FZQEMZs.exe
  2⤵
  PID:2168
- C:\Windows\System\DuxXoXI.exe
  C:\Windows\System\DuxXoXI.exe
  2⤵
  PID:1776
- C:\Windows\System\RXhrPmm.exe
  C:\Windows\System\RXhrPmm.exe
  2⤵
  PID:2068
- C:\Windows\System\dQYOyIs.exe
  C:\Windows\System\dQYOyIs.exe
  2⤵
  PID:7648
- C:\Windows\System\JxNflhz.exe
  C:\Windows\System\JxNflhz.exe
  2⤵
  PID:7668
- C:\Windows\System\hKmaFeT.exe
  C:\Windows\System\hKmaFeT.exe
  2⤵
  PID:7804
- C:\Windows\System\VIpxoSb.exe
  C:\Windows\System\VIpxoSb.exe
  2⤵
  PID:8756
- C:\Windows\System\XKogKlw.exe
  C:\Windows\System\XKogKlw.exe
  2⤵
  PID:7628
- C:\Windows\System\uUOjsPt.exe
  C:\Windows\System\uUOjsPt.exe
  2⤵
  PID:4212
- C:\Windows\System\uuSHHJw.exe
  C:\Windows\System\uuSHHJw.exe
  2⤵
  PID:456
- C:\Windows\System\lNBKVMb.exe
  C:\Windows\System\lNBKVMb.exe
  2⤵
  PID:4392
- C:\Windows\System\VtcTvaz.exe
  C:\Windows\System\VtcTvaz.exe
  2⤵
  PID:5028
- C:\Windows\System\PrVpkbO.exe
  C:\Windows\System\PrVpkbO.exe
  2⤵
  PID:720
- C:\Windows\System\omqEofH.exe
  C:\Windows\System\omqEofH.exe
  2⤵
  PID:2672
- C:\Windows\System\LEeDnkf.exe
  C:\Windows\System\LEeDnkf.exe
  2⤵
  PID:944
- C:\Windows\System\hDaebzL.exe
  C:\Windows\System\hDaebzL.exe
  2⤵
  PID:6556
- C:\Windows\System\mmMZXAw.exe
  C:\Windows\System\mmMZXAw.exe
  2⤵
  PID:8148
- C:\Windows\System\LvFejYB.exe
  C:\Windows\System\LvFejYB.exe
  2⤵
  PID:8796
- C:\Windows\System\JoKRqMg.exe
  C:\Windows\System\JoKRqMg.exe
  2⤵
  PID:8828
- C:\Windows\System\HkKPwmx.exe
  C:\Windows\System\HkKPwmx.exe
  2⤵
  PID:8844
- C:\Windows\System\CCaVvWo.exe
  C:\Windows\System\CCaVvWo.exe
  2⤵
  PID:8432
- C:\Windows\System\VLHGpdg.exe
  C:\Windows\System\VLHGpdg.exe
  2⤵
  PID:8896
- C:\Windows\System\qLcKMrM.exe
  C:\Windows\System\qLcKMrM.exe
  2⤵
  PID:8892
- C:\Windows\System\lUAOToZ.exe
  C:\Windows\System\lUAOToZ.exe
  2⤵
  PID:8936
- C:\Windows\System\MbFYond.exe
  C:\Windows\System\MbFYond.exe
  2⤵
  PID:8980
- C:\Windows\System\eJQuYeM.exe
  C:\Windows\System\eJQuYeM.exe
  2⤵
  PID:7908
- C:\Windows\System\WxBdsFD.exe
  C:\Windows\System\WxBdsFD.exe
  2⤵
  PID:9232
- C:\Windows\System\wFsEZpN.exe
  C:\Windows\System\wFsEZpN.exe
  2⤵
  PID:9252
- C:\Windows\System\VXcAYHx.exe
  C:\Windows\System\VXcAYHx.exe
  2⤵
  PID:9272
- C:\Windows\System\fIZUwqP.exe
  C:\Windows\System\fIZUwqP.exe
  2⤵
  PID:9300
- C:\Windows\System\RdEmiCx.exe
  C:\Windows\System\RdEmiCx.exe
  2⤵
  PID:9316
- C:\Windows\System\pUyGRyI.exe
  C:\Windows\System\pUyGRyI.exe
  2⤵
  PID:9340
- C:\Windows\System\mVviHgb.exe
  C:\Windows\System\mVviHgb.exe
  2⤵
  PID:9364
- C:\Windows\System\PJiWerN.exe
  C:\Windows\System\PJiWerN.exe
  2⤵
  PID:9384
- C:\Windows\System\QlZAVCd.exe
  C:\Windows\System\QlZAVCd.exe
  2⤵
  PID:9408
- C:\Windows\System\oUforfu.exe
  C:\Windows\System\oUforfu.exe
  2⤵
  PID:9436
- C:\Windows\System\lNBrJmB.exe
  C:\Windows\System\lNBrJmB.exe
  2⤵
  PID:9460
- C:\Windows\System\IQFTTjf.exe
  C:\Windows\System\IQFTTjf.exe
  2⤵
  PID:9484
- C:\Windows\System\nglYDKF.exe
  C:\Windows\System\nglYDKF.exe
  2⤵
  PID:9504
- C:\Windows\System\SGtYrvc.exe
  C:\Windows\System\SGtYrvc.exe
  2⤵
  PID:9528
- C:\Windows\System\fdxyAYn.exe
  C:\Windows\System\fdxyAYn.exe
  2⤵
  PID:9552
- C:\Windows\System\clsAdcf.exe
  C:\Windows\System\clsAdcf.exe
  2⤵
  PID:9576
- C:\Windows\System\WmSoxwB.exe
  C:\Windows\System\WmSoxwB.exe
  2⤵
  PID:9596
- C:\Windows\System\TCOVmxw.exe
  C:\Windows\System\TCOVmxw.exe
  2⤵
  PID:9620
- C:\Windows\System\MXDpIvU.exe
  C:\Windows\System\MXDpIvU.exe
  2⤵
  PID:9644
- C:\Windows\System\drGPyUd.exe
  C:\Windows\System\drGPyUd.exe
  2⤵
  PID:9672
- C:\Windows\System\uKJgucU.exe
  C:\Windows\System\uKJgucU.exe
  2⤵
  PID:9692
- C:\Windows\System\ketqIpD.exe
  C:\Windows\System\ketqIpD.exe
  2⤵
  PID:9716
- C:\Windows\System\vlKADXO.exe
  C:\Windows\System\vlKADXO.exe
  2⤵
  PID:9740
- C:\Windows\System\zCzQmpI.exe
  C:\Windows\System\zCzQmpI.exe
  2⤵
  PID:9760
- C:\Windows\System\tYdZhrC.exe
  C:\Windows\System\tYdZhrC.exe
  2⤵
  PID:9784
- C:\Windows\System\jUsnoOS.exe
  C:\Windows\System\jUsnoOS.exe
  2⤵
  PID:9808
- C:\Windows\System\jOiZgFT.exe
  C:\Windows\System\jOiZgFT.exe
  2⤵
  PID:9828
- C:\Windows\System\fkqgEOk.exe
  C:\Windows\System\fkqgEOk.exe
  2⤵
  PID:9848
- C:\Windows\System\JehPEan.exe
  C:\Windows\System\JehPEan.exe
  2⤵
  PID:9872
- C:\Windows\System\rKTZolQ.exe
  C:\Windows\System\rKTZolQ.exe
  2⤵
  PID:9896
- C:\Windows\System\NjWfLrJ.exe
  C:\Windows\System\NjWfLrJ.exe
  2⤵
  PID:9916
- C:\Windows\System\dbBSZFb.exe
  C:\Windows\System\dbBSZFb.exe
  2⤵
  PID:9940
- C:\Windows\System\RXtlKLU.exe
  C:\Windows\System\RXtlKLU.exe
  2⤵
  PID:9964
- C:\Windows\System\HLlDfCG.exe
  C:\Windows\System\HLlDfCG.exe
  2⤵
  PID:9992
- C:\Windows\System\yoxSwli.exe
  C:\Windows\System\yoxSwli.exe
  2⤵
  PID:10008
- C:\Windows\System\LigmzcQ.exe
  C:\Windows\System\LigmzcQ.exe
  2⤵
  PID:10032
- C:\Windows\System\MpzrAiB.exe
  C:\Windows\System\MpzrAiB.exe
  2⤵
  PID:10056
- C:\Windows\System\BJPnlXh.exe
  C:\Windows\System\BJPnlXh.exe
  2⤵
  PID:10072
- C:\Windows\System\EyQpYCJ.exe
  C:\Windows\System\EyQpYCJ.exe
  2⤵
  PID:10088
- C:\Windows\System\NPsGpIx.exe
  C:\Windows\System\NPsGpIx.exe
  2⤵
  PID:10108
- C:\Windows\System\YsUJNIr.exe
  C:\Windows\System\YsUJNIr.exe
  2⤵
  PID:10132
- C:\Windows\System\iEUlXVn.exe
  C:\Windows\System\iEUlXVn.exe
  2⤵
  PID:10152
- C:\Windows\System\yYTnJdQ.exe
  C:\Windows\System\yYTnJdQ.exe
  2⤵
  PID:10176
- C:\Windows\System\DPLlCDV.exe
  C:\Windows\System\DPLlCDV.exe
  2⤵
  PID:10192
- C:\Windows\System\iGEdsSm.exe
  C:\Windows\System\iGEdsSm.exe
  2⤵
  PID:10216
- C:\Windows\System\oroQFru.exe
  C:\Windows\System\oroQFru.exe
  2⤵
  PID:9040
- C:\Windows\System\ECDdkiL.exe
  C:\Windows\System\ECDdkiL.exe
  2⤵
  PID:9104
- C:\Windows\System\mFbiQOk.exe
  C:\Windows\System\mFbiQOk.exe
  2⤵
  PID:8512
- C:\Windows\System\QdKsBLf.exe
  C:\Windows\System\QdKsBLf.exe
  2⤵
  PID:6788
- C:\Windows\System\Ivrukil.exe
  C:\Windows\System\Ivrukil.exe
  2⤵
  PID:7208
- C:\Windows\System\lgOYhuI.exe
  C:\Windows\System\lgOYhuI.exe
  2⤵
  PID:7328
- C:\Windows\System\TEHzQut.exe
  C:\Windows\System\TEHzQut.exe
  2⤵
  PID:7464
- C:\Windows\System\PXIVESV.exe
  C:\Windows\System\PXIVESV.exe
  2⤵
  PID:8572
- C:\Windows\System\RPbdoXf.exe
  C:\Windows\System\RPbdoXf.exe
  2⤵
  PID:7580
- C:\Windows\System\SuNSnjS.exe
  C:\Windows\System\SuNSnjS.exe
  2⤵
  PID:7320
- C:\Windows\System\VthyAFM.exe
  C:\Windows\System\VthyAFM.exe
  2⤵
  PID:3620
- C:\Windows\System\NKYoPep.exe
  C:\Windows\System\NKYoPep.exe
  2⤵
  PID:6536
- C:\Windows\System\rlqmMdU.exe
  C:\Windows\System\rlqmMdU.exe
  2⤵
  PID:7996
- C:\Windows\System\gTWnlDI.exe
  C:\Windows\System\gTWnlDI.exe
  2⤵
  PID:6744
- C:\Windows\System\vQmZuEU.exe
  C:\Windows\System\vQmZuEU.exe
  2⤵
  PID:808
- C:\Windows\System\QIOgnAy.exe
  C:\Windows\System\QIOgnAy.exe
  2⤵
  PID:8652
- C:\Windows\System\MmzDdDj.exe
  C:\Windows\System\MmzDdDj.exe
  2⤵
  PID:7448
- C:\Windows\System\NoOoQHI.exe
  C:\Windows\System\NoOoQHI.exe
  2⤵
  PID:8360
- C:\Windows\System\BECBctR.exe
  C:\Windows\System\BECBctR.exe
  2⤵
  PID:8368
- C:\Windows\System\sgKKEev.exe
  C:\Windows\System\sgKKEev.exe
  2⤵
  PID:7924
- C:\Windows\System\DgEcjMU.exe
  C:\Windows\System\DgEcjMU.exe
  2⤵
  PID:8784
- C:\Windows\System\OtLcqSs.exe
  C:\Windows\System\OtLcqSs.exe
  2⤵
  PID:8420
- C:\Windows\System\OIyZsil.exe
  C:\Windows\System\OIyZsil.exe
  2⤵
  PID:7812
- C:\Windows\System\HXiMeqv.exe
  C:\Windows\System\HXiMeqv.exe
  2⤵
  PID:9020
- C:\Windows\System\wuYLZGs.exe
  C:\Windows\System\wuYLZGs.exe
  2⤵
  PID:10256
- C:\Windows\System\wjUJOnp.exe
  C:\Windows\System\wjUJOnp.exe
  2⤵
  PID:10272
- C:\Windows\System\XiYBBqc.exe
  C:\Windows\System\XiYBBqc.exe
  2⤵
  PID:10292
- C:\Windows\System\FChviOX.exe
  C:\Windows\System\FChviOX.exe
  2⤵
  PID:10312
- C:\Windows\System\RPJaInj.exe
  C:\Windows\System\RPJaInj.exe
  2⤵
  PID:10332
- C:\Windows\System\yGIFymh.exe
  C:\Windows\System\yGIFymh.exe
  2⤵
  PID:10356
- C:\Windows\System\crrUryG.exe
  C:\Windows\System\crrUryG.exe
  2⤵
  PID:10376
- C:\Windows\System\duksZzp.exe
  C:\Windows\System\duksZzp.exe
  2⤵
  PID:10396
- C:\Windows\System\acKlJPb.exe
  C:\Windows\System\acKlJPb.exe
  2⤵
  PID:10424
- C:\Windows\System\hWxrOzg.exe
  C:\Windows\System\hWxrOzg.exe
  2⤵
  PID:10920
- C:\Windows\System\kpIKyjb.exe
  C:\Windows\System\kpIKyjb.exe
  2⤵
  PID:10948
- C:\Windows\System\RyOiXXo.exe
  C:\Windows\System\RyOiXXo.exe
  2⤵
  PID:10972
- C:\Windows\System\IYBYmGW.exe
  C:\Windows\System\IYBYmGW.exe
  2⤵
  PID:10996
- C:\Windows\System\KzAZUPG.exe
  C:\Windows\System\KzAZUPG.exe
  2⤵
  PID:11016
- C:\Windows\System\ZvOmcCC.exe
  C:\Windows\System\ZvOmcCC.exe
  2⤵
  PID:11040
- C:\Windows\System\hKlBQNx.exe
  C:\Windows\System\hKlBQNx.exe
  2⤵
  PID:11064
- C:\Windows\System\QtlJqZK.exe
  C:\Windows\System\QtlJqZK.exe
  2⤵
  PID:11092
- C:\Windows\System\ZewWDYK.exe
  C:\Windows\System\ZewWDYK.exe
  2⤵
  PID:11112
- C:\Windows\System\CIqdZno.exe
  C:\Windows\System\CIqdZno.exe
  2⤵
  PID:11136
- C:\Windows\System\VaECNPI.exe
  C:\Windows\System\VaECNPI.exe
  2⤵
  PID:11156
- C:\Windows\System\qvWdRwk.exe
  C:\Windows\System\qvWdRwk.exe
  2⤵
  PID:11180
- C:\Windows\System\hZLiNtm.exe
  C:\Windows\System\hZLiNtm.exe
  2⤵
  PID:11200
- C:\Windows\System\vOitQEV.exe
  C:\Windows\System\vOitQEV.exe
  2⤵
  PID:11224
- C:\Windows\System\tfnaFdK.exe
  C:\Windows\System\tfnaFdK.exe
  2⤵
  PID:9268
- C:\Windows\System\FRkYJur.exe
  C:\Windows\System\FRkYJur.exe
  2⤵
  PID:9076
- C:\Windows\System\vOuLADT.exe
  C:\Windows\System\vOuLADT.exe
  2⤵
  PID:9156
- C:\Windows\System\XfFUWzW.exe
  C:\Windows\System\XfFUWzW.exe
  2⤵
  PID:6772
- C:\Windows\System\DdhGHUU.exe
  C:\Windows\System\DdhGHUU.exe
  2⤵
  PID:6396
- C:\Windows\System\TXonrHd.exe
  C:\Windows\System\TXonrHd.exe
  2⤵
  PID:9688
- C:\Windows\System\kBIughW.exe
  C:\Windows\System\kBIughW.exe
  2⤵
  PID:9728
- C:\Windows\System\KhdTQnC.exe
  C:\Windows\System\KhdTQnC.exe
  2⤵
  PID:9780
- C:\Windows\System\RmaPFNa.exe
  C:\Windows\System\RmaPFNa.exe
  2⤵
  PID:9844
- C:\Windows\System\EDLgesp.exe
  C:\Windows\System\EDLgesp.exe
  2⤵
  PID:2188
- C:\Windows\System\RhyBerY.exe
  C:\Windows\System\RhyBerY.exe
  2⤵
  PID:10004
- C:\Windows\System\agmieMx.exe
  C:\Windows\System\agmieMx.exe
  2⤵
  PID:8492
- C:\Windows\System\TewtSOz.exe
  C:\Windows\System\TewtSOz.exe
  2⤵
  PID:3592
- C:\Windows\System\RNMBAkD.exe
  C:\Windows\System\RNMBAkD.exe
  2⤵
  PID:8920
- C:\Windows\System\DzEjxQu.exe
  C:\Windows\System\DzEjxQu.exe
  2⤵
  PID:5772
- C:\Windows\System\mvCbNMi.exe
  C:\Windows\System\mvCbNMi.exe
  2⤵
  PID:10348
- C:\Windows\System\lBLJMYG.exe
  C:\Windows\System\lBLJMYG.exe
  2⤵
  PID:9424
- C:\Windows\System\BhiizGv.exe
  C:\Windows\System\BhiizGv.exe
  2⤵
  PID:10472
- C:\Windows\System\vCpOYdA.exe
  C:\Windows\System\vCpOYdA.exe
  2⤵
  PID:9584
- C:\Windows\System\hzpGVUz.exe
  C:\Windows\System\hzpGVUz.exe
  2⤵
  PID:4088
- C:\Windows\System\rkhdcrV.exe
  C:\Windows\System\rkhdcrV.exe
  2⤵
  PID:10544
- C:\Windows\System\ylGCqwI.exe
  C:\Windows\System\ylGCqwI.exe
  2⤵
  PID:7144
- C:\Windows\System\dQwAUHL.exe
  C:\Windows\System\dQwAUHL.exe
  2⤵
  PID:10188
- C:\Windows\System\PbftDpa.exe
  C:\Windows\System\PbftDpa.exe
  2⤵
  PID:10236
- C:\Windows\System\VVmIJKM.exe
  C:\Windows\System\VVmIJKM.exe
  2⤵
  PID:9124
- C:\Windows\System\VNDvymC.exe
  C:\Windows\System\VNDvymC.exe
  2⤵
  PID:8032
- C:\Windows\System\TdgqXaH.exe
  C:\Windows\System\TdgqXaH.exe
  2⤵
  PID:1600
- C:\Windows\System\JLcMtEF.exe
  C:\Windows\System\JLcMtEF.exe
  2⤵
  PID:1624
- C:\Windows\System\PRUWLdp.exe
  C:\Windows\System\PRUWLdp.exe
  2⤵
  PID:556
- C:\Windows\System\ZRmSZHp.exe
  C:\Windows\System\ZRmSZHp.exe
  2⤵
  PID:11268
- C:\Windows\System\NsVqael.exe
  C:\Windows\System\NsVqael.exe
  2⤵
  PID:11284
- C:\Windows\System\OPaHOgL.exe
  C:\Windows\System\OPaHOgL.exe
  2⤵
  PID:11316
- C:\Windows\System\dyUIKoR.exe
  C:\Windows\System\dyUIKoR.exe
  2⤵
  PID:11352
- C:\Windows\System\YqEnRuA.exe
  C:\Windows\System\YqEnRuA.exe
  2⤵
  PID:11384
- C:\Windows\System\LmVkTzO.exe
  C:\Windows\System\LmVkTzO.exe
  2⤵
  PID:11424
- C:\Windows\System\mKvehuv.exe
  C:\Windows\System\mKvehuv.exe
  2⤵
  PID:11444
- C:\Windows\System\vdRmPjv.exe
  C:\Windows\System\vdRmPjv.exe
  2⤵
  PID:11472
- C:\Windows\System\gbTFRmZ.exe
  C:\Windows\System\gbTFRmZ.exe
  2⤵
  PID:11500
- C:\Windows\System\WOdlxCM.exe
  C:\Windows\System\WOdlxCM.exe
  2⤵
  PID:11528
- C:\Windows\System\duOinVv.exe
  C:\Windows\System\duOinVv.exe
  2⤵
  PID:11556
- C:\Windows\System\bCMcrgX.exe
  C:\Windows\System\bCMcrgX.exe
  2⤵
  PID:11572
- C:\Windows\System\MzAFXHk.exe
  C:\Windows\System\MzAFXHk.exe
  2⤵
  PID:11596
- C:\Windows\System\jDeGIib.exe
  C:\Windows\System\jDeGIib.exe
  2⤵
  PID:11620
- C:\Windows\System\Zvrahmk.exe
  C:\Windows\System\Zvrahmk.exe
  2⤵
  PID:11644
- C:\Windows\System\bWxhCud.exe
  C:\Windows\System\bWxhCud.exe
  2⤵
  PID:11664
- C:\Windows\System\glSMCiL.exe
  C:\Windows\System\glSMCiL.exe
  2⤵
  PID:11684
- C:\Windows\System\ybbYnLT.exe
  C:\Windows\System\ybbYnLT.exe
  2⤵
  PID:11708
- C:\Windows\System\xvnXlmZ.exe
  C:\Windows\System\xvnXlmZ.exe
  2⤵
  PID:11732
- C:\Windows\System\aFnxViV.exe
  C:\Windows\System\aFnxViV.exe
  2⤵
  PID:11752
- C:\Windows\System\CHYlyEG.exe
  C:\Windows\System\CHYlyEG.exe
  2⤵
  PID:11780
- C:\Windows\System\EhaoyKd.exe
  C:\Windows\System\EhaoyKd.exe
  2⤵
  PID:11804
- C:\Windows\System\yqnwMRE.exe
  C:\Windows\System\yqnwMRE.exe
  2⤵
  PID:11824
- C:\Windows\System\ksTHXrr.exe
  C:\Windows\System\ksTHXrr.exe
  2⤵
  PID:11848
- C:\Windows\System\fmHgWZi.exe
  C:\Windows\System\fmHgWZi.exe
  2⤵
  PID:11872
- C:\Windows\System\wPallZO.exe
  C:\Windows\System\wPallZO.exe
  2⤵
  PID:11892
- C:\Windows\System\dWMcglb.exe
  C:\Windows\System\dWMcglb.exe
  2⤵
  PID:11912
- C:\Windows\System\eHVOSMX.exe
  C:\Windows\System\eHVOSMX.exe
  2⤵
  PID:11936
- C:\Windows\System\ViTDaAZ.exe
  C:\Windows\System\ViTDaAZ.exe
  2⤵
  PID:11952
- C:\Windows\System\UCociBe.exe
  C:\Windows\System\UCociBe.exe
  2⤵
  PID:11992
- C:\Windows\System\cmOnRzN.exe
  C:\Windows\System\cmOnRzN.exe
  2⤵
  PID:12028
- C:\Windows\System\RbIeobu.exe
  C:\Windows\System\RbIeobu.exe
  2⤵
  PID:12052
- C:\Windows\System\AVnUGxH.exe
  C:\Windows\System\AVnUGxH.exe
  2⤵
  PID:12076
- C:\Windows\System\hgIzwnO.exe
  C:\Windows\System\hgIzwnO.exe
  2⤵
  PID:12108
- C:\Windows\System\sKzcARF.exe
  C:\Windows\System\sKzcARF.exe
  2⤵
  PID:12124
- C:\Windows\System\LZQLKem.exe
  C:\Windows\System\LZQLKem.exe
  2⤵
  PID:12148
- C:\Windows\System\rmdulLe.exe
  C:\Windows\System\rmdulLe.exe
  2⤵
  PID:12172
- C:\Windows\System\lAIrwjd.exe
  C:\Windows\System\lAIrwjd.exe
  2⤵
  PID:12196
- C:\Windows\System\YwcLHXU.exe
  C:\Windows\System\YwcLHXU.exe
  2⤵
  PID:12216
- C:\Windows\System\WFaRPRc.exe
  C:\Windows\System\WFaRPRc.exe
  2⤵
  PID:12236
- C:\Windows\System\CeUpnSD.exe
  C:\Windows\System\CeUpnSD.exe
  2⤵
  PID:12260
- C:\Windows\System\VPSkxOf.exe
  C:\Windows\System\VPSkxOf.exe
  2⤵
  PID:12284
- C:\Windows\System\mOLkUbE.exe
  C:\Windows\System\mOLkUbE.exe
  2⤵
  PID:4728
- C:\Windows\System\ZPCZizt.exe
  C:\Windows\System\ZPCZizt.exe
  2⤵
  PID:2588
- C:\Windows\System\ASeNNsB.exe
  C:\Windows\System\ASeNNsB.exe
  2⤵
  PID:4612
- C:\Windows\System\aqBcXIA.exe
  C:\Windows\System\aqBcXIA.exe
  2⤵
  PID:1628
- C:\Windows\System\FxVAUpd.exe
  C:\Windows\System\FxVAUpd.exe
  2⤵
  PID:7708
- C:\Windows\System\byJRJpn.exe
  C:\Windows\System\byJRJpn.exe
  2⤵
  PID:8860
- C:\Windows\System\UJTeeNF.exe
  C:\Windows\System\UJTeeNF.exe
  2⤵
  PID:6600
- C:\Windows\System\quFVGMH.exe
  C:\Windows\System\quFVGMH.exe
  2⤵
  PID:8944
- C:\Windows\System\FoHAbGm.exe
  C:\Windows\System\FoHAbGm.exe
  2⤵
  PID:9228
- C:\Windows\System\zUtPmJX.exe
  C:\Windows\System\zUtPmJX.exe
  2⤵
  PID:10408
- C:\Windows\System\vaRIDFM.exe
  C:\Windows\System\vaRIDFM.exe
  2⤵
  PID:9512
- C:\Windows\System\SwtWBEc.exe
  C:\Windows\System\SwtWBEc.exe
  2⤵
  PID:10984
- C:\Windows\System\PulfwtC.exe
  C:\Windows\System\PulfwtC.exe
  2⤵
  PID:9588
- C:\Windows\System\HpBORDk.exe
  C:\Windows\System\HpBORDk.exe
  2⤵
  PID:9332
- C:\Windows\System\qkMnIEB.exe
  C:\Windows\System\qkMnIEB.exe
  2⤵
  PID:9192
- C:\Windows\System\YgtlPHY.exe
  C:\Windows\System\YgtlPHY.exe
  2⤵
  PID:9520
- C:\Windows\System\UpPWBkf.exe
  C:\Windows\System\UpPWBkf.exe
  2⤵
  PID:9912
- C:\Windows\System\RUjAgPN.exe
  C:\Windows\System\RUjAgPN.exe
  2⤵
  PID:7252
- C:\Windows\System\exXsnmA.exe
  C:\Windows\System\exXsnmA.exe
  2⤵
  PID:12300
- C:\Windows\System\YFEFIdd.exe
  C:\Windows\System\YFEFIdd.exe
  2⤵
  PID:12316
- C:\Windows\System\xlvqXxn.exe
  C:\Windows\System\xlvqXxn.exe
  2⤵
  PID:12332
- C:\Windows\System\JTNUBjx.exe
  C:\Windows\System\JTNUBjx.exe
  2⤵
  PID:12348
- C:\Windows\System\qCVzueD.exe
  C:\Windows\System\qCVzueD.exe
  2⤵
  PID:12364
- C:\Windows\System\hdAaxLo.exe
  C:\Windows\System\hdAaxLo.exe
  2⤵
  PID:12388
- C:\Windows\System\CokwxoV.exe
  C:\Windows\System\CokwxoV.exe
  2⤵
  PID:12428
- C:\Windows\System\EohtlCe.exe
  C:\Windows\System\EohtlCe.exe
  2⤵
  PID:12444
- C:\Windows\System\IZnXsxl.exe
  C:\Windows\System\IZnXsxl.exe
  2⤵
  PID:12472
- C:\Windows\System\iDGLozP.exe
  C:\Windows\System\iDGLozP.exe
  2⤵
  PID:12496
- C:\Windows\System\vpnDWZz.exe
  C:\Windows\System\vpnDWZz.exe
  2⤵
  PID:12520
- C:\Windows\System\OgtxkYC.exe
  C:\Windows\System\OgtxkYC.exe
  2⤵
  PID:12544
- C:\Windows\System\YDqzXOT.exe
  C:\Windows\System\YDqzXOT.exe
  2⤵
  PID:13144
- C:\Windows\System\sErQIhW.exe
  C:\Windows\System\sErQIhW.exe
  2⤵
  PID:13164
- C:\Windows\System\pKHXQlt.exe
  C:\Windows\System\pKHXQlt.exe
  2⤵
  PID:13192
- C:\Windows\System\GRFQgtc.exe
  C:\Windows\System\GRFQgtc.exe
  2⤵
  PID:13220
- C:\Windows\System\kmRJwYw.exe
  C:\Windows\System\kmRJwYw.exe
  2⤵
  PID:13240
- C:\Windows\System\itajExM.exe
  C:\Windows\System\itajExM.exe
  2⤵
  PID:13280
- C:\Windows\System\WptEdZJ.exe
  C:\Windows\System\WptEdZJ.exe
  2⤵
  PID:13308
- C:\Windows\System\tjUKxCv.exe
  C:\Windows\System\tjUKxCv.exe
  2⤵
  PID:10000
- C:\Windows\System\RokQFiH.exe
  C:\Windows\System\RokQFiH.exe
  2⤵
  PID:10048
- C:\Windows\System\Qoulovq.exe
  C:\Windows\System\Qoulovq.exe
  2⤵
  PID:10080
- C:\Windows\System\jCJeDVv.exe
  C:\Windows\System\jCJeDVv.exe
  2⤵
  PID:10140
- C:\Windows\System\hkhjIkw.exe
  C:\Windows\System\hkhjIkw.exe
  2⤵
  PID:9360
- C:\Windows\System\uJIcRVd.exe
  C:\Windows\System\uJIcRVd.exe
  2⤵
  PID:9640
- C:\Windows\System\UiBUVBh.exe
  C:\Windows\System\UiBUVBh.exe
  2⤵
  PID:10172
- C:\Windows\System\zDtsbEq.exe
  C:\Windows\System\zDtsbEq.exe
  2⤵
  PID:4060
- C:\Windows\System\gsOriXN.exe
  C:\Windows\System\gsOriXN.exe
  2⤵
  PID:2824
- C:\Windows\System\ldBqiCs.exe
  C:\Windows\System\ldBqiCs.exe
  2⤵
  PID:11396
- C:\Windows\System\scuTqJY.exe
  C:\Windows\System\scuTqJY.exe
  2⤵
  PID:11748
- C:\Windows\System\abEcrYw.exe
  C:\Windows\System\abEcrYw.exe
  2⤵
  PID:11764
- C:\Windows\System\WVwRENr.exe
  C:\Windows\System\WVwRENr.exe
  2⤵
  PID:11796
- C:\Windows\System\WCTcEwj.exe
  C:\Windows\System\WCTcEwj.exe
  2⤵
  PID:11840
- C:\Windows\System\QfdszyR.exe
  C:\Windows\System\QfdszyR.exe
  2⤵
  PID:7876
- C:\Windows\System\cooytmZ.exe
  C:\Windows\System\cooytmZ.exe
  2⤵
  PID:8908
- C:\Windows\System\lSaVlMY.exe
  C:\Windows\System\lSaVlMY.exe
  2⤵
  PID:10320
- C:\Windows\System\AooMTIl.exe
  C:\Windows\System\AooMTIl.exe
  2⤵
  PID:10280
- C:\Windows\System\QPZuSrb.exe
  C:\Windows\System\QPZuSrb.exe
  2⤵
  PID:11980
- C:\Windows\System\WAWmSXC.exe
  C:\Windows\System\WAWmSXC.exe
  2⤵
  PID:12072
- C:\Windows\System\oHRMoYv.exe
  C:\Windows\System\oHRMoYv.exe
  2⤵
  PID:11060
- C:\Windows\System\lqNbjsx.exe
  C:\Windows\System\lqNbjsx.exe
  2⤵
  PID:12208
- C:\Windows\System\sgrdTEu.exe
  C:\Windows\System\sgrdTEu.exe
  2⤵
  PID:12256
- C:\Windows\System\DdSfgFv.exe
  C:\Windows\System\DdSfgFv.exe
  2⤵
  PID:7480
- C:\Windows\System\qjesWyz.exe
  C:\Windows\System\qjesWyz.exe
  2⤵
  PID:11248
- C:\Windows\System\jCHwQuK.exe
  C:\Windows\System\jCHwQuK.exe
  2⤵
  PID:10560
- C:\Windows\System\xUAnPOe.exe
  C:\Windows\System\xUAnPOe.exe
  2⤵
  PID:8176
- C:\Windows\System\ClrTKjq.exe
  C:\Windows\System\ClrTKjq.exe
  2⤵
  PID:10644
- C:\Windows\System\UYtgXyJ.exe
  C:\Windows\System\UYtgXyJ.exe
  2⤵
  PID:10716
- C:\Windows\System\MwVsIZI.exe
  C:\Windows\System\MwVsIZI.exe
  2⤵
  PID:11408
- C:\Windows\System\UteOzVz.exe
  C:\Windows\System\UteOzVz.exe
  2⤵
  PID:11452
- C:\Windows\System\nCSyrVY.exe
  C:\Windows\System\nCSyrVY.exe
  2⤵
  PID:12728
- C:\Windows\System\sMZYvzm.exe
  C:\Windows\System\sMZYvzm.exe
  2⤵
  PID:10876
- C:\Windows\System\Umzppgp.exe
  C:\Windows\System\Umzppgp.exe
  2⤵
  PID:10904
- C:\Windows\System\wtagUbt.exe
  C:\Windows\System\wtagUbt.exe
  2⤵
  PID:12140
- C:\Windows\System\VpWiCNM.exe
  C:\Windows\System\VpWiCNM.exe
  2⤵
  PID:5100
- C:\Windows\System\dSCrDUY.exe
  C:\Windows\System\dSCrDUY.exe
  2⤵
  PID:3556
- C:\Windows\System\MGHzmLw.exe
  C:\Windows\System\MGHzmLw.exe
  2⤵
  PID:13000
- C:\Windows\System\tHEojyz.exe
  C:\Windows\System\tHEojyz.exe
  2⤵
  PID:11468
- C:\Windows\System\YrLHBog.exe
  C:\Windows\System\YrLHBog.exe
  2⤵
  PID:11900
- C:\Windows\System\JyeEhQS.exe
  C:\Windows\System\JyeEhQS.exe
  2⤵
  PID:11948
- C:\Windows\System\uaDbAlG.exe
  C:\Windows\System\uaDbAlG.exe
  2⤵
  PID:12024
- C:\Windows\System\LToADRa.exe
  C:\Windows\System\LToADRa.exe
  2⤵
  PID:12068
- C:\Windows\System\XyWbxjT.exe
  C:\Windows\System\XyWbxjT.exe
  2⤵
  PID:12144
- C:\Windows\System\vdzIqrr.exe
  C:\Windows\System\vdzIqrr.exe
  2⤵
  PID:4468
- C:\Windows\System\IvDZpnt.exe
  C:\Windows\System\IvDZpnt.exe
  2⤵
  PID:2220
- C:\Windows\System\UovMcfs.exe
  C:\Windows\System\UovMcfs.exe
  2⤵
  PID:9016
- C:\Windows\System\aUwoloY.exe
  C:\Windows\System\aUwoloY.exe
  2⤵
  PID:9448
- C:\Windows\System\YZVYNLf.exe
  C:\Windows\System\YZVYNLf.exe
  2⤵
  PID:9572
- C:\Windows\System\ksoeoEn.exe
  C:\Windows\System\ksoeoEn.exe
  2⤵
  PID:12292
- C:\Windows\System\EpdmLbu.exe
  C:\Windows\System\EpdmLbu.exe
  2⤵
  PID:8112
- C:\Windows\System\AAItcKU.exe
  C:\Windows\System\AAItcKU.exe
  2⤵
  PID:12512
- C:\Windows\System\NdVRlDN.exe
  C:\Windows\System\NdVRlDN.exe
  2⤵
  PID:10300
- C:\Windows\System\PvtDdpo.exe
  C:\Windows\System\PvtDdpo.exe
  2⤵
  PID:12992
- C:\Windows\System\UdQANrp.exe
  C:\Windows\System\UdQANrp.exe
  2⤵
  PID:12376
- C:\Windows\System\FUTToOB.exe
  C:\Windows\System\FUTToOB.exe
  2⤵
  PID:12772
- C:\Windows\System\VIdMnFz.exe
  C:\Windows\System\VIdMnFz.exe
  2⤵
  PID:11232
- C:\Windows\System\qPwalBD.exe
  C:\Windows\System\qPwalBD.exe
  2⤵
  PID:13188
- C:\Windows\System\CMaTIGd.exe
  C:\Windows\System\CMaTIGd.exe
  2⤵
  PID:12916
- C:\Windows\System\JGHhjNq.exe
  C:\Windows\System\JGHhjNq.exe
  2⤵
  PID:7944
- C:\Windows\System\jeqnxzh.exe
  C:\Windows\System\jeqnxzh.exe
  2⤵
  PID:12328
- C:\Windows\System\EBTGTyq.exe
  C:\Windows\System\EBTGTyq.exe
  2⤵
  PID:12872
- C:\Windows\System\gkMHMtG.exe
  C:\Windows\System\gkMHMtG.exe
  2⤵
  PID:9952
- C:\Windows\System\TqbDDEX.exe
  C:\Windows\System\TqbDDEX.exe
  2⤵
  PID:7680
- C:\Windows\System\rBXqwkd.exe
  C:\Windows\System\rBXqwkd.exe
  2⤵
  PID:9100
- C:\Windows\System\cXgnECU.exe
  C:\Windows\System\cXgnECU.exe
  2⤵
  PID:8016
- C:\Windows\System\lZfWrXI.exe
  C:\Windows\System\lZfWrXI.exe
  2⤵
  PID:6300
- C:\Windows\System\fjurmvM.exe
  C:\Windows\System\fjurmvM.exe
  2⤵
  PID:3784
- C:\Windows\System\GIliJfR.exe
  C:\Windows\System\GIliJfR.exe
  2⤵
  PID:9892
- C:\Windows\System\ZHysskZ.exe
  C:\Windows\System\ZHysskZ.exe
  2⤵
  PID:1888
- C:\Windows\System\mHKhdMa.exe
  C:\Windows\System\mHKhdMa.exe
  2⤵
  PID:11456
- C:\Windows\System\mwbIvTz.exe
  C:\Windows\System\mwbIvTz.exe
  2⤵
  PID:10688
- C:\Windows\System\JRpxNbK.exe
  C:\Windows\System\JRpxNbK.exe
  2⤵
  PID:10736
- C:\Windows\System\pgFLxen.exe
  C:\Windows\System\pgFLxen.exe
  2⤵
  PID:11884
- C:\Windows\System\zcePAbQ.exe
  C:\Windows\System\zcePAbQ.exe
  2⤵
  PID:11120
- C:\Windows\System\XldeoHU.exe
  C:\Windows\System\XldeoHU.exe
  2⤵
  PID:11696
- C:\Windows\System\eYTSZWk.exe
  C:\Windows\System\eYTSZWk.exe
  2⤵
  PID:6532
- C:\Windows\System\iqqpzvG.exe
  C:\Windows\System\iqqpzvG.exe
  2⤵
  PID:8780
- C:\Windows\System\tzXbUAs.exe
  C:\Windows\System\tzXbUAs.exe
  2⤵
  PID:10364
- C:\Windows\System\cdIQfNG.exe
  C:\Windows\System\cdIQfNG.exe
  2⤵
  PID:13028
- C:\Windows\System\Azprmtu.exe
  C:\Windows\System\Azprmtu.exe
  2⤵
  PID:12276
- C:\Windows\System\MMGnTEl.exe
  C:\Windows\System\MMGnTEl.exe
  2⤵
  PID:8768
- C:\Windows\System\GLnWwgk.exe
  C:\Windows\System\GLnWwgk.exe
  2⤵
  PID:12020
- C:\Windows\System\WExGDQJ.exe
  C:\Windows\System\WExGDQJ.exe
  2⤵
  PID:10800
- C:\Windows\System\DNQmWNZ.exe
  C:\Windows\System\DNQmWNZ.exe
  2⤵
  PID:10820
- C:\Windows\System\jmeyVZv.exe
  C:\Windows\System\jmeyVZv.exe
  2⤵
  PID:11132
- C:\Windows\System\XomVEWN.exe
  C:\Windows\System\XomVEWN.exe
  2⤵
  PID:11196
- C:\Windows\System\oJTROir.exe
  C:\Windows\System\oJTROir.exe
  2⤵
  PID:8100
- C:\Windows\System\QJEwluz.exe
  C:\Windows\System\QJEwluz.exe
  2⤵
  PID:13320
- C:\Windows\System\VyuxwEU.exe
  C:\Windows\System\VyuxwEU.exe
  2⤵
  PID:13344
- C:\Windows\System\mDnhvxW.exe
  C:\Windows\System\mDnhvxW.exe
  2⤵
  PID:13856
- C:\Windows\System\WVTuHYf.exe
  C:\Windows\System\WVTuHYf.exe
  2⤵
  PID:14104
- C:\Windows\System\iILXvBP.exe
  C:\Windows\System\iILXvBP.exe
  2⤵
  PID:14124
- C:\Windows\System\GQPLJKq.exe
  C:\Windows\System\GQPLJKq.exe
  2⤵
  PID:14144
- C:\Windows\System\IqiKyXG.exe
  C:\Windows\System\IqiKyXG.exe
  2⤵
  PID:14164
- C:\Windows\System\KCfSSgO.exe
  C:\Windows\System\KCfSSgO.exe
  2⤵
  PID:14180
- C:\Windows\System\vWPTEql.exe
  C:\Windows\System\vWPTEql.exe
  2⤵
  PID:14204
- C:\Windows\System\dQrMDdZ.exe
  C:\Windows\System\dQrMDdZ.exe
  2⤵
  PID:14232
- C:\Windows\System\NLbpEAj.exe
  C:\Windows\System\NLbpEAj.exe
  2⤵
  PID:14256
- C:\Windows\System\yboKzbi.exe
  C:\Windows\System\yboKzbi.exe
  2⤵
  PID:776
- C:\Windows\System\vKDDZxt.exe
  C:\Windows\System\vKDDZxt.exe
  2⤵
  PID:3648
- C:\Windows\System\mLIihYo.exe
  C:\Windows\System\mLIihYo.exe
  2⤵
  PID:13500
- C:\Windows\System\FfoMBTg.exe
  C:\Windows\System\FfoMBTg.exe
  2⤵
  PID:13260
- C:\Windows\System\ZbJlRtK.exe
  C:\Windows\System\ZbJlRtK.exe
  2⤵
  PID:12000
- C:\Windows\System\xXSsYFt.exe
  C:\Windows\System\xXSsYFt.exe
  2⤵
  PID:13656
- C:\Windows\System\pkmWcGE.exe
  C:\Windows\System\pkmWcGE.exe
  2⤵
  PID:13448
- C:\Windows\System\upajNTj.exe
  C:\Windows\System\upajNTj.exe
  2⤵
  PID:13652
- C:\Windows\System\adpFuxW.exe
  C:\Windows\System\adpFuxW.exe
  2⤵
  PID:13384
- C:\Windows\System\WSYRsnM.exe
  C:\Windows\System\WSYRsnM.exe
  2⤵
  PID:4544
- C:\Windows\System\XYEMDuC.exe
  C:\Windows\System\XYEMDuC.exe
  2⤵
  PID:13156
- C:\Windows\System\dkYRWAO.exe
  C:\Windows\System\dkYRWAO.exe
  2⤵
  PID:14000
- C:\Windows\System\SVCeXJP.exe
  C:\Windows\System\SVCeXJP.exe
  2⤵
  PID:12360
- C:\Windows\System\FjIezhN.exe
  C:\Windows\System\FjIezhN.exe
  2⤵
  PID:13232
- C:\Windows\System\cHXrJsG.exe
  C:\Windows\System\cHXrJsG.exe
  2⤵
  PID:11760
- C:\Windows\System\CQJodzm.exe
  C:\Windows\System\CQJodzm.exe
  2⤵
  PID:13988
- C:\Windows\System\nhoAOPk.exe
  C:\Windows\System\nhoAOPk.exe
  2⤵
  PID:13660
- C:\Windows\System\AoXixQP.exe
  C:\Windows\System\AoXixQP.exe
  2⤵
  PID:13628
- C:\Windows\System\PeYrToo.exe
  C:\Windows\System\PeYrToo.exe
  2⤵
  PID:13720
- C:\Windows\System\dLwhfyF.exe
  C:\Windows\System\dLwhfyF.exe
  2⤵
  PID:14004
- C:\Windows\System\EiCPseL.exe
  C:\Windows\System\EiCPseL.exe
  2⤵
  PID:14292
- C:\Windows\System\MNzxKTL.exe
  C:\Windows\System\MNzxKTL.exe
  2⤵
  PID:9984
- C:\Windows\System\wwFHyWf.exe
  C:\Windows\System\wwFHyWf.exe
  2⤵
  PID:14280
- C:\Windows\System\qVtIzqI.exe
  C:\Windows\System\qVtIzqI.exe
  2⤵
  PID:4364
- C:\Windows\System\tHRaBMm.exe
  C:\Windows\System\tHRaBMm.exe
  2⤵
  PID:14152
- C:\Windows\System\AlpQWyI.exe
  C:\Windows\System\AlpQWyI.exe
  2⤵
  PID:12180
- C:\Windows\System\LhfUgAv.exe
  C:\Windows\System\LhfUgAv.exe
  2⤵
  PID:13412
- C:\Windows\System\jehksHU.exe
  C:\Windows\System\jehksHU.exe
  2⤵
  PID:12164
- C:\Windows\System\yKHCoBe.exe
  C:\Windows\System\yKHCoBe.exe
  2⤵
  PID:12344
- C:\Windows\System\ZbQPmRZ.exe
  C:\Windows\System\ZbQPmRZ.exe
  2⤵
  PID:14120
- C:\Windows\System\SwMGvIe.exe
  C:\Windows\System\SwMGvIe.exe
  2⤵
  PID:10044
- C:\Windows\System\ElmcfBe.exe
  C:\Windows\System\ElmcfBe.exe
  2⤵
  PID:11304
- C:\Windows\System\IRNgcoH.exe
  C:\Windows\System\IRNgcoH.exe
  2⤵
  PID:14136
- C:\Windows\System\OVTpyVL.exe
  C:\Windows\System\OVTpyVL.exe
  2⤵
  PID:14224
- C:\Windows\System\bdshXal.exe
  C:\Windows\System\bdshXal.exe
  2⤵
  PID:14052
- C:\Windows\System\hrKDwQm.exe
  C:\Windows\System\hrKDwQm.exe
  2⤵
  PID:10328
- C:\Windows\System\SFQvqAr.exe
  C:\Windows\System\SFQvqAr.exe
  2⤵
  PID:14088
- C:\Windows\System\CZeDzls.exe
  C:\Windows\System\CZeDzls.exe
  2⤵
  PID:14268
- C:\Windows\System\JpgNpYs.exe
  C:\Windows\System\JpgNpYs.exe
  2⤵
  PID:10344
- C:\Windows\System\DJBmrRH.exe
  C:\Windows\System\DJBmrRH.exe
  2⤵
  PID:14156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:8
1⤵
PID:6332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0lvwjer5.kcx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DbAGrxG.exe

Filesize
1.9MB

MD5
4504fb5199720e96ea92a688884a6a8b

SHA1
65062f2d299d6a7d9c5b361d01aac9010a00fc52

SHA256
c625bf10ef4ddfbd4e5bb79d523feadbac2db6eb4ad3b55a63d4a0f3900f2708

SHA512
d04ac9426e0550ded25ac168cf3c0b231489cd52fc9d5ff9f564dd98dad32083cb019996be1bc245beb0cb5b72a98912e575d993ee99c81947c9cf6398fea720

Download Submit
C:\Windows\System\FjXMMgO.exe

Filesize
1.9MB

MD5
88105aeab297c51b5b7101be9976dd28

SHA1
e85e00fd85437461dd059bf73ba407bb6ac860a3

SHA256
7650e85d39160e85910d5e92b5cf58e02bb85f638b57d2a9a667d09a8919a971

SHA512
d705e85a744e514b540df583d596ab19ab436f856aee56c48eaad03454a842e3347477c8daf7261e57bf28226d37a8d1c4e57be515eacd1f93b30b47f2d7d84e

Download Submit
C:\Windows\System\IHYqrUC.exe

Filesize
1.9MB

MD5
3c0730e5def48022fdc22f83519bda11

SHA1
e9c192b455410c4b762964cde9be7463c48d8eaf

SHA256
e31c7a7e14c7cf9981e65f55c46ecd3dac0b4ae24d6e5756cd86fbe636443587

SHA512
23a713aa6e7ac2f0928d592243f5d05866857b23cf063d14dcafd2c89ed94a3c2e4ac2224c57e6406643a26f1e571a088277a2f75d4a5647b9c01752e7025383

Download Submit
C:\Windows\System\IQcsKwC.exe

Filesize
1.9MB

MD5
04d801c44c0e372b693f546b66ce385d

SHA1
7d3f033a6747b5487fe2de26602e83ad8c42edb1

SHA256
1426edd01e5e9154e6ec207acd50b35ef9a9099fbc97c64a9fb4a7658a8969bd

SHA512
c1abea1d6e8217b9fb8d508e0e62df6fb07da8e6efe75b4c1d9474aa5b9eb1bc8b2a301f342c6041fc3d90df6f172950c287554720d84294ace2b1bcf4e4c40f

Download Submit
C:\Windows\System\IYGVvkb.exe

Filesize
1.9MB

MD5
2cdb9ba6f91a6d3f12ce34f90cc307c3

SHA1
829799aa2332a4d973c22af331814b61524602b8

SHA256
4077c20e017af9c6cbdfbf53f75d537d8008d6252a4aa003c3d7da95d3c8a2ef

SHA512
d0e5c7f4403ec9a5ecc913d7ba60d13aa48f8763df04a71052883778c88fe0334a3e38b21ad9064fb9d32ac6d0f1b15a0f9c6a106e2fc3c6a4e91e034272a4cb

Download Submit
C:\Windows\System\JAWPhAt.exe

Filesize
1.9MB

MD5
987394c640971393e85a82be5343803f

SHA1
9494f955e5954a292e24c6994064a0460c2f4e6e

SHA256
c22480b93c50a33369cf08c155e3d9988ac98f01dad68d3f0631005871244326

SHA512
92ca48b18f00917d1b666fbf4b3d6a65a8f6cdf1fa3e7f4fb561a8294cc4b60c99255c2ba493be85e86a3479e93b15bfb4de81aee38e8f5e56a3cf5647784c1f

Download Submit
C:\Windows\System\JXcqCKX.exe

Filesize
1.9MB

MD5
c47e5cc661f417fdd27e6d5dff55acf4

SHA1
827935f7799d829470246661cfe112ff5b8838b5

SHA256
9f3245565dce6b4a736eb6958df8578ad8e4fec66d4c6b20f61677dc7183da44

SHA512
c91dd96bf9fa45fc619199c29af9fc6298f1ddfc35480379d9206105f7dcd5bdb2651b0290aab58f2de85cc3cc5b1d04fbdb8e21724ddeae8f8f6e93f0e56926

Download Submit
C:\Windows\System\LhfAIUj.exe

Filesize
1.9MB

MD5
407f236966488d7604b53575bdc54a70

SHA1
017a7b36a94a76e2d3c4c8b76231706f20f9ab2e

SHA256
41532644321acff080a2aef5755b7a857b839c9333adf776d5c19e1f7fea10dd

SHA512
7385657a94a09f0f16b0263c46c4ea59aba520f13881b56961b470389dcc113810d9dceaa0f3595206659968265c8515f4048663f981e1d96a42943241ac6ded

Download Submit
C:\Windows\System\PYTCuuN.exe

Filesize
1.9MB

MD5
6ca2aa9e4ed6dd4c488635dc8442ca7c

SHA1
0352c4c9466b56d86e798b9431ef3982bbc1903b

SHA256
ab81d42ccfb5743c55fbf8300edab7ee2cdc140d35c67e74545a7f11f6199da4

SHA512
c3fad4b15be0cd4edfeab3b787007f30c2763c8f9bd88f8bcc9b3e1db1b47e302d6d193eb08da84e49cefa7d88bd001f103d5ea4926ff061e11be26c60989dcd

Download Submit
C:\Windows\System\QwCbNTY.exe

Filesize
1.9MB

MD5
9fc3039aa7b7d3340adfc5f438118121

SHA1
e56c6037f43892b070200d57b519bcfaecd54da7

SHA256
50f31416f17e83647b90920e11438384946624127491da7363acee1d819c4b05

SHA512
fbc3916fae54aaa7b5d889f38d774888e730f796445776be8cfc165834b221353bdb587691c379cbc6288c42385f8f2cf4a43739cc92825125635e8bd0620ab6

Download Submit
C:\Windows\System\RJwVYeo.exe

Filesize
1.9MB

MD5
a422677db5a129d7a5f0491ae250f4c3

SHA1
14492b7a95acf20cc5041cc0b008e96930720806

SHA256
77cf0db87baa1a871254169a44b75c658c236aa271bc06a9bafcdacb9971b5d6

SHA512
6a75d5e03718d9a0351dad35faaa8e3a95cabe643659a5990f9670fd1bddf811eb1b97f22c8d7998c36f532ca7fb4c89f8fbfbd73283bf43fac3280e39ff5441

Download Submit
C:\Windows\System\TSrynJA.exe

Filesize
1.9MB

MD5
d234cbd4a114d55cf49de604bbc7a812

SHA1
1cb4dc6e59475bc17bcf2fc5f315b2ade932f059

SHA256
1b6fc0ad94be98ff60c9c12e90585ef01b92d1280e5587682780120d55b9cee4

SHA512
9915734d89864715f532e75e29f876ad861425c50766f9b0dcb1d3bf7be409edc4fe9f80a15f084d3afd463b8e7fa78750fd2dcd7874acb5a5f83c25be87562d

Download Submit
C:\Windows\System\UPSbPeK.exe

Filesize
1.9MB

MD5
e820e11b47a547cc794b2b10899fdeb1

SHA1
c04362f7261e0666923ab8901b3b6110ac779695

SHA256
d216d62344105d38699bf3a5f16c5ce2490f1922649d6a499f88cbcbf9533932

SHA512
c0461623db2ced7a3e6861a2d16a87add856fe7a31e34b7f5773e08c84e57cad1330dafa804c63dc582bfd59d2abc4c31e0d2c6825ad79df401081fff4c5ae2e

Download Submit
C:\Windows\System\VbAikwy.exe

Filesize
1.9MB

MD5
3690122ea16a5533432332f496a4fe6d

SHA1
5744445d89e71ce0d4c8c7dd9a855bf6a3ea3d1f

SHA256
5936c6f2d057f9308e807992014218c5145db6c9928615eec5bf2e96d895b9dd

SHA512
a5af09e6dcaa022c9342145eb34d60ab68be5182de6e1fcde7c5c08622cb6b0fcadaad6ab041e36723ca601605a6305336f83732eb78cff83611c0765e7aa496

Download Submit
C:\Windows\System\XTxsALe.exe

Filesize
1.9MB

MD5
8eb47a57122cd969245cf969faf02ad0

SHA1
2bf4c97cb07b04243045a119665d16c56e23e37e

SHA256
79f49ca3308777a4e44290d1bf4e8ba49f44facdcc6f5f2f027d6d94cedb6bff

SHA512
8da6585b9b3e437cd3f9c9672249e3628673284884c016a34b87b5a17ed799c9604ed78a273e3e6d2a6950ce78f8377f5668dfd66ecc734c7c5d7df3776a2006

Download Submit
C:\Windows\System\YHeatJH.exe

Filesize
1.9MB

MD5
72509f809f9eaad536c20511c5d8801f

SHA1
1036fef47ae5970c29fbe29aee4e2cf92707213e

SHA256
4d8a3cea69efbbe37071c26ceb3f26c6843986db015e10e9043af29f79c87057

SHA512
08e8f895bff8de19d3230075db6b2914cde47eec2b88576a1d04c4cfc5773365194d726bd423fab413e6e21eeb22101f1231d7bc13eb7c339cab14a6f12a550e

Download Submit
C:\Windows\System\YXznOsi.exe

Filesize
1.9MB

MD5
0200612eb9eb40b13cc1dd9dcc2704a9

SHA1
958ff38ba5ab24d975283fb909206ba52f849259

SHA256
b1eab14e966d6ed0f20237284c31da67293e6938647aae3e4e46f3fa9570105c

SHA512
f3e70f8def9ce360d5d8c3ddd670dd9f76a5f38e76bdec6a656a58c9a37d0ffbe52e418996a1f3d15725afb188c6ff3c9e55e95adc43d9422577c05b5ea28e04

Download Submit
C:\Windows\System\bDwoeqW.exe

Filesize
1.9MB

MD5
c444d646e3ccd411b50e47bce25fa06f

SHA1
f3096a3ca1bbfc37ca5da846af1e34414f7a674d

SHA256
4e196641dfeb1b754140ebff000496245412a79af9d48eed1f437f5bab2f6daf

SHA512
995b055aa0b2e6c23b931c80337a279b37432055ef27d9c319ed831b8d4751ad7d4f033e79adc38e4c4c6546cf83b49f04bb7bd2e1ce49671fa5ffc3b2e4b043

Download Submit
C:\Windows\System\bMVGzAm.exe

Filesize
1.9MB

MD5
d99604fb39a90936e98dbbd812a6abc8

SHA1
5da3f6c5c39f50c8042837b3c5453eb044a49f4a

SHA256
83bad9977b633682f09e6fd32582452542551ab091af996e54d8cbd171e5a3f7

SHA512
1d85c870245677ed2fdc2506f68cd21ab0ed6a47cea1b66115a03791e5b331e2251bbe46bb373643947fb29fb1564e9ba668a5118a9cb6457570dc757464ef81

Download Submit
C:\Windows\System\bpcBHtS.exe

Filesize
1.9MB

MD5
ae0d92e42899efcda516e05768a30496

SHA1
01acec03a10f4ca6346f2147f5dcd29415b96e6b

SHA256
18027cca9c15d981ab99fe4541277745dacbef113085c5fe037644958d0d51ca

SHA512
976c2f984d7e8580af5b480ba76f172e6dee2d55aa9a2f4515e9744ba7ac40983f88473268b4d37a9071cecad35d3341b86b2338f7fa89099c0a534205aa44cb

Download Submit
C:\Windows\System\cPJjymt.exe

Filesize
1.9MB

MD5
af196d7b0352113d52ad39fab8249ab5

SHA1
59fb730b452367628e50270f60a7b22796fcbde4

SHA256
4484bafd5106f0f7f1e86f10180a0827e862cafe09981e9e00379ca438085259

SHA512
644cb4c24e7254e8a497d6f75a9a749626baa204fedd420c6ade1b93f526cebe6031065264311a4ab8aa7fe938c33da89172ac5f190c0dd7811799df8e86dc54

Download Submit
C:\Windows\System\cmWoxCg.exe

Filesize
1.9MB

MD5
1fc2c2b7d0ff1df615d3acbfcd02f9fc

SHA1
d447bf5ca6303c892421f62ecca275c3bfb94f7b

SHA256
8211ed74e19ee9dae4db25dc9094fa74805bea9cbbbe6b5580f65de4fc264c00

SHA512
b8954bf46c606780b6934c8e2dbdcde58c4aec48acb64b826bd8a88c5c94b23a5ebb5a1c024957a3219d5ae3c16e03b349492ffdc9b11544e38e9cc56188f9b8

Download Submit
C:\Windows\System\fzjJLUx.exe

Filesize
1.9MB

MD5
58ab09cc46d1b1fbc83063e65dde7e5f

SHA1
a33ed7a71209588585fd727bb40a89971351558d

SHA256
f71921640377c22c27b8f74a0afb99877a552fd06363820f38e2e99ec4470f22

SHA512
5456500f81dfdd311236a36fd59eb4416505a6d6630f509a0361dc658d18cd6c8cd19dfd16cd24e2e5a69df98fc1300e1b7b78039bdacb336d26b38adfad002a

Download Submit
C:\Windows\System\gHvJrlH.exe

Filesize
1.9MB

MD5
ce88968f92ca342086212b08885cc3e9

SHA1
20651e9dd5b464de257f60bc1bf2532d3c37ea19

SHA256
8a868e52a869e3ae1dfcec83602ac1f078fd1ae51948f4d124a708f79510e0fc

SHA512
e27e895ef06410397da61b1c864f4aab6abd0e2e3dc33a7c4f0d0991371b266545c154111ea4a87ab9bb73723df77bdbce7b0d715c753a3adcbd35ac6c457936

Download Submit
C:\Windows\System\jjFJLrj.exe

Filesize
1.9MB

MD5
a153c2740fdfb588da66e3bd147b5a62

SHA1
5f0a9a32f4d406ed37865d20678d8b4eb2331013

SHA256
25862937ecb8585b4c31d00efe63e4213829bc4bd20f849a1301828e5340012a

SHA512
20e5220581397b5ac2783887c36168ec08987bbb8b1a49707073cefaf8608d3a31cbed414241c3b2052532b8e9557e033cf6937bed483a5fa605594727ecc4c6

Download Submit
C:\Windows\System\meajDTe.exe

Filesize
1.9MB

MD5
f4d642be4a409be456349f7de34046e9

SHA1
135876fc65af7533272d45981c2b69385080a808

SHA256
7454815a98f029227a670e550776958544231feda42dbc51dcc16555f35f4c3f

SHA512
41ebee56697ec66efe13cff11fc437907ae9038cf30928313db7cbb62714bb0090d6581a0709e4fbae0a753e629824b25cfb0f39ffe48942f863f7d8162597c0

Download Submit
C:\Windows\System\pKnFIvi.exe

Filesize
1.9MB

MD5
fc760e4a0e45888919e784560a2025f6

SHA1
8786fb4c54e2d847cf8877f4bf74c526348bc23d

SHA256
7fd51081cc56928cb91ffcd73226ccda9600fb5295487ac4e94bf37e64163e56

SHA512
1d8b0d01c2b35fb596a5b1a2c3fdd8cf9adbd7fe0cf299b7e8d0e13fb9bdc725ef4cb748eb90475591e479ba28bad0a8ecaa740bbc01ef267416e1e806c2122a

Download Submit
C:\Windows\System\rFPvITV.exe

Filesize
1.9MB

MD5
3625ecbe6af5f83389bdd2ebb1bec281

SHA1
2304b2fd6f848e1accd814f5cdbe1f90ecfee2c1

SHA256
33364e9f7b5d3255c630af969382891803eadaac9c48bf124bc52b8e2fd63599

SHA512
b3dc047d19cb02b97cea45fd87ccaa68cc7521dfa5ac98a6a4996a2a4bd82920ef23c92858bfcd55074c6476e897c57f82c5b171afcaebfc7c839ff18073d155

Download Submit
C:\Windows\System\tdJxenk.exe

Filesize
1.9MB

MD5
58f661ddbc190a8f7a1e8c7d67307da5

SHA1
901307cd2257ad13a9c33f8d38fb7f3751921c46

SHA256
73f454f3244b4dacef78538f85f1acd44363634619a20d6dc7096c7b16a23ff3

SHA512
5e771f36a793bfb109a957d8717865a3e70dfd2201392797b40d283d822842e8f08cc2e4a496cde9bcc7dac11f0146672281d5e892cf635c98e214794cff7b3b

Download Submit
C:\Windows\System\uQrGbBX.exe

Filesize
8B

MD5
2adac273ce248e8d242a4b12f749bb46

SHA1
300bd2c60c669d978305195f11eaf26c73d9e457

SHA256
5a695799bf8f73300a4f9c4a59fd25b209a2457abf1051a262d540e520557456

SHA512
011941b215532355e8e4d21af78180da68d2fe04927118ebe818ec14ec4bfb6a7a2d9aaa01fdfd0cd2c6dc84968b5f642ccf10cc92c29aa0e1d06bcf6f120232

Download Submit
C:\Windows\System\wJEdYld.exe

Filesize
1.9MB

MD5
984b08fa7b668a0c7c07b46e462e9613

SHA1
ded1b37c6872126fcc58db3844ee3a503e492ab7

SHA256
ca5a00664b4d6e4b28309d88880325ab3f179a95f61960a8484dc742ffbda362

SHA512
ead0bbecd5ed27697c91dc9052de34934923916692573640449f74c23e3e8f58b6c2791d89b37bb9dd5de5b47b3269bf1a6d6e495b9898b241a89c2cc60996c9

Download Submit
C:\Windows\System\woOwkEf.exe

Filesize
1.9MB

MD5
7c582da1828f8944019fa71953398866

SHA1
037d71ce9719890903fc0b170690e62dd3ab760c

SHA256
720d80d3d0f74c4982d60b8dea2003bbd5fc32327b636d7befe2833232d0189d

SHA512
4f1a7b51949af30d0a53ad840933390136acf22ec56dd32414eefb53e25e9ef5358d28b55f89c3fbaaefe056e2986a202cde413b6251d283a353ed12b3d6323b

Download Submit
C:\Windows\System\wzQNWEX.exe

Filesize
1.9MB

MD5
3b041063f042a8be8b817c2180c3d4f7

SHA1
a87b802d7b197b4407d7ac663c748fcd4f5a55a6

SHA256
39a646da7fd8663814a381dc44f6de58224cdd34282bfc1de4d3387ed13e7a13

SHA512
3ca17635698ec72e2751ee2e4efb39a1289aeb2031154a7f7fd184440d6deeaf092342ca47c6cbec24710ac5fe24f6257326ebd58dfdeac463287793d2376800

Download Submit
C:\Windows\System\yGGWVsS.exe

Filesize
1.9MB

MD5
098d428a10e09f729697005bcb1c8cb7

SHA1
95f7e644c46cea8feb0e47900ab4de77fb6d2331

SHA256
373efa8845b43f2d1a4d32bde7238ddcfb856b6769852f115b172cf5457da6ec

SHA512
d052760de26c8ccac112163c68a362be5517b1ddf0a89b990eeb61fca6bafe0076b33434d289937bf85821da0a9d3e4d05e885d9443810c75a020ed5c2e6f6bc

Download Submit
C:\Windows\System\yanWjTf.exe

Filesize
1.9MB

MD5
972b8f0ed32822c4230fdc461e487d33

SHA1
f6404e3b2acb148a581c8599208fcbd5652cb2eb

SHA256
a9fa8cbb7d0fe4aee1e566bae3ce6bc2ce7862ef8117d6745bc58c4b89522ebc

SHA512
f99d8c283ab01be0552ea24ebaed71e44c4f83ec02120fcf38632fe18146cf74cacef500085d60e3ea303aa52bfb3e0d0ad3bdf4e69fb81af63ff1794757002d

Download Submit
C:\Windows\System\yxzizgQ.exe

Filesize
1.9MB

MD5
9523c968d83e34080b9dccaf9dbc5020

SHA1
b3323dd0f8181b4de2a697ee69759c0e4734d1a8

SHA256
ef3dcf1a037c0250b1292a4c3d6ee5734b5ba3c41ee5cce9b2cb915c0162c5ce

SHA512
73146b09eb19b58b22422b0af1c9e09c8d2f60dcbf5137f94b8479ac383e8979098ffe2d091f493b2b831d5dd0c8481cf2e000a0cf7ca0f47f92493612d4edea

Download Submit
memory/212-3826-0x00007FF706150000-0x00007FF706542000-memory.dmp

Filesize
3.9MB

Download
memory/212-665-0x00007FF706150000-0x00007FF706542000-memory.dmp

Filesize
3.9MB

Download
memory/624-0-0x00007FF68C7B0000-0x00007FF68CBA2000-memory.dmp

Filesize
3.9MB

Download
memory/624-1-0x0000024D7B890000-0x0000024D7B8A0000-memory.dmp

Filesize
64KB

Download
memory/872-155-0x00007FF714630000-0x00007FF714A22000-memory.dmp

Filesize
3.9MB

Download
memory/872-3793-0x00007FF714630000-0x00007FF714A22000-memory.dmp

Filesize
3.9MB

Download
memory/1052-3797-0x00007FF60DC00000-0x00007FF60DFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1052-156-0x00007FF60DC00000-0x00007FF60DFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-3814-0x00007FF73EDF0000-0x00007FF73F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1116-782-0x00007FF73EDF0000-0x00007FF73F1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-3806-0x00007FF757400000-0x00007FF7577F2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-340-0x00007FF757400000-0x00007FF7577F2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-423-0x00007FF7F0920000-0x00007FF7F0D12000-memory.dmp

Filesize
3.9MB

Download
memory/1304-3809-0x00007FF7F0920000-0x00007FF7F0D12000-memory.dmp

Filesize
3.9MB

Download
memory/1480-3816-0x00007FF6D1A30000-0x00007FF6D1E22000-memory.dmp

Filesize
3.9MB

Download
memory/1480-345-0x00007FF6D1A30000-0x00007FF6D1E22000-memory.dmp

Filesize
3.9MB

Download
memory/1788-3795-0x00007FF69F1F0000-0x00007FF69F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1788-87-0x00007FF69F1F0000-0x00007FF69F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-3751-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp

Filesize
3.9MB

Download
memory/2312-14-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp

Filesize
3.9MB

Download
memory/2312-3785-0x00007FF6B4420000-0x00007FF6B4812000-memory.dmp

Filesize
3.9MB

Download
memory/2364-3790-0x00007FF714430000-0x00007FF714822000-memory.dmp

Filesize
3.9MB

Download
memory/2364-52-0x00007FF714430000-0x00007FF714822000-memory.dmp

Filesize
3.9MB

Download
memory/2388-204-0x00007FF78E920000-0x00007FF78ED12000-memory.dmp

Filesize
3.9MB

Download
memory/2388-3821-0x00007FF78E920000-0x00007FF78ED12000-memory.dmp

Filesize
3.9MB

Download
memory/2724-664-0x00007FF7D4590000-0x00007FF7D4982000-memory.dmp

Filesize
3.9MB

Download
memory/2724-3828-0x00007FF7D4590000-0x00007FF7D4982000-memory.dmp

Filesize
3.9MB

Download
memory/3200-3835-0x00007FF68CC00000-0x00007FF68CFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3200-562-0x00007FF68CC00000-0x00007FF68CFF2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-15-0x000001CBDCB90000-0x000001CBDCBA0000-memory.dmp

Filesize
64KB

Download
memory/3268-148-0x000001CBC44F0000-0x000001CBC4512000-memory.dmp

Filesize
136KB

Download
memory/3268-16-0x00007FFCC2C33000-0x00007FFCC2C35000-memory.dmp

Filesize
8KB

Download
memory/3492-3787-0x00007FF63AF80000-0x00007FF63B372000-memory.dmp

Filesize
3.9MB

Download
memory/3492-35-0x00007FF63AF80000-0x00007FF63B372000-memory.dmp

Filesize
3.9MB

Download
memory/3904-292-0x00007FF7E0540000-0x00007FF7E0932000-memory.dmp

Filesize
3.9MB

Download
memory/3904-3824-0x00007FF7E0540000-0x00007FF7E0932000-memory.dmp

Filesize
3.9MB

Download
memory/3964-3819-0x00007FF79C780000-0x00007FF79CB72000-memory.dmp

Filesize
3.9MB

Download
memory/3964-346-0x00007FF79C780000-0x00007FF79CB72000-memory.dmp

Filesize
3.9MB

Download
memory/4436-3823-0x00007FF764820000-0x00007FF764C12000-memory.dmp

Filesize
3.9MB

Download
memory/4436-240-0x00007FF764820000-0x00007FF764C12000-memory.dmp

Filesize
3.9MB

Download
memory/4508-342-0x00007FF663100000-0x00007FF6634F2000-memory.dmp

Filesize
3.9MB

Download
memory/4508-3833-0x00007FF663100000-0x00007FF6634F2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-3811-0x00007FF6C57E0000-0x00007FF6C5BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-253-0x00007FF6C57E0000-0x00007FF6C5BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-3831-0x00007FF6E3C00000-0x00007FF6E3FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-518-0x00007FF6E3C00000-0x00007FF6E3FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-3812-0x00007FF734820000-0x00007FF734C12000-memory.dmp

Filesize
3.9MB

Download
memory/4820-1037-0x00007FF734820000-0x00007FF734C12000-memory.dmp

Filesize
3.9MB

Download
memory/4900-3802-0x00007FF72FA30000-0x00007FF72FE22000-memory.dmp

Filesize
3.9MB

Download
memory/4900-1040-0x00007FF72FA30000-0x00007FF72FE22000-memory.dmp

Filesize
3.9MB

Download
memory/4956-3804-0x00007FF736350000-0x00007FF736742000-memory.dmp

Filesize
3.9MB

Download
memory/4956-343-0x00007FF736350000-0x00007FF736742000-memory.dmp

Filesize
3.9MB

Download
memory/5016-117-0x00007FF7C8180000-0x00007FF7C8572000-memory.dmp

Filesize
3.9MB

Download
memory/5016-3792-0x00007FF7C8180000-0x00007FF7C8572000-memory.dmp

Filesize
3.9MB

Download