xmrig | 0f5cdd6bd3b566fadd85fb6e435c6a9c461d1382cdb008503ac2036922841aff

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
Size

1.5MB
MD5

a916de2af8b180c4e45ffbe3c0b4fa90
SHA1

c26d6ba05dd0497faca8499fdd8968a2319828e6
SHA256

0f5cdd6bd3b566fadd85fb6e435c6a9c461d1382cdb008503ac2036922841aff
SHA512

4de42befee434d395eea1dc0f35a73b80747f9c190b7e8b1cce2c0dd25dff89a9e43b6351d9d91124f1b8ee6496e84c843b39857f34194f6c72e0963fd8006b5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1yuya:Lz071uv4BPMkHC0IEFTo/abRu/

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/4944-526-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp	xmrig
behavioral2/memory/4308-673-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp	xmrig
behavioral2/memory/2868-781-0x00007FF776620000-0x00007FF776A12000-memory.dmp	xmrig
behavioral2/memory/496-784-0x00007FF693160000-0x00007FF693552000-memory.dmp	xmrig
behavioral2/memory/2620-786-0x00007FF715F50000-0x00007FF716342000-memory.dmp	xmrig
behavioral2/memory/1708-785-0x00007FF66C4B0000-0x00007FF66C8A2000-memory.dmp	xmrig
behavioral2/memory/1956-783-0x00007FF7416B0000-0x00007FF741AA2000-memory.dmp	xmrig
behavioral2/memory/4712-664-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp	xmrig
behavioral2/memory/4116-448-0x00007FF7CD930000-0x00007FF7CDD22000-memory.dmp	xmrig
behavioral2/memory/532-440-0x00007FF6E8170000-0x00007FF6E8562000-memory.dmp	xmrig
behavioral2/memory/4788-389-0x00007FF6204C0000-0x00007FF6208B2000-memory.dmp	xmrig
behavioral2/memory/4724-333-0x00007FF6DB970000-0x00007FF6DBD62000-memory.dmp	xmrig
behavioral2/memory/4268-330-0x00007FF6CB490000-0x00007FF6CB882000-memory.dmp	xmrig
behavioral2/memory/2680-302-0x00007FF7C0A90000-0x00007FF7C0E82000-memory.dmp	xmrig
behavioral2/memory/3972-263-0x00007FF7D82C0000-0x00007FF7D86B2000-memory.dmp	xmrig
behavioral2/memory/564-255-0x00007FF6F2050000-0x00007FF6F2442000-memory.dmp	xmrig
behavioral2/memory/3924-204-0x00007FF73D800000-0x00007FF73DBF2000-memory.dmp	xmrig
behavioral2/memory/1088-203-0x00007FF762230000-0x00007FF762622000-memory.dmp	xmrig
behavioral2/memory/4908-195-0x00007FF7883E0000-0x00007FF7887D2000-memory.dmp	xmrig
behavioral2/memory/4352-174-0x00007FF76C8C0000-0x00007FF76CCB2000-memory.dmp	xmrig
behavioral2/memory/2180-194-0x00007FF6A8BB0000-0x00007FF6A8FA2000-memory.dmp	xmrig
behavioral2/memory/1272-124-0x00007FF66A4F0000-0x00007FF66A8E2000-memory.dmp	xmrig
behavioral2/memory/1076-88-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	xmrig
behavioral2/memory/4840-60-0x00007FF6949F0000-0x00007FF694DE2000-memory.dmp	xmrig
behavioral2/memory/4352-7945-0x00007FF76C8C0000-0x00007FF76CCB2000-memory.dmp	xmrig
behavioral2/memory/4788-8024-0x00007FF6204C0000-0x00007FF6208B2000-memory.dmp	xmrig
behavioral2/memory/2620-8127-0x00007FF715F50000-0x00007FF716342000-memory.dmp	xmrig
behavioral2/memory/4116-8124-0x00007FF7CD930000-0x00007FF7CDD22000-memory.dmp	xmrig
behavioral2/memory/2868-8131-0x00007FF776620000-0x00007FF776A12000-memory.dmp	xmrig
behavioral2/memory/4308-8151-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp	xmrig
behavioral2/memory/4944-8156-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp	xmrig
behavioral2/memory/4712-8154-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp	xmrig
behavioral2/memory/3972-8148-0x00007FF7D82C0000-0x00007FF7D86B2000-memory.dmp	xmrig
behavioral2/memory/4724-8166-0x00007FF6DB970000-0x00007FF6DBD62000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3180	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4840	gcIFndl.exe
1076	DGqCMmZ.exe
1272	HjWoURL.exe
4352	WMAKwTs.exe
2180	BvLHFHI.exe
4908	WajPEXw.exe
1088	RGDZscc.exe
3924	Rxihfcm.exe
564	HSSbpqt.exe
1956	TlcyPKN.exe
3972	XcQgdwz.exe
2680	cwkBRtz.exe
4268	oxSEjlY.exe
4724	iDJmlAZ.exe
496	BgFreTY.exe
1708	HpGXMcP.exe
4788	lZYHthR.exe
532	bqENHOu.exe
4116	Xbqqnsz.exe
4944	hbLuLtc.exe
4712	nMvwLdT.exe
4308	lGfxJkJ.exe
2620	ommPoNh.exe
2868	oLupQWE.exe
2344	jjvGbHn.exe
3532	fXherZB.exe
3360	jzcExOG.exe
2896	jVGhfke.exe
5052	neHuawJ.exe
4740	FmkgxuK.exe
3388	xGsQLJY.exe
4584	QKTCcHK.exe
4260	veqquRo.exe
1604	ZyZNGvd.exe
1772	JjsoMDe.exe
4696	YKKFbmD.exe
1436	LvNBpBU.exe
3572	denDQrO.exe
3136	usqwNcv.exe
3560	qRxKoxf.exe
4464	sJnEBzQ.exe
4052	iqtrzRE.exe
4524	bTujFou.exe
2264	XbZmcOc.exe
4984	EcbqNEQ.exe
1504	pmWuPeC.exe
1220	HCZMFYp.exe
5040	IASBjfm.exe
4400	DElPGtZ.exe
4064	jhEkWAJ.exe
4600	bdwahuz.exe
4928	tmPUebv.exe
1120	HlozuTk.exe
4528	dwXEKGC.exe
3040	kMruAjI.exe
3600	qfJFoRN.exe
2356	TgdjEzt.exe
4016	AzZrmlD.exe
3440	IZRYrfW.exe
1780	waYRMmS.exe
116	LoLJkbu.exe
224	bMLikra.exe
4428	qXAEoXC.exe
1752	VoXemch.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2940-0-0x00007FF7D4F50000-0x00007FF7D5342000-memory.dmp	upx
behavioral2/files/0x000700000002343f-7.dat	upx
behavioral2/files/0x000800000002343e-8.dat	upx
behavioral2/files/0x0007000000023441-18.dat	upx
behavioral2/files/0x0007000000023447-73.dat	upx
behavioral2/files/0x0007000000023455-133.dat	upx
behavioral2/memory/4944-526-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp	upx
behavioral2/memory/4308-673-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp	upx
behavioral2/memory/2868-781-0x00007FF776620000-0x00007FF776A12000-memory.dmp	upx
behavioral2/memory/496-784-0x00007FF693160000-0x00007FF693552000-memory.dmp	upx
behavioral2/memory/2620-786-0x00007FF715F50000-0x00007FF716342000-memory.dmp	upx
behavioral2/memory/1708-785-0x00007FF66C4B0000-0x00007FF66C8A2000-memory.dmp	upx
behavioral2/memory/1956-783-0x00007FF7416B0000-0x00007FF741AA2000-memory.dmp	upx
behavioral2/memory/4712-664-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp	upx
behavioral2/memory/4116-448-0x00007FF7CD930000-0x00007FF7CDD22000-memory.dmp	upx
behavioral2/memory/532-440-0x00007FF6E8170000-0x00007FF6E8562000-memory.dmp	upx
behavioral2/memory/4788-389-0x00007FF6204C0000-0x00007FF6208B2000-memory.dmp	upx
behavioral2/memory/4724-333-0x00007FF6DB970000-0x00007FF6DBD62000-memory.dmp	upx
behavioral2/memory/4268-330-0x00007FF6CB490000-0x00007FF6CB882000-memory.dmp	upx
behavioral2/memory/2680-302-0x00007FF7C0A90000-0x00007FF7C0E82000-memory.dmp	upx
behavioral2/memory/3972-263-0x00007FF7D82C0000-0x00007FF7D86B2000-memory.dmp	upx
behavioral2/memory/564-255-0x00007FF6F2050000-0x00007FF6F2442000-memory.dmp	upx
behavioral2/memory/3924-204-0x00007FF73D800000-0x00007FF73DBF2000-memory.dmp	upx
behavioral2/memory/1088-203-0x00007FF762230000-0x00007FF762622000-memory.dmp	upx
behavioral2/memory/4908-195-0x00007FF7883E0000-0x00007FF7887D2000-memory.dmp	upx
behavioral2/files/0x0007000000023464-193.dat	upx
behavioral2/files/0x0007000000023463-192.dat	upx
behavioral2/files/0x0007000000023462-191.dat	upx
behavioral2/files/0x0007000000023461-190.dat	upx
behavioral2/files/0x0007000000023457-188.dat	upx
behavioral2/files/0x0007000000023460-187.dat	upx
behavioral2/files/0x000700000002345f-186.dat	upx
behavioral2/files/0x000700000002345e-181.dat	upx
behavioral2/files/0x000700000002345d-178.dat	upx
behavioral2/files/0x0007000000023454-175.dat	upx
behavioral2/memory/4352-174-0x00007FF76C8C0000-0x00007FF76CCB2000-memory.dmp	upx
behavioral2/files/0x000700000002345c-173.dat	upx
behavioral2/files/0x000700000002345b-172.dat	upx
behavioral2/files/0x000700000002345a-165.dat	upx
behavioral2/memory/2180-194-0x00007FF6A8BB0000-0x00007FF6A8FA2000-memory.dmp	upx
behavioral2/files/0x000700000002344c-164.dat	upx
behavioral2/files/0x0007000000023459-158.dat	upx
behavioral2/files/0x0008000000023449-154.dat	upx
behavioral2/files/0x0007000000023458-149.dat	upx
behavioral2/files/0x000700000002344b-148.dat	upx
behavioral2/files/0x0007000000023456-139.dat	upx
behavioral2/files/0x000700000002344a-138.dat	upx
behavioral2/files/0x000700000002344f-129.dat	upx
behavioral2/memory/1272-124-0x00007FF66A4F0000-0x00007FF66A8E2000-memory.dmp	upx
behavioral2/files/0x0007000000023453-122.dat	upx
behavioral2/files/0x0007000000023445-105.dat	upx
behavioral2/files/0x0007000000023443-101.dat	upx
behavioral2/files/0x0008000000023448-136.dat	upx
behavioral2/files/0x0007000000023450-95.dat	upx
behavioral2/files/0x0007000000023444-94.dat	upx
behavioral2/memory/1076-88-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp	upx
behavioral2/files/0x000700000002344e-83.dat	upx
behavioral2/files/0x0007000000023452-121.dat	upx
behavioral2/files/0x0007000000023451-120.dat	upx
behavioral2/files/0x0007000000023446-63.dat	upx
behavioral2/memory/4840-60-0x00007FF6949F0000-0x00007FF694DE2000-memory.dmp	upx
behavioral2/files/0x000700000002344d-79.dat	upx
behavioral2/files/0x0007000000023442-55.dat	upx
behavioral2/files/0x0007000000023440-25.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XlQcOws.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\BKgposT.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\XkdcmvD.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\OBduHmw.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\SsRJRbY.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\JgOhtnw.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\SFUaKLp.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\FOVyrMe.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\kyiSYBZ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ejZbunM.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\NnHxEQB.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\DvGioCU.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\zymPViZ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\qsZZGoO.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\pTRHiZi.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\RRWphkY.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\VjGOTrW.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\HzZXjKK.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\PKCoXxe.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\xJukxOe.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\SGACyWz.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\uAIhMCF.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\QywOdst.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\HIzmrvJ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\GkBsNZa.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\RonmQVj.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\FqkPvxF.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\IZLjBpP.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\XFTTVJy.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\uZlVyjK.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\rTfhjMp.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\bURMKAU.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\uuoDdGi.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\YMsifeI.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\jJyWwQZ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\HenlReI.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\svxHdnO.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\dwhWUyB.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\bLPGhnu.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ksGYajW.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\uuiqsNf.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\KJiGJlG.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\aCFQcYy.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ZLrXHgG.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\BwXMKPg.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\vhTKWfa.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ZUaHuTy.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ABCBFxr.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\Nveuyfa.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\HlPhHXo.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\RlMCmBr.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\IJBfyCr.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\qZIlXlI.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\bihMcTO.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\SDyxJgv.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\XbshwOX.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\HOSebRN.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\wkQAcxJ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\FBoVfPK.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\zfKrsAN.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\PjDInSJ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\niIUYUx.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\AgdZRfi.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\PKYoWyq.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3180	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	85
PID 2940 wrote to memory of 3180	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	85
PID 2940 wrote to memory of 1076	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	86
PID 2940 wrote to memory of 1076	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	86
PID 2940 wrote to memory of 4840	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	87
PID 2940 wrote to memory of 4840	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	87
PID 2940 wrote to memory of 1272	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	88
PID 2940 wrote to memory of 1272	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	88
PID 2940 wrote to memory of 2180	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	89
PID 2940 wrote to memory of 2180	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	89
PID 2940 wrote to memory of 4352	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	90
PID 2940 wrote to memory of 4352	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	90
PID 2940 wrote to memory of 4908	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	91
PID 2940 wrote to memory of 4908	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	91
PID 2940 wrote to memory of 1088	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	92
PID 2940 wrote to memory of 1088	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	92
PID 2940 wrote to memory of 3924	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	93
PID 2940 wrote to memory of 3924	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	93
PID 2940 wrote to memory of 564	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	94
PID 2940 wrote to memory of 564	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	94
PID 2940 wrote to memory of 1956	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	95
PID 2940 wrote to memory of 1956	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	95
PID 2940 wrote to memory of 3972	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	96
PID 2940 wrote to memory of 3972	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	96
PID 2940 wrote to memory of 2680	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	97
PID 2940 wrote to memory of 2680	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	97
PID 2940 wrote to memory of 4268	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	98
PID 2940 wrote to memory of 4268	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	98
PID 2940 wrote to memory of 4116	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	99
PID 2940 wrote to memory of 4116	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	99
PID 2940 wrote to memory of 4724	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	100
PID 2940 wrote to memory of 4724	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	100
PID 2940 wrote to memory of 496	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	101
PID 2940 wrote to memory of 496	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	101
PID 2940 wrote to memory of 1708	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	102
PID 2940 wrote to memory of 1708	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	102
PID 2940 wrote to memory of 4788	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	103
PID 2940 wrote to memory of 4788	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	103
PID 2940 wrote to memory of 532	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	104
PID 2940 wrote to memory of 532	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	104
PID 2940 wrote to memory of 4944	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	105
PID 2940 wrote to memory of 4944	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	105
PID 2940 wrote to memory of 4712	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	106
PID 2940 wrote to memory of 4712	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	106
PID 2940 wrote to memory of 4308	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	107
PID 2940 wrote to memory of 4308	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	107
PID 2940 wrote to memory of 2620	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	108
PID 2940 wrote to memory of 2620	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	108
PID 2940 wrote to memory of 2868	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	109
PID 2940 wrote to memory of 2868	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	109
PID 2940 wrote to memory of 2344	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	110
PID 2940 wrote to memory of 2344	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	110
PID 2940 wrote to memory of 3532	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	111
PID 2940 wrote to memory of 3532	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	111
PID 2940 wrote to memory of 3360	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	112
PID 2940 wrote to memory of 3360	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	112
PID 2940 wrote to memory of 2896	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	113
PID 2940 wrote to memory of 2896	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	113
PID 2940 wrote to memory of 5052	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	114
PID 2940 wrote to memory of 5052	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	114
PID 2940 wrote to memory of 4740	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	115
PID 2940 wrote to memory of 4740	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	115
PID 2940 wrote to memory of 3388	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	116
PID 2940 wrote to memory of 3388	2940	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\System\DGqCMmZ.exe
  C:\Windows\System\DGqCMmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\gcIFndl.exe
  C:\Windows\System\gcIFndl.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\HjWoURL.exe
  C:\Windows\System\HjWoURL.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\BvLHFHI.exe
  C:\Windows\System\BvLHFHI.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\WMAKwTs.exe
  C:\Windows\System\WMAKwTs.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\WajPEXw.exe
  C:\Windows\System\WajPEXw.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\RGDZscc.exe
  C:\Windows\System\RGDZscc.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\Rxihfcm.exe
  C:\Windows\System\Rxihfcm.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\HSSbpqt.exe
  C:\Windows\System\HSSbpqt.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\TlcyPKN.exe
  C:\Windows\System\TlcyPKN.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\XcQgdwz.exe
  C:\Windows\System\XcQgdwz.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\cwkBRtz.exe
  C:\Windows\System\cwkBRtz.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\oxSEjlY.exe
  C:\Windows\System\oxSEjlY.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\Xbqqnsz.exe
  C:\Windows\System\Xbqqnsz.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\iDJmlAZ.exe
  C:\Windows\System\iDJmlAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\BgFreTY.exe
  C:\Windows\System\BgFreTY.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\HpGXMcP.exe
  C:\Windows\System\HpGXMcP.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\lZYHthR.exe
  C:\Windows\System\lZYHthR.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\bqENHOu.exe
  C:\Windows\System\bqENHOu.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\hbLuLtc.exe
  C:\Windows\System\hbLuLtc.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\nMvwLdT.exe
  C:\Windows\System\nMvwLdT.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\lGfxJkJ.exe
  C:\Windows\System\lGfxJkJ.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\ommPoNh.exe
  C:\Windows\System\ommPoNh.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\oLupQWE.exe
  C:\Windows\System\oLupQWE.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\jjvGbHn.exe
  C:\Windows\System\jjvGbHn.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\fXherZB.exe
  C:\Windows\System\fXherZB.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\jzcExOG.exe
  C:\Windows\System\jzcExOG.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\jVGhfke.exe
  C:\Windows\System\jVGhfke.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\neHuawJ.exe
  C:\Windows\System\neHuawJ.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\FmkgxuK.exe
  C:\Windows\System\FmkgxuK.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\xGsQLJY.exe
  C:\Windows\System\xGsQLJY.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\QKTCcHK.exe
  C:\Windows\System\QKTCcHK.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\veqquRo.exe
  C:\Windows\System\veqquRo.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\ZyZNGvd.exe
  C:\Windows\System\ZyZNGvd.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\JjsoMDe.exe
  C:\Windows\System\JjsoMDe.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\YKKFbmD.exe
  C:\Windows\System\YKKFbmD.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\LvNBpBU.exe
  C:\Windows\System\LvNBpBU.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\denDQrO.exe
  C:\Windows\System\denDQrO.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\usqwNcv.exe
  C:\Windows\System\usqwNcv.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\qRxKoxf.exe
  C:\Windows\System\qRxKoxf.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\sJnEBzQ.exe
  C:\Windows\System\sJnEBzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\iqtrzRE.exe
  C:\Windows\System\iqtrzRE.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\bTujFou.exe
  C:\Windows\System\bTujFou.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\EcbqNEQ.exe
  C:\Windows\System\EcbqNEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\XbZmcOc.exe
  C:\Windows\System\XbZmcOc.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\pmWuPeC.exe
  C:\Windows\System\pmWuPeC.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\HCZMFYp.exe
  C:\Windows\System\HCZMFYp.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\IASBjfm.exe
  C:\Windows\System\IASBjfm.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\DElPGtZ.exe
  C:\Windows\System\DElPGtZ.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\jhEkWAJ.exe
  C:\Windows\System\jhEkWAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\bdwahuz.exe
  C:\Windows\System\bdwahuz.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\tmPUebv.exe
  C:\Windows\System\tmPUebv.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\HlozuTk.exe
  C:\Windows\System\HlozuTk.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\dwXEKGC.exe
  C:\Windows\System\dwXEKGC.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\kMruAjI.exe
  C:\Windows\System\kMruAjI.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\nsnbqFB.exe
  C:\Windows\System\nsnbqFB.exe
  2⤵
  PID:2736
- C:\Windows\System\qfJFoRN.exe
  C:\Windows\System\qfJFoRN.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\TgdjEzt.exe
  C:\Windows\System\TgdjEzt.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\AzZrmlD.exe
  C:\Windows\System\AzZrmlD.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\IZRYrfW.exe
  C:\Windows\System\IZRYrfW.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\waYRMmS.exe
  C:\Windows\System\waYRMmS.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\LoLJkbu.exe
  C:\Windows\System\LoLJkbu.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\bMLikra.exe
  C:\Windows\System\bMLikra.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\qXAEoXC.exe
  C:\Windows\System\qXAEoXC.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\VoXemch.exe
  C:\Windows\System\VoXemch.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\BUbMRYk.exe
  C:\Windows\System\BUbMRYk.exe
  2⤵
  PID:1136
- C:\Windows\System\FvDrrNv.exe
  C:\Windows\System\FvDrrNv.exe
  2⤵
  PID:1020
- C:\Windows\System\hsWvLSU.exe
  C:\Windows\System\hsWvLSU.exe
  2⤵
  PID:4440
- C:\Windows\System\GGnGggI.exe
  C:\Windows\System\GGnGggI.exe
  2⤵
  PID:4448
- C:\Windows\System\eUUIXAa.exe
  C:\Windows\System\eUUIXAa.exe
  2⤵
  PID:3356
- C:\Windows\System\ZHNXjrW.exe
  C:\Windows\System\ZHNXjrW.exe
  2⤵
  PID:4104
- C:\Windows\System\MDwEqEf.exe
  C:\Windows\System\MDwEqEf.exe
  2⤵
  PID:4168
- C:\Windows\System\hvcaUOG.exe
  C:\Windows\System\hvcaUOG.exe
  2⤵
  PID:5128
- C:\Windows\System\wRwtOvX.exe
  C:\Windows\System\wRwtOvX.exe
  2⤵
  PID:5148
- C:\Windows\System\AvapSZq.exe
  C:\Windows\System\AvapSZq.exe
  2⤵
  PID:5176
- C:\Windows\System\FwiTpOp.exe
  C:\Windows\System\FwiTpOp.exe
  2⤵
  PID:5196
- C:\Windows\System\dpJeQWj.exe
  C:\Windows\System\dpJeQWj.exe
  2⤵
  PID:5212
- C:\Windows\System\frsIebY.exe
  C:\Windows\System\frsIebY.exe
  2⤵
  PID:5228
- C:\Windows\System\ESrhqvE.exe
  C:\Windows\System\ESrhqvE.exe
  2⤵
  PID:5252
- C:\Windows\System\QVOOpWD.exe
  C:\Windows\System\QVOOpWD.exe
  2⤵
  PID:5272
- C:\Windows\System\wLQhlMK.exe
  C:\Windows\System\wLQhlMK.exe
  2⤵
  PID:5288
- C:\Windows\System\xwnubsC.exe
  C:\Windows\System\xwnubsC.exe
  2⤵
  PID:5304
- C:\Windows\System\vqddXEz.exe
  C:\Windows\System\vqddXEz.exe
  2⤵
  PID:5328
- C:\Windows\System\dRGVKwx.exe
  C:\Windows\System\dRGVKwx.exe
  2⤵
  PID:5356
- C:\Windows\System\qXQPWRs.exe
  C:\Windows\System\qXQPWRs.exe
  2⤵
  PID:5384
- C:\Windows\System\ZbqLIzq.exe
  C:\Windows\System\ZbqLIzq.exe
  2⤵
  PID:5400
- C:\Windows\System\vUDATDC.exe
  C:\Windows\System\vUDATDC.exe
  2⤵
  PID:5416
- C:\Windows\System\jqOTHDV.exe
  C:\Windows\System\jqOTHDV.exe
  2⤵
  PID:5468
- C:\Windows\System\JtkHWzI.exe
  C:\Windows\System\JtkHWzI.exe
  2⤵
  PID:5484
- C:\Windows\System\Fxhefzv.exe
  C:\Windows\System\Fxhefzv.exe
  2⤵
  PID:5508
- C:\Windows\System\MdWuXIu.exe
  C:\Windows\System\MdWuXIu.exe
  2⤵
  PID:5524
- C:\Windows\System\MZPmfUY.exe
  C:\Windows\System\MZPmfUY.exe
  2⤵
  PID:5548
- C:\Windows\System\gcxQrZD.exe
  C:\Windows\System\gcxQrZD.exe
  2⤵
  PID:5572
- C:\Windows\System\djtlxcC.exe
  C:\Windows\System\djtlxcC.exe
  2⤵
  PID:5588
- C:\Windows\System\ewURQaq.exe
  C:\Windows\System\ewURQaq.exe
  2⤵
  PID:5652
- C:\Windows\System\SACNpqk.exe
  C:\Windows\System\SACNpqk.exe
  2⤵
  PID:5672
- C:\Windows\System\hNkzFco.exe
  C:\Windows\System\hNkzFco.exe
  2⤵
  PID:5692
- C:\Windows\System\PgkfThY.exe
  C:\Windows\System\PgkfThY.exe
  2⤵
  PID:5716
- C:\Windows\System\YpotAqm.exe
  C:\Windows\System\YpotAqm.exe
  2⤵
  PID:5732
- C:\Windows\System\IQvaJqP.exe
  C:\Windows\System\IQvaJqP.exe
  2⤵
  PID:5812
- C:\Windows\System\LVtdomh.exe
  C:\Windows\System\LVtdomh.exe
  2⤵
  PID:5832
- C:\Windows\System\qQaNQyf.exe
  C:\Windows\System\qQaNQyf.exe
  2⤵
  PID:5852
- C:\Windows\System\wkUybjh.exe
  C:\Windows\System\wkUybjh.exe
  2⤵
  PID:5876
- C:\Windows\System\LHqjIQg.exe
  C:\Windows\System\LHqjIQg.exe
  2⤵
  PID:5908
- C:\Windows\System\ZFKaaPe.exe
  C:\Windows\System\ZFKaaPe.exe
  2⤵
  PID:5924
- C:\Windows\System\WlGPKrY.exe
  C:\Windows\System\WlGPKrY.exe
  2⤵
  PID:5940
- C:\Windows\System\quitiJY.exe
  C:\Windows\System\quitiJY.exe
  2⤵
  PID:5964
- C:\Windows\System\zuxrPFX.exe
  C:\Windows\System\zuxrPFX.exe
  2⤵
  PID:5980
- C:\Windows\System\eMviTev.exe
  C:\Windows\System\eMviTev.exe
  2⤵
  PID:5996
- C:\Windows\System\zEUTpxR.exe
  C:\Windows\System\zEUTpxR.exe
  2⤵
  PID:6016
- C:\Windows\System\ludUEBP.exe
  C:\Windows\System\ludUEBP.exe
  2⤵
  PID:6032
- C:\Windows\System\jMMAqTf.exe
  C:\Windows\System\jMMAqTf.exe
  2⤵
  PID:6048
- C:\Windows\System\cmeqdub.exe
  C:\Windows\System\cmeqdub.exe
  2⤵
  PID:6072
- C:\Windows\System\wBamyKY.exe
  C:\Windows\System\wBamyKY.exe
  2⤵
  PID:6088
- C:\Windows\System\jvtJnKI.exe
  C:\Windows\System\jvtJnKI.exe
  2⤵
  PID:6108
- C:\Windows\System\lRoBSMD.exe
  C:\Windows\System\lRoBSMD.exe
  2⤵
  PID:6136
- C:\Windows\System\NHCmpbM.exe
  C:\Windows\System\NHCmpbM.exe
  2⤵
  PID:5076
- C:\Windows\System\htwUKLy.exe
  C:\Windows\System\htwUKLy.exe
  2⤵
  PID:1960
- C:\Windows\System\agtOqUT.exe
  C:\Windows\System\agtOqUT.exe
  2⤵
  PID:5036
- C:\Windows\System\GVLXuUm.exe
  C:\Windows\System\GVLXuUm.exe
  2⤵
  PID:3680
- C:\Windows\System\OgfByUP.exe
  C:\Windows\System\OgfByUP.exe
  2⤵
  PID:3256
- C:\Windows\System\cZeQQyZ.exe
  C:\Windows\System\cZeQQyZ.exe
  2⤵
  PID:4068
- C:\Windows\System\Ugtmckh.exe
  C:\Windows\System\Ugtmckh.exe
  2⤵
  PID:4300
- C:\Windows\System\jsqAefY.exe
  C:\Windows\System\jsqAefY.exe
  2⤵
  PID:3448
- C:\Windows\System\GVJBvCI.exe
  C:\Windows\System\GVJBvCI.exe
  2⤵
  PID:2788
- C:\Windows\System\QncZzwk.exe
  C:\Windows\System\QncZzwk.exe
  2⤵
  PID:3940
- C:\Windows\System\fTKoaOU.exe
  C:\Windows\System\fTKoaOU.exe
  2⤵
  PID:4708
- C:\Windows\System\nBZzdSK.exe
  C:\Windows\System\nBZzdSK.exe
  2⤵
  PID:3964
- C:\Windows\System\bPvdmFd.exe
  C:\Windows\System\bPvdmFd.exe
  2⤵
  PID:5412
- C:\Windows\System\DAeQjJn.exe
  C:\Windows\System\DAeQjJn.exe
  2⤵
  PID:4816
- C:\Windows\System\iHumhqj.exe
  C:\Windows\System\iHumhqj.exe
  2⤵
  PID:5744
- C:\Windows\System\sqBdeIH.exe
  C:\Windows\System\sqBdeIH.exe
  2⤵
  PID:5236
- C:\Windows\System\RggqrDc.exe
  C:\Windows\System\RggqrDc.exe
  2⤵
  PID:5280
- C:\Windows\System\PCpqgFK.exe
  C:\Windows\System\PCpqgFK.exe
  2⤵
  PID:5840
- C:\Windows\System\wyAAMdC.exe
  C:\Windows\System\wyAAMdC.exe
  2⤵
  PID:5340
- C:\Windows\System\hDsawhy.exe
  C:\Windows\System\hDsawhy.exe
  2⤵
  PID:5392
- C:\Windows\System\XquXcSB.exe
  C:\Windows\System\XquXcSB.exe
  2⤵
  PID:6096
- C:\Windows\System\APDNxuY.exe
  C:\Windows\System\APDNxuY.exe
  2⤵
  PID:6124
- C:\Windows\System\iIPvTAW.exe
  C:\Windows\System\iIPvTAW.exe
  2⤵
  PID:6168
- C:\Windows\System\CxQfibB.exe
  C:\Windows\System\CxQfibB.exe
  2⤵
  PID:6188
- C:\Windows\System\kEbUxhq.exe
  C:\Windows\System\kEbUxhq.exe
  2⤵
  PID:6220
- C:\Windows\System\acWoPBU.exe
  C:\Windows\System\acWoPBU.exe
  2⤵
  PID:6240
- C:\Windows\System\JWWexOa.exe
  C:\Windows\System\JWWexOa.exe
  2⤵
  PID:6268
- C:\Windows\System\tqmaHzP.exe
  C:\Windows\System\tqmaHzP.exe
  2⤵
  PID:6284
- C:\Windows\System\stvxkzw.exe
  C:\Windows\System\stvxkzw.exe
  2⤵
  PID:6308
- C:\Windows\System\rxUKiZd.exe
  C:\Windows\System\rxUKiZd.exe
  2⤵
  PID:6332
- C:\Windows\System\UKJekHl.exe
  C:\Windows\System\UKJekHl.exe
  2⤵
  PID:6352
- C:\Windows\System\BAZPCyQ.exe
  C:\Windows\System\BAZPCyQ.exe
  2⤵
  PID:6372
- C:\Windows\System\LOTRoKm.exe
  C:\Windows\System\LOTRoKm.exe
  2⤵
  PID:6408
- C:\Windows\System\wVqDYtt.exe
  C:\Windows\System\wVqDYtt.exe
  2⤵
  PID:6428
- C:\Windows\System\TrtHUwy.exe
  C:\Windows\System\TrtHUwy.exe
  2⤵
  PID:6448
- C:\Windows\System\kgBqpUS.exe
  C:\Windows\System\kgBqpUS.exe
  2⤵
  PID:6464
- C:\Windows\System\PsqXjxq.exe
  C:\Windows\System\PsqXjxq.exe
  2⤵
  PID:6492
- C:\Windows\System\syDLrLY.exe
  C:\Windows\System\syDLrLY.exe
  2⤵
  PID:6508
- C:\Windows\System\fVyZFMu.exe
  C:\Windows\System\fVyZFMu.exe
  2⤵
  PID:6528
- C:\Windows\System\RmkcgrI.exe
  C:\Windows\System\RmkcgrI.exe
  2⤵
  PID:6548
- C:\Windows\System\HQSKfcp.exe
  C:\Windows\System\HQSKfcp.exe
  2⤵
  PID:6572
- C:\Windows\System\NMHgSMu.exe
  C:\Windows\System\NMHgSMu.exe
  2⤵
  PID:6592
- C:\Windows\System\uwArWvH.exe
  C:\Windows\System\uwArWvH.exe
  2⤵
  PID:6608
- C:\Windows\System\xdInLuq.exe
  C:\Windows\System\xdInLuq.exe
  2⤵
  PID:6624
- C:\Windows\System\rEXrSDf.exe
  C:\Windows\System\rEXrSDf.exe
  2⤵
  PID:6640
- C:\Windows\System\WJSxDgQ.exe
  C:\Windows\System\WJSxDgQ.exe
  2⤵
  PID:6668
- C:\Windows\System\Nuilxdv.exe
  C:\Windows\System\Nuilxdv.exe
  2⤵
  PID:6684
- C:\Windows\System\zzYtJip.exe
  C:\Windows\System\zzYtJip.exe
  2⤵
  PID:6708
- C:\Windows\System\seIIAJQ.exe
  C:\Windows\System\seIIAJQ.exe
  2⤵
  PID:6728
- C:\Windows\System\azuBiUv.exe
  C:\Windows\System\azuBiUv.exe
  2⤵
  PID:6744
- C:\Windows\System\FtjRDAz.exe
  C:\Windows\System\FtjRDAz.exe
  2⤵
  PID:6764
- C:\Windows\System\dlebMHz.exe
  C:\Windows\System\dlebMHz.exe
  2⤵
  PID:6780
- C:\Windows\System\oOxNZbK.exe
  C:\Windows\System\oOxNZbK.exe
  2⤵
  PID:6804
- C:\Windows\System\AvCSZCQ.exe
  C:\Windows\System\AvCSZCQ.exe
  2⤵
  PID:6824
- C:\Windows\System\DzoTKAC.exe
  C:\Windows\System\DzoTKAC.exe
  2⤵
  PID:6840
- C:\Windows\System\yWELzBd.exe
  C:\Windows\System\yWELzBd.exe
  2⤵
  PID:6856
- C:\Windows\System\SsNSGjK.exe
  C:\Windows\System\SsNSGjK.exe
  2⤵
  PID:6884
- C:\Windows\System\YAfzYya.exe
  C:\Windows\System\YAfzYya.exe
  2⤵
  PID:6900
- C:\Windows\System\aaCWgit.exe
  C:\Windows\System\aaCWgit.exe
  2⤵
  PID:6928
- C:\Windows\System\yJOQkce.exe
  C:\Windows\System\yJOQkce.exe
  2⤵
  PID:6944
- C:\Windows\System\NhXahyg.exe
  C:\Windows\System\NhXahyg.exe
  2⤵
  PID:6980
- C:\Windows\System\bsqgWSD.exe
  C:\Windows\System\bsqgWSD.exe
  2⤵
  PID:6996
- C:\Windows\System\qoEsqsu.exe
  C:\Windows\System\qoEsqsu.exe
  2⤵
  PID:7016
- C:\Windows\System\ddhYbDO.exe
  C:\Windows\System\ddhYbDO.exe
  2⤵
  PID:7036
- C:\Windows\System\IRHhjRw.exe
  C:\Windows\System\IRHhjRw.exe
  2⤵
  PID:7056
- C:\Windows\System\QkyVjnE.exe
  C:\Windows\System\QkyVjnE.exe
  2⤵
  PID:7080
- C:\Windows\System\DizpaVA.exe
  C:\Windows\System\DizpaVA.exe
  2⤵
  PID:7108
- C:\Windows\System\LIVUeAE.exe
  C:\Windows\System\LIVUeAE.exe
  2⤵
  PID:7124
- C:\Windows\System\pxhwaGf.exe
  C:\Windows\System\pxhwaGf.exe
  2⤵
  PID:7148
- C:\Windows\System\WeasgCV.exe
  C:\Windows\System\WeasgCV.exe
  2⤵
  PID:7164
- C:\Windows\System\tkuFZEj.exe
  C:\Windows\System\tkuFZEj.exe
  2⤵
  PID:4704
- C:\Windows\System\KYASayu.exe
  C:\Windows\System\KYASayu.exe
  2⤵
  PID:5516
- C:\Windows\System\xXSlpDy.exe
  C:\Windows\System\xXSlpDy.exe
  2⤵
  PID:5560
- C:\Windows\System\yGGTCss.exe
  C:\Windows\System\yGGTCss.exe
  2⤵
  PID:4796
- C:\Windows\System\nDdYZYk.exe
  C:\Windows\System\nDdYZYk.exe
  2⤵
  PID:5828
- C:\Windows\System\xhHWGPD.exe
  C:\Windows\System\xhHWGPD.exe
  2⤵
  PID:732
- C:\Windows\System\wMZBkqy.exe
  C:\Windows\System\wMZBkqy.exe
  2⤵
  PID:5688
- C:\Windows\System\EDzMRjn.exe
  C:\Windows\System\EDzMRjn.exe
  2⤵
  PID:5160
- C:\Windows\System\bawETHU.exe
  C:\Windows\System\bawETHU.exe
  2⤵
  PID:6212
- C:\Windows\System\nxtSTJk.exe
  C:\Windows\System\nxtSTJk.exe
  2⤵
  PID:6304
- C:\Windows\System\BdZdayh.exe
  C:\Windows\System\BdZdayh.exe
  2⤵
  PID:5424
- C:\Windows\System\XmUbjIJ.exe
  C:\Windows\System\XmUbjIJ.exe
  2⤵
  PID:6344
- C:\Windows\System\jGveWfE.exe
  C:\Windows\System\jGveWfE.exe
  2⤵
  PID:1304
- C:\Windows\System\oPXlhzE.exe
  C:\Windows\System\oPXlhzE.exe
  2⤵
  PID:5868
- C:\Windows\System\BaJGipH.exe
  C:\Windows\System\BaJGipH.exe
  2⤵
  PID:5920
- C:\Windows\System\MYkIsCL.exe
  C:\Windows\System\MYkIsCL.exe
  2⤵
  PID:5972
- C:\Windows\System\OpClsPj.exe
  C:\Windows\System\OpClsPj.exe
  2⤵
  PID:6004
- C:\Windows\System\CzbBtqk.exe
  C:\Windows\System\CzbBtqk.exe
  2⤵
  PID:7176
- C:\Windows\System\ZqgiRUt.exe
  C:\Windows\System\ZqgiRUt.exe
  2⤵
  PID:7204
- C:\Windows\System\hyRblWO.exe
  C:\Windows\System\hyRblWO.exe
  2⤵
  PID:7228
- C:\Windows\System\KnVBekf.exe
  C:\Windows\System\KnVBekf.exe
  2⤵
  PID:7248
- C:\Windows\System\TlsepBQ.exe
  C:\Windows\System\TlsepBQ.exe
  2⤵
  PID:7268
- C:\Windows\System\ZxGDdBo.exe
  C:\Windows\System\ZxGDdBo.exe
  2⤵
  PID:7288
- C:\Windows\System\XuACLTI.exe
  C:\Windows\System\XuACLTI.exe
  2⤵
  PID:7308
- C:\Windows\System\UIvnwDz.exe
  C:\Windows\System\UIvnwDz.exe
  2⤵
  PID:7336
- C:\Windows\System\tpJHxTS.exe
  C:\Windows\System\tpJHxTS.exe
  2⤵
  PID:7352
- C:\Windows\System\hvVIudp.exe
  C:\Windows\System\hvVIudp.exe
  2⤵
  PID:7372
- C:\Windows\System\TcyuGnP.exe
  C:\Windows\System\TcyuGnP.exe
  2⤵
  PID:7396
- C:\Windows\System\dffwbUs.exe
  C:\Windows\System\dffwbUs.exe
  2⤵
  PID:7412
- C:\Windows\System\OljQmnw.exe
  C:\Windows\System\OljQmnw.exe
  2⤵
  PID:7436
- C:\Windows\System\sMUYFLA.exe
  C:\Windows\System\sMUYFLA.exe
  2⤵
  PID:7452
- C:\Windows\System\xycDXkb.exe
  C:\Windows\System\xycDXkb.exe
  2⤵
  PID:7472
- C:\Windows\System\PhhIiww.exe
  C:\Windows\System\PhhIiww.exe
  2⤵
  PID:7492
- C:\Windows\System\tgKNTyC.exe
  C:\Windows\System\tgKNTyC.exe
  2⤵
  PID:7516
- C:\Windows\System\LkVYMoo.exe
  C:\Windows\System\LkVYMoo.exe
  2⤵
  PID:7532
- C:\Windows\System\ouxpMoX.exe
  C:\Windows\System\ouxpMoX.exe
  2⤵
  PID:7556
- C:\Windows\System\CEWQqKa.exe
  C:\Windows\System\CEWQqKa.exe
  2⤵
  PID:7572
- C:\Windows\System\Kmsmkik.exe
  C:\Windows\System\Kmsmkik.exe
  2⤵
  PID:7596
- C:\Windows\System\gxPoQtE.exe
  C:\Windows\System\gxPoQtE.exe
  2⤵
  PID:7616
- C:\Windows\System\XJmXnRE.exe
  C:\Windows\System\XJmXnRE.exe
  2⤵
  PID:7636
- C:\Windows\System\szYmlFo.exe
  C:\Windows\System\szYmlFo.exe
  2⤵
  PID:7652
- C:\Windows\System\BCKPDhd.exe
  C:\Windows\System\BCKPDhd.exe
  2⤵
  PID:7676
- C:\Windows\System\zziUDNn.exe
  C:\Windows\System\zziUDNn.exe
  2⤵
  PID:7692
- C:\Windows\System\dzmzCxN.exe
  C:\Windows\System\dzmzCxN.exe
  2⤵
  PID:7712
- C:\Windows\System\SXvHQRi.exe
  C:\Windows\System\SXvHQRi.exe
  2⤵
  PID:7740
- C:\Windows\System\IzscAYi.exe
  C:\Windows\System\IzscAYi.exe
  2⤵
  PID:7760
- C:\Windows\System\wUcnqNB.exe
  C:\Windows\System\wUcnqNB.exe
  2⤵
  PID:7780
- C:\Windows\System\MkdinSd.exe
  C:\Windows\System\MkdinSd.exe
  2⤵
  PID:7804
- C:\Windows\System\WQBFTEG.exe
  C:\Windows\System\WQBFTEG.exe
  2⤵
  PID:7820
- C:\Windows\System\MSHkIMp.exe
  C:\Windows\System\MSHkIMp.exe
  2⤵
  PID:7840
- C:\Windows\System\rsZWkJG.exe
  C:\Windows\System\rsZWkJG.exe
  2⤵
  PID:7860
- C:\Windows\System\hIWkBbZ.exe
  C:\Windows\System\hIWkBbZ.exe
  2⤵
  PID:7876
- C:\Windows\System\vkniFtx.exe
  C:\Windows\System\vkniFtx.exe
  2⤵
  PID:7900
- C:\Windows\System\oEiwmON.exe
  C:\Windows\System\oEiwmON.exe
  2⤵
  PID:7916
- C:\Windows\System\BFtRuqo.exe
  C:\Windows\System\BFtRuqo.exe
  2⤵
  PID:7932
- C:\Windows\System\DOdOGSO.exe
  C:\Windows\System\DOdOGSO.exe
  2⤵
  PID:7948
- C:\Windows\System\KMaLsbU.exe
  C:\Windows\System\KMaLsbU.exe
  2⤵
  PID:7968
- C:\Windows\System\VivAGKP.exe
  C:\Windows\System\VivAGKP.exe
  2⤵
  PID:7988
- C:\Windows\System\WCCkNQJ.exe
  C:\Windows\System\WCCkNQJ.exe
  2⤵
  PID:8004
- C:\Windows\System\KIpVmpF.exe
  C:\Windows\System\KIpVmpF.exe
  2⤵
  PID:8028
- C:\Windows\System\Xcqxwcn.exe
  C:\Windows\System\Xcqxwcn.exe
  2⤵
  PID:8044
- C:\Windows\System\WLycRNu.exe
  C:\Windows\System\WLycRNu.exe
  2⤵
  PID:8064
- C:\Windows\System\pQsAbkC.exe
  C:\Windows\System\pQsAbkC.exe
  2⤵
  PID:8080
- C:\Windows\System\eiQxPYa.exe
  C:\Windows\System\eiQxPYa.exe
  2⤵
  PID:8108
- C:\Windows\System\QUfcnRf.exe
  C:\Windows\System\QUfcnRf.exe
  2⤵
  PID:8124
- C:\Windows\System\oFHywQa.exe
  C:\Windows\System\oFHywQa.exe
  2⤵
  PID:8140
- C:\Windows\System\mAgJPeB.exe
  C:\Windows\System\mAgJPeB.exe
  2⤵
  PID:8160
- C:\Windows\System\TvkXAMr.exe
  C:\Windows\System\TvkXAMr.exe
  2⤵
  PID:8176
- C:\Windows\System\vgkhOKi.exe
  C:\Windows\System\vgkhOKi.exe
  2⤵
  PID:6044
- C:\Windows\System\hVdpnIE.exe
  C:\Windows\System\hVdpnIE.exe
  2⤵
  PID:5260
- C:\Windows\System\dNLPXVr.exe
  C:\Windows\System\dNLPXVr.exe
  2⤵
  PID:6848
- C:\Windows\System\ZVPMHaM.exe
  C:\Windows\System\ZVPMHaM.exe
  2⤵
  PID:6196
- C:\Windows\System\HUtLBqe.exe
  C:\Windows\System\HUtLBqe.exe
  2⤵
  PID:7044
- C:\Windows\System\BqtUZeY.exe
  C:\Windows\System\BqtUZeY.exe
  2⤵
  PID:7028
- C:\Windows\System\iBjdZum.exe
  C:\Windows\System\iBjdZum.exe
  2⤵
  PID:6300
- C:\Windows\System\qPSOrHr.exe
  C:\Windows\System\qPSOrHr.exe
  2⤵
  PID:3748
- C:\Windows\System\tLTLmrN.exe
  C:\Windows\System\tLTLmrN.exe
  2⤵
  PID:4768
- C:\Windows\System\QZhYXSs.exe
  C:\Windows\System\QZhYXSs.exe
  2⤵
  PID:5640
- C:\Windows\System\SWtjuDf.exe
  C:\Windows\System\SWtjuDf.exe
  2⤵
  PID:6364
- C:\Windows\System\HpEcOfS.exe
  C:\Windows\System\HpEcOfS.exe
  2⤵
  PID:4744
- C:\Windows\System\fSMfwLx.exe
  C:\Windows\System\fSMfwLx.exe
  2⤵
  PID:7188
- C:\Windows\System\iLXulNW.exe
  C:\Windows\System\iLXulNW.exe
  2⤵
  PID:8204
- C:\Windows\System\wTEklRN.exe
  C:\Windows\System\wTEklRN.exe
  2⤵
  PID:8224
- C:\Windows\System\YeVzxmf.exe
  C:\Windows\System\YeVzxmf.exe
  2⤵
  PID:8244
- C:\Windows\System\TxQytFO.exe
  C:\Windows\System\TxQytFO.exe
  2⤵
  PID:8264
- C:\Windows\System\IctCuPZ.exe
  C:\Windows\System\IctCuPZ.exe
  2⤵
  PID:8284
- C:\Windows\System\NWzHcGz.exe
  C:\Windows\System\NWzHcGz.exe
  2⤵
  PID:8304
- C:\Windows\System\EdCmRfs.exe
  C:\Windows\System\EdCmRfs.exe
  2⤵
  PID:8432
- C:\Windows\System\NaZcAYS.exe
  C:\Windows\System\NaZcAYS.exe
  2⤵
  PID:8448
- C:\Windows\System\sLJhMcD.exe
  C:\Windows\System\sLJhMcD.exe
  2⤵
  PID:8464
- C:\Windows\System\FUqHEEJ.exe
  C:\Windows\System\FUqHEEJ.exe
  2⤵
  PID:8480
- C:\Windows\System\pADOOnL.exe
  C:\Windows\System\pADOOnL.exe
  2⤵
  PID:8496
- C:\Windows\System\MQSHEnF.exe
  C:\Windows\System\MQSHEnF.exe
  2⤵
  PID:8512
- C:\Windows\System\RiHzvyS.exe
  C:\Windows\System\RiHzvyS.exe
  2⤵
  PID:8532
- C:\Windows\System\yZTENwk.exe
  C:\Windows\System\yZTENwk.exe
  2⤵
  PID:8548
- C:\Windows\System\chUoGay.exe
  C:\Windows\System\chUoGay.exe
  2⤵
  PID:8564
- C:\Windows\System\xknrTGd.exe
  C:\Windows\System\xknrTGd.exe
  2⤵
  PID:8588
- C:\Windows\System\hkFwoTQ.exe
  C:\Windows\System\hkFwoTQ.exe
  2⤵
  PID:8848
- C:\Windows\System\Nrfubpf.exe
  C:\Windows\System\Nrfubpf.exe
  2⤵
  PID:8868
- C:\Windows\System\eWcoMrQ.exe
  C:\Windows\System\eWcoMrQ.exe
  2⤵
  PID:8892
- C:\Windows\System\yCELsVI.exe
  C:\Windows\System\yCELsVI.exe
  2⤵
  PID:8908
- C:\Windows\System\xdTZwAg.exe
  C:\Windows\System\xdTZwAg.exe
  2⤵
  PID:8924
- C:\Windows\System\VvfjcqL.exe
  C:\Windows\System\VvfjcqL.exe
  2⤵
  PID:8940
- C:\Windows\System\iladSuJ.exe
  C:\Windows\System\iladSuJ.exe
  2⤵
  PID:8956
- C:\Windows\System\AyvvxfK.exe
  C:\Windows\System\AyvvxfK.exe
  2⤵
  PID:8972
- C:\Windows\System\LTlOuzh.exe
  C:\Windows\System\LTlOuzh.exe
  2⤵
  PID:8988
- C:\Windows\System\bmWANam.exe
  C:\Windows\System\bmWANam.exe
  2⤵
  PID:9004
- C:\Windows\System\pRcznxu.exe
  C:\Windows\System\pRcznxu.exe
  2⤵
  PID:9020
- C:\Windows\System\erfjnFV.exe
  C:\Windows\System\erfjnFV.exe
  2⤵
  PID:9036
- C:\Windows\System\xzRIDKK.exe
  C:\Windows\System\xzRIDKK.exe
  2⤵
  PID:9052
- C:\Windows\System\XcsHkXT.exe
  C:\Windows\System\XcsHkXT.exe
  2⤵
  PID:9068
- C:\Windows\System\JYmmtvi.exe
  C:\Windows\System\JYmmtvi.exe
  2⤵
  PID:9088
- C:\Windows\System\OfQoypN.exe
  C:\Windows\System\OfQoypN.exe
  2⤵
  PID:9104
- C:\Windows\System\CQTPXio.exe
  C:\Windows\System\CQTPXio.exe
  2⤵
  PID:9120
- C:\Windows\System\fDsuiwn.exe
  C:\Windows\System\fDsuiwn.exe
  2⤵
  PID:9136
- C:\Windows\System\mWKUcXP.exe
  C:\Windows\System\mWKUcXP.exe
  2⤵
  PID:9152
- C:\Windows\System\jjZZhIv.exe
  C:\Windows\System\jjZZhIv.exe
  2⤵
  PID:9180
- C:\Windows\System\TuIQXFw.exe
  C:\Windows\System\TuIQXFw.exe
  2⤵
  PID:9200
- C:\Windows\System\UzzqxlG.exe
  C:\Windows\System\UzzqxlG.exe
  2⤵
  PID:7276
- C:\Windows\System\xbHcdEG.exe
  C:\Windows\System\xbHcdEG.exe
  2⤵
  PID:7360
- C:\Windows\System\wnvGhGw.exe
  C:\Windows\System\wnvGhGw.exe
  2⤵
  PID:6760
- C:\Windows\System\wsmPLwj.exe
  C:\Windows\System\wsmPLwj.exe
  2⤵
  PID:5668
- C:\Windows\System\IrIDKpf.exe
  C:\Windows\System\IrIDKpf.exe
  2⤵
  PID:6792
- C:\Windows\System\JoMifPR.exe
  C:\Windows\System\JoMifPR.exe
  2⤵
  PID:7048
- C:\Windows\System\fsBfDfl.exe
  C:\Windows\System\fsBfDfl.exe
  2⤵
  PID:7144
- C:\Windows\System\ftOlULx.exe
  C:\Windows\System\ftOlULx.exe
  2⤵
  PID:6436
- C:\Windows\System\YnLzZMH.exe
  C:\Windows\System\YnLzZMH.exe
  2⤵
  PID:6480
- C:\Windows\System\fZpaWHX.exe
  C:\Windows\System\fZpaWHX.exe
  2⤵
  PID:6544
- C:\Windows\System\peWHnjD.exe
  C:\Windows\System\peWHnjD.exe
  2⤵
  PID:6600
- C:\Windows\System\ljmUsNg.exe
  C:\Windows\System\ljmUsNg.exe
  2⤵
  PID:6636
- C:\Windows\System\FcOBlVR.exe
  C:\Windows\System\FcOBlVR.exe
  2⤵
  PID:6692
- C:\Windows\System\DyPRfCl.exe
  C:\Windows\System\DyPRfCl.exe
  2⤵
  PID:7368
- C:\Windows\System\TqgtJqH.exe
  C:\Windows\System\TqgtJqH.exe
  2⤵
  PID:6800
- C:\Windows\System\qxZILPV.exe
  C:\Windows\System\qxZILPV.exe
  2⤵
  PID:6908
- C:\Windows\System\ewxIfzC.exe
  C:\Windows\System\ewxIfzC.exe
  2⤵
  PID:6992
- C:\Windows\System\JqCAYOB.exe
  C:\Windows\System\JqCAYOB.exe
  2⤵
  PID:5156
- C:\Windows\System\EVcKrOM.exe
  C:\Windows\System\EVcKrOM.exe
  2⤵
  PID:6260
- C:\Windows\System\TLiElhT.exe
  C:\Windows\System\TLiElhT.exe
  2⤵
  PID:5936
- C:\Windows\System\tslpnck.exe
  C:\Windows\System\tslpnck.exe
  2⤵
  PID:7212
- C:\Windows\System\JVmMlUI.exe
  C:\Windows\System\JVmMlUI.exe
  2⤵
  PID:7460
- C:\Windows\System\MVrGQLx.exe
  C:\Windows\System\MVrGQLx.exe
  2⤵
  PID:7724
- C:\Windows\System\Ojtugvo.exe
  C:\Windows\System\Ojtugvo.exe
  2⤵
  PID:8184
- C:\Windows\System\bwKeLom.exe
  C:\Windows\System\bwKeLom.exe
  2⤵
  PID:4328
- C:\Windows\System\ekzMgVd.exe
  C:\Windows\System\ekzMgVd.exe
  2⤵
  PID:7404
- C:\Windows\System\KBFOrcv.exe
  C:\Windows\System\KBFOrcv.exe
  2⤵
  PID:7464
- C:\Windows\System\aHjYvLi.exe
  C:\Windows\System\aHjYvLi.exe
  2⤵
  PID:7528
- C:\Windows\System\oXmrxTe.exe
  C:\Windows\System\oXmrxTe.exe
  2⤵
  PID:7608
- C:\Windows\System\GuNiSFe.exe
  C:\Windows\System\GuNiSFe.exe
  2⤵
  PID:7664
- C:\Windows\System\PdJqFJU.exe
  C:\Windows\System\PdJqFJU.exe
  2⤵
  PID:7708
- C:\Windows\System\iKxqUbf.exe
  C:\Windows\System\iKxqUbf.exe
  2⤵
  PID:7776
- C:\Windows\System\IYndESp.exe
  C:\Windows\System\IYndESp.exe
  2⤵
  PID:7836
- C:\Windows\System\TUzKaLh.exe
  C:\Windows\System\TUzKaLh.exe
  2⤵
  PID:7908
- C:\Windows\System\nTcRbed.exe
  C:\Windows\System\nTcRbed.exe
  2⤵
  PID:7964
- C:\Windows\System\PJOFCbC.exe
  C:\Windows\System\PJOFCbC.exe
  2⤵
  PID:8036
- C:\Windows\System\fnpCldF.exe
  C:\Windows\System\fnpCldF.exe
  2⤵
  PID:8076
- C:\Windows\System\kZJVfaO.exe
  C:\Windows\System\kZJVfaO.exe
  2⤵
  PID:8148
- C:\Windows\System\CXqxWhs.exe
  C:\Windows\System\CXqxWhs.exe
  2⤵
  PID:6056
- C:\Windows\System\rBumUbN.exe
  C:\Windows\System\rBumUbN.exe
  2⤵
  PID:6208
- C:\Windows\System\SnzdXEf.exe
  C:\Windows\System\SnzdXEf.exe
  2⤵
  PID:3216
- C:\Windows\System\cUmlZNG.exe
  C:\Windows\System\cUmlZNG.exe
  2⤵
  PID:5456
- C:\Windows\System\wefvcBA.exe
  C:\Windows\System\wefvcBA.exe
  2⤵
  PID:7996
- C:\Windows\System\xpJNWkD.exe
  C:\Windows\System\xpJNWkD.exe
  2⤵
  PID:8220
- C:\Windows\System\pRYFjjP.exe
  C:\Windows\System\pRYFjjP.exe
  2⤵
  PID:8260
- C:\Windows\System\BLbpOFL.exe
  C:\Windows\System\BLbpOFL.exe
  2⤵
  PID:9228
- C:\Windows\System\pciEgHt.exe
  C:\Windows\System\pciEgHt.exe
  2⤵
  PID:9256
- C:\Windows\System\RoQAgUQ.exe
  C:\Windows\System\RoQAgUQ.exe
  2⤵
  PID:9276
- C:\Windows\System\FjUlpCS.exe
  C:\Windows\System\FjUlpCS.exe
  2⤵
  PID:9300
- C:\Windows\System\ybDLFBH.exe
  C:\Windows\System\ybDLFBH.exe
  2⤵
  PID:9324
- C:\Windows\System\eRSMAdV.exe
  C:\Windows\System\eRSMAdV.exe
  2⤵
  PID:9344
- C:\Windows\System\lZcYrgn.exe
  C:\Windows\System\lZcYrgn.exe
  2⤵
  PID:9368
- C:\Windows\System\FNhEHkv.exe
  C:\Windows\System\FNhEHkv.exe
  2⤵
  PID:9396
- C:\Windows\System\grFlSke.exe
  C:\Windows\System\grFlSke.exe
  2⤵
  PID:9424
- C:\Windows\System\ejcNjci.exe
  C:\Windows\System\ejcNjci.exe
  2⤵
  PID:9448
- C:\Windows\System\AKNtulq.exe
  C:\Windows\System\AKNtulq.exe
  2⤵
  PID:9472
- C:\Windows\System\FMJqYDA.exe
  C:\Windows\System\FMJqYDA.exe
  2⤵
  PID:9492
- C:\Windows\System\EfKenec.exe
  C:\Windows\System\EfKenec.exe
  2⤵
  PID:9516
- C:\Windows\System\geWCSPq.exe
  C:\Windows\System\geWCSPq.exe
  2⤵
  PID:9532
- C:\Windows\System\rTgJYTV.exe
  C:\Windows\System\rTgJYTV.exe
  2⤵
  PID:9556
- C:\Windows\System\YoxujdU.exe
  C:\Windows\System\YoxujdU.exe
  2⤵
  PID:9580
- C:\Windows\System\GFiiUSU.exe
  C:\Windows\System\GFiiUSU.exe
  2⤵
  PID:9604
- C:\Windows\System\gjExVGw.exe
  C:\Windows\System\gjExVGw.exe
  2⤵
  PID:9624
- C:\Windows\System\cwZAsKA.exe
  C:\Windows\System\cwZAsKA.exe
  2⤵
  PID:9644
- C:\Windows\System\ANPuyTH.exe
  C:\Windows\System\ANPuyTH.exe
  2⤵
  PID:9668
- C:\Windows\System\pkMGwnf.exe
  C:\Windows\System\pkMGwnf.exe
  2⤵
  PID:9692
- C:\Windows\System\PCmlOzL.exe
  C:\Windows\System\PCmlOzL.exe
  2⤵
  PID:9708
- C:\Windows\System\vLCRdNh.exe
  C:\Windows\System\vLCRdNh.exe
  2⤵
  PID:9732
- C:\Windows\System\BGwezOi.exe
  C:\Windows\System\BGwezOi.exe
  2⤵
  PID:9748
- C:\Windows\System\iOwmlEr.exe
  C:\Windows\System\iOwmlEr.exe
  2⤵
  PID:9764
- C:\Windows\System\zNpEgBW.exe
  C:\Windows\System\zNpEgBW.exe
  2⤵
  PID:9780
- C:\Windows\System\Rucyzuc.exe
  C:\Windows\System\Rucyzuc.exe
  2⤵
  PID:9804
- C:\Windows\System\ycLDSoD.exe
  C:\Windows\System\ycLDSoD.exe
  2⤵
  PID:9824
- C:\Windows\System\nvEntKy.exe
  C:\Windows\System\nvEntKy.exe
  2⤵
  PID:9840
- C:\Windows\System\zEkOUCX.exe
  C:\Windows\System\zEkOUCX.exe
  2⤵
  PID:9860
- C:\Windows\System\vyigBFl.exe
  C:\Windows\System\vyigBFl.exe
  2⤵
  PID:9880
- C:\Windows\System\pAmuKit.exe
  C:\Windows\System\pAmuKit.exe
  2⤵
  PID:9896
- C:\Windows\System\zdbtXIK.exe
  C:\Windows\System\zdbtXIK.exe
  2⤵
  PID:9916
- C:\Windows\System\WlFrBBD.exe
  C:\Windows\System\WlFrBBD.exe
  2⤵
  PID:9936
- C:\Windows\System\hPcXfXI.exe
  C:\Windows\System\hPcXfXI.exe
  2⤵
  PID:9952
- C:\Windows\System\SYdfyRX.exe
  C:\Windows\System\SYdfyRX.exe
  2⤵
  PID:9972
- C:\Windows\System\uOPUBHT.exe
  C:\Windows\System\uOPUBHT.exe
  2⤵
  PID:9992
- C:\Windows\System\XtSNgIP.exe
  C:\Windows\System\XtSNgIP.exe
  2⤵
  PID:10008
- C:\Windows\System\VewXvcc.exe
  C:\Windows\System\VewXvcc.exe
  2⤵
  PID:10028
- C:\Windows\System\uSlGZGP.exe
  C:\Windows\System\uSlGZGP.exe
  2⤵
  PID:10048
- C:\Windows\System\IkmzVhv.exe
  C:\Windows\System\IkmzVhv.exe
  2⤵
  PID:10064
- C:\Windows\System\VEEnXxs.exe
  C:\Windows\System\VEEnXxs.exe
  2⤵
  PID:10084
- C:\Windows\System\OYIhMtQ.exe
  C:\Windows\System\OYIhMtQ.exe
  2⤵
  PID:10100
- C:\Windows\System\HQbjlNg.exe
  C:\Windows\System\HQbjlNg.exe
  2⤵
  PID:10120
- C:\Windows\System\ovAwtAO.exe
  C:\Windows\System\ovAwtAO.exe
  2⤵
  PID:10140
- C:\Windows\System\jPwcPPa.exe
  C:\Windows\System\jPwcPPa.exe
  2⤵
  PID:10160
- C:\Windows\System\tZQVSPx.exe
  C:\Windows\System\tZQVSPx.exe
  2⤵
  PID:10176
- C:\Windows\System\GOGtkaj.exe
  C:\Windows\System\GOGtkaj.exe
  2⤵
  PID:10196
- C:\Windows\System\oIGDBQc.exe
  C:\Windows\System\oIGDBQc.exe
  2⤵
  PID:10216
- C:\Windows\System\vNKzXZd.exe
  C:\Windows\System\vNKzXZd.exe
  2⤵
  PID:10232
- C:\Windows\System\ZDoyQQF.exe
  C:\Windows\System\ZDoyQQF.exe
  2⤵
  PID:10256
- C:\Windows\System\nfFJdat.exe
  C:\Windows\System\nfFJdat.exe
  2⤵
  PID:10276
- C:\Windows\System\QizTbES.exe
  C:\Windows\System\QizTbES.exe
  2⤵
  PID:10292
- C:\Windows\System\XHjKSqd.exe
  C:\Windows\System\XHjKSqd.exe
  2⤵
  PID:10312
- C:\Windows\System\uxUfhew.exe
  C:\Windows\System\uxUfhew.exe
  2⤵
  PID:10332
- C:\Windows\System\KujyCzq.exe
  C:\Windows\System\KujyCzq.exe
  2⤵
  PID:10348
- C:\Windows\System\BsfayZI.exe
  C:\Windows\System\BsfayZI.exe
  2⤵
  PID:10368
- C:\Windows\System\suKclHS.exe
  C:\Windows\System\suKclHS.exe
  2⤵
  PID:10388
- C:\Windows\System\OEgZlZp.exe
  C:\Windows\System\OEgZlZp.exe
  2⤵
  PID:10404
- C:\Windows\System\vLnRyjI.exe
  C:\Windows\System\vLnRyjI.exe
  2⤵
  PID:10428
- C:\Windows\System\ihDOfqu.exe
  C:\Windows\System\ihDOfqu.exe
  2⤵
  PID:10452
- C:\Windows\System\VbSuMMi.exe
  C:\Windows\System\VbSuMMi.exe
  2⤵
  PID:10468
- C:\Windows\System\IWZASDW.exe
  C:\Windows\System\IWZASDW.exe
  2⤵
  PID:10488
- C:\Windows\System\OebbWnL.exe
  C:\Windows\System\OebbWnL.exe
  2⤵
  PID:10508
- C:\Windows\System\CojRqvN.exe
  C:\Windows\System\CojRqvN.exe
  2⤵
  PID:10528
- C:\Windows\System\ssRrRIs.exe
  C:\Windows\System\ssRrRIs.exe
  2⤵
  PID:10544
- C:\Windows\System\jGkIMso.exe
  C:\Windows\System\jGkIMso.exe
  2⤵
  PID:10796
- C:\Windows\System\BXqVwxT.exe
  C:\Windows\System\BXqVwxT.exe
  2⤵
  PID:10816
- C:\Windows\System\UZoRggZ.exe
  C:\Windows\System\UZoRggZ.exe
  2⤵
  PID:10832
- C:\Windows\System\SDjZbxE.exe
  C:\Windows\System\SDjZbxE.exe
  2⤵
  PID:10852
- C:\Windows\System\nxoTVxj.exe
  C:\Windows\System\nxoTVxj.exe
  2⤵
  PID:10868
- C:\Windows\System\FaGNFDw.exe
  C:\Windows\System\FaGNFDw.exe
  2⤵
  PID:10884
- C:\Windows\System\qHghqHl.exe
  C:\Windows\System\qHghqHl.exe
  2⤵
  PID:10900
- C:\Windows\System\yBVpNLq.exe
  C:\Windows\System\yBVpNLq.exe
  2⤵
  PID:10916
- C:\Windows\System\QsDqspj.exe
  C:\Windows\System\QsDqspj.exe
  2⤵
  PID:10932
- C:\Windows\System\cWOeOvj.exe
  C:\Windows\System\cWOeOvj.exe
  2⤵
  PID:10948
- C:\Windows\System\cVkCgeS.exe
  C:\Windows\System\cVkCgeS.exe
  2⤵
  PID:10964
- C:\Windows\System\UIrUtuL.exe
  C:\Windows\System\UIrUtuL.exe
  2⤵
  PID:10980
- C:\Windows\System\QrRBeQO.exe
  C:\Windows\System\QrRBeQO.exe
  2⤵
  PID:11000
- C:\Windows\System\mNxPMOl.exe
  C:\Windows\System\mNxPMOl.exe
  2⤵
  PID:11016
- C:\Windows\System\uFsGasn.exe
  C:\Windows\System\uFsGasn.exe
  2⤵
  PID:11036
- C:\Windows\System\ncrccaM.exe
  C:\Windows\System\ncrccaM.exe
  2⤵
  PID:11056
- C:\Windows\System\KoRQxXd.exe
  C:\Windows\System\KoRQxXd.exe
  2⤵
  PID:11076
- C:\Windows\System\zZinJYn.exe
  C:\Windows\System\zZinJYn.exe
  2⤵
  PID:11092
- C:\Windows\System\qvfQOPc.exe
  C:\Windows\System\qvfQOPc.exe
  2⤵
  PID:11108
- C:\Windows\System\EHgonxc.exe
  C:\Windows\System\EHgonxc.exe
  2⤵
  PID:11128
- C:\Windows\System\xsCkJRb.exe
  C:\Windows\System\xsCkJRb.exe
  2⤵
  PID:11144
- C:\Windows\System\nBcFEhl.exe
  C:\Windows\System\nBcFEhl.exe
  2⤵
  PID:11160
- C:\Windows\System\UxdssAw.exe
  C:\Windows\System\UxdssAw.exe
  2⤵
  PID:11176
- C:\Windows\System\TDprGuZ.exe
  C:\Windows\System\TDprGuZ.exe
  2⤵
  PID:11224
- C:\Windows\System\NXNDqnU.exe
  C:\Windows\System\NXNDqnU.exe
  2⤵
  PID:11244
- C:\Windows\System\kuXqIym.exe
  C:\Windows\System\kuXqIym.exe
  2⤵
  PID:11260
- C:\Windows\System\PQKkbDM.exe
  C:\Windows\System\PQKkbDM.exe
  2⤵
  PID:8920
- C:\Windows\System\jtMqUnt.exe
  C:\Windows\System\jtMqUnt.exe
  2⤵
  PID:11268
- C:\Windows\System\UWSCbYt.exe
  C:\Windows\System\UWSCbYt.exe
  2⤵
  PID:11292
- C:\Windows\System\TikCbcm.exe
  C:\Windows\System\TikCbcm.exe
  2⤵
  PID:11312
- C:\Windows\System\TpDIBBJ.exe
  C:\Windows\System\TpDIBBJ.exe
  2⤵
  PID:11336
- C:\Windows\System\MdHszAW.exe
  C:\Windows\System\MdHszAW.exe
  2⤵
  PID:11356
- C:\Windows\System\CoVmHIS.exe
  C:\Windows\System\CoVmHIS.exe
  2⤵
  PID:11372
- C:\Windows\System\yxYMBCM.exe
  C:\Windows\System\yxYMBCM.exe
  2⤵
  PID:11388
- C:\Windows\System\tpeBtxi.exe
  C:\Windows\System\tpeBtxi.exe
  2⤵
  PID:11420
- C:\Windows\System\TJqVRif.exe
  C:\Windows\System\TJqVRif.exe
  2⤵
  PID:11440
- C:\Windows\System\eeCEeOs.exe
  C:\Windows\System\eeCEeOs.exe
  2⤵
  PID:11472
- C:\Windows\System\FTMSPiy.exe
  C:\Windows\System\FTMSPiy.exe
  2⤵
  PID:11500
- C:\Windows\System\ugvQKtE.exe
  C:\Windows\System\ugvQKtE.exe
  2⤵
  PID:11524
- C:\Windows\System\rIOOIvt.exe
  C:\Windows\System\rIOOIvt.exe
  2⤵
  PID:11560
- C:\Windows\System\vctklLh.exe
  C:\Windows\System\vctklLh.exe
  2⤵
  PID:11588
- C:\Windows\System\LUkOKEI.exe
  C:\Windows\System\LUkOKEI.exe
  2⤵
  PID:11616
- C:\Windows\System\nhowWQG.exe
  C:\Windows\System\nhowWQG.exe
  2⤵
  PID:11652
- C:\Windows\System\dtSDSPN.exe
  C:\Windows\System\dtSDSPN.exe
  2⤵
  PID:11672
- C:\Windows\System\IvmsUYT.exe
  C:\Windows\System\IvmsUYT.exe
  2⤵
  PID:11704
- C:\Windows\System\JVmkniN.exe
  C:\Windows\System\JVmkniN.exe
  2⤵
  PID:11748
- C:\Windows\System\eKfGCNd.exe
  C:\Windows\System\eKfGCNd.exe
  2⤵
  PID:11788
- C:\Windows\System\rnbbmHI.exe
  C:\Windows\System\rnbbmHI.exe
  2⤵
  PID:11804
- C:\Windows\System\KPVHNKU.exe
  C:\Windows\System\KPVHNKU.exe
  2⤵
  PID:11828
- C:\Windows\System\ibvLdIc.exe
  C:\Windows\System\ibvLdIc.exe
  2⤵
  PID:11844
- C:\Windows\System\abafvfz.exe
  C:\Windows\System\abafvfz.exe
  2⤵
  PID:11872
- C:\Windows\System\hmEPFWW.exe
  C:\Windows\System\hmEPFWW.exe
  2⤵
  PID:11888
- C:\Windows\System\UOnXtXF.exe
  C:\Windows\System\UOnXtXF.exe
  2⤵
  PID:11908
- C:\Windows\System\jUHRmyH.exe
  C:\Windows\System\jUHRmyH.exe
  2⤵
  PID:11924
- C:\Windows\System\bbWZDDQ.exe
  C:\Windows\System\bbWZDDQ.exe
  2⤵
  PID:11948
- C:\Windows\System\JbvCDPn.exe
  C:\Windows\System\JbvCDPn.exe
  2⤵
  PID:11972
- C:\Windows\System\iOcktQC.exe
  C:\Windows\System\iOcktQC.exe
  2⤵
  PID:11996
- C:\Windows\System\zzcbLFQ.exe
  C:\Windows\System\zzcbLFQ.exe
  2⤵
  PID:12016
- C:\Windows\System\ieKPxLP.exe
  C:\Windows\System\ieKPxLP.exe
  2⤵
  PID:12052
- C:\Windows\System\YQAiYhu.exe
  C:\Windows\System\YQAiYhu.exe
  2⤵
  PID:12072
- C:\Windows\System\vZWuYGP.exe
  C:\Windows\System\vZWuYGP.exe
  2⤵
  PID:12096
- C:\Windows\System\BaFSlDJ.exe
  C:\Windows\System\BaFSlDJ.exe
  2⤵
  PID:12120
- C:\Windows\System\kHYKPjt.exe
  C:\Windows\System\kHYKPjt.exe
  2⤵
  PID:12144
- C:\Windows\System\PhZwote.exe
  C:\Windows\System\PhZwote.exe
  2⤵
  PID:12160
- C:\Windows\System\CzvvDtW.exe
  C:\Windows\System\CzvvDtW.exe
  2⤵
  PID:12180
- C:\Windows\System\lQQvZTa.exe
  C:\Windows\System\lQQvZTa.exe
  2⤵
  PID:12200
- C:\Windows\System\IyfoqdI.exe
  C:\Windows\System\IyfoqdI.exe
  2⤵
  PID:12220
- C:\Windows\System\HEvPVmQ.exe
  C:\Windows\System\HEvPVmQ.exe
  2⤵
  PID:12236
- C:\Windows\System\cFdBBcq.exe
  C:\Windows\System\cFdBBcq.exe
  2⤵
  PID:12256
- C:\Windows\System\KfydGvd.exe
  C:\Windows\System\KfydGvd.exe
  2⤵
  PID:12272
- C:\Windows\System\dIfEcYV.exe
  C:\Windows\System\dIfEcYV.exe
  2⤵
  PID:6872
- C:\Windows\System\RgbLZMs.exe
  C:\Windows\System\RgbLZMs.exe
  2⤵
  PID:6756
- C:\Windows\System\WiwQajY.exe
  C:\Windows\System\WiwQajY.exe
  2⤵
  PID:5460
- C:\Windows\System\xJwcBqo.exe
  C:\Windows\System\xJwcBqo.exe
  2⤵
  PID:7264
- C:\Windows\System\GvdeVSm.exe
  C:\Windows\System\GvdeVSm.exe
  2⤵
  PID:6340
- C:\Windows\System\dFOzAqR.exe
  C:\Windows\System\dFOzAqR.exe
  2⤵
  PID:9352
- C:\Windows\System\lQjzKLk.exe
  C:\Windows\System\lQjzKLk.exe
  2⤵
  PID:9464
- C:\Windows\System\uxEnhVA.exe
  C:\Windows\System\uxEnhVA.exe
  2⤵
  PID:9596
- C:\Windows\System\FTZIpJd.exe
  C:\Windows\System\FTZIpJd.exe
  2⤵
  PID:9724
- C:\Windows\System\XeXpguj.exe
  C:\Windows\System\XeXpguj.exe
  2⤵
  PID:9988
- C:\Windows\System\uYHxxue.exe
  C:\Windows\System\uYHxxue.exe
  2⤵
  PID:12304
- C:\Windows\System\lJDChUJ.exe
  C:\Windows\System\lJDChUJ.exe
  2⤵
  PID:12324
- C:\Windows\System\tuoDgka.exe
  C:\Windows\System\tuoDgka.exe
  2⤵
  PID:12344
- C:\Windows\System\PAsDIwR.exe
  C:\Windows\System\PAsDIwR.exe
  2⤵
  PID:12360
- C:\Windows\System\fRqxOAf.exe
  C:\Windows\System\fRqxOAf.exe
  2⤵
  PID:12376
- C:\Windows\System\myZRUEc.exe
  C:\Windows\System\myZRUEc.exe
  2⤵
  PID:12392
- C:\Windows\System\RxmYqMU.exe
  C:\Windows\System\RxmYqMU.exe
  2⤵
  PID:12408
- C:\Windows\System\CCnLGCP.exe
  C:\Windows\System\CCnLGCP.exe
  2⤵
  PID:12428
- C:\Windows\System\WyEYIgl.exe
  C:\Windows\System\WyEYIgl.exe
  2⤵
  PID:12448
- C:\Windows\System\ClJrncv.exe
  C:\Windows\System\ClJrncv.exe
  2⤵
  PID:12464
- C:\Windows\System\SQzJFpk.exe
  C:\Windows\System\SQzJFpk.exe
  2⤵
  PID:12484
- C:\Windows\System\VQDuzQT.exe
  C:\Windows\System\VQDuzQT.exe
  2⤵
  PID:12500
- C:\Windows\System\pcXiwaI.exe
  C:\Windows\System\pcXiwaI.exe
  2⤵
  PID:12516
- C:\Windows\System\TQezLzD.exe
  C:\Windows\System\TQezLzD.exe
  2⤵
  PID:12532
- C:\Windows\System\yfcgxNa.exe
  C:\Windows\System\yfcgxNa.exe
  2⤵
  PID:12548
- C:\Windows\System\zTBKnCr.exe
  C:\Windows\System\zTBKnCr.exe
  2⤵
  PID:12564
- C:\Windows\System\gBtaqSu.exe
  C:\Windows\System\gBtaqSu.exe
  2⤵
  PID:12580
- C:\Windows\System\mfhvLma.exe
  C:\Windows\System\mfhvLma.exe
  2⤵
  PID:12596
- C:\Windows\System\VzthVZp.exe
  C:\Windows\System\VzthVZp.exe
  2⤵
  PID:12612
- C:\Windows\System\FTJYRBv.exe
  C:\Windows\System\FTJYRBv.exe
  2⤵
  PID:12632
- C:\Windows\System\PXRzTTv.exe
  C:\Windows\System\PXRzTTv.exe
  2⤵
  PID:12648
- C:\Windows\System\RLtCcfe.exe
  C:\Windows\System\RLtCcfe.exe
  2⤵
  PID:12664
- C:\Windows\System\tWIEtcQ.exe
  C:\Windows\System\tWIEtcQ.exe
  2⤵
  PID:12680
- C:\Windows\System\IhZoXMk.exe
  C:\Windows\System\IhZoXMk.exe
  2⤵
  PID:12696
- C:\Windows\System\eLRUlfH.exe
  C:\Windows\System\eLRUlfH.exe
  2⤵
  PID:12716
- C:\Windows\System\PJvgQyD.exe
  C:\Windows\System\PJvgQyD.exe
  2⤵
  PID:12732
- C:\Windows\System\MSeIzZM.exe
  C:\Windows\System\MSeIzZM.exe
  2⤵
  PID:12808
- C:\Windows\System\lpzVUQF.exe
  C:\Windows\System\lpzVUQF.exe
  2⤵
  PID:12828
- C:\Windows\System\HjgdyXL.exe
  C:\Windows\System\HjgdyXL.exe
  2⤵
  PID:12844
- C:\Windows\System\yesGdTE.exe
  C:\Windows\System\yesGdTE.exe
  2⤵
  PID:12860
- C:\Windows\System\TiiPISY.exe
  C:\Windows\System\TiiPISY.exe
  2⤵
  PID:12876
- C:\Windows\System\iZqxrxp.exe
  C:\Windows\System\iZqxrxp.exe
  2⤵
  PID:12892
- C:\Windows\System\JGQLBac.exe
  C:\Windows\System\JGQLBac.exe
  2⤵
  PID:12908
- C:\Windows\System\IomUKqF.exe
  C:\Windows\System\IomUKqF.exe
  2⤵
  PID:12924
- C:\Windows\System\aLTEzbG.exe
  C:\Windows\System\aLTEzbG.exe
  2⤵
  PID:12940
- C:\Windows\System\cRQhzIY.exe
  C:\Windows\System\cRQhzIY.exe
  2⤵
  PID:12956
- C:\Windows\System\ewuWcwE.exe
  C:\Windows\System\ewuWcwE.exe
  2⤵
  PID:12972
- C:\Windows\System\tOWEOex.exe
  C:\Windows\System\tOWEOex.exe
  2⤵
  PID:12988
- C:\Windows\System\zAZiFoP.exe
  C:\Windows\System\zAZiFoP.exe
  2⤵
  PID:13012
- C:\Windows\System\OktOOza.exe
  C:\Windows\System\OktOOza.exe
  2⤵
  PID:13036
- C:\Windows\System\IrqHJEL.exe
  C:\Windows\System\IrqHJEL.exe
  2⤵
  PID:13060
- C:\Windows\System\SppDxSz.exe
  C:\Windows\System\SppDxSz.exe
  2⤵
  PID:13080
- C:\Windows\System\DWBNfyp.exe
  C:\Windows\System\DWBNfyp.exe
  2⤵
  PID:13096
- C:\Windows\System\FnUpPXS.exe
  C:\Windows\System\FnUpPXS.exe
  2⤵
  PID:13112
- C:\Windows\System\hBHJjsT.exe
  C:\Windows\System\hBHJjsT.exe
  2⤵
  PID:13128
- C:\Windows\System\xBKBnZO.exe
  C:\Windows\System\xBKBnZO.exe
  2⤵
  PID:13144
- C:\Windows\System\xfhaRTQ.exe
  C:\Windows\System\xfhaRTQ.exe
  2⤵
  PID:13168
- C:\Windows\System\FfxMkoq.exe
  C:\Windows\System\FfxMkoq.exe
  2⤵
  PID:13188
- C:\Windows\System\MrkqKUA.exe
  C:\Windows\System\MrkqKUA.exe
  2⤵
  PID:13208
- C:\Windows\System\MLHHblQ.exe
  C:\Windows\System\MLHHblQ.exe
  2⤵
  PID:13228
- C:\Windows\System\pOkaIzU.exe
  C:\Windows\System\pOkaIzU.exe
  2⤵
  PID:13244
- C:\Windows\System\yIZAIoQ.exe
  C:\Windows\System\yIZAIoQ.exe
  2⤵
  PID:13260
- C:\Windows\System\ECKFjbk.exe
  C:\Windows\System\ECKFjbk.exe
  2⤵
  PID:13276
- C:\Windows\System\VLhSLhf.exe
  C:\Windows\System\VLhSLhf.exe
  2⤵
  PID:13292
- C:\Windows\System\GOuUEVx.exe
  C:\Windows\System\GOuUEVx.exe
  2⤵
  PID:10016
- C:\Windows\System\kUWUKgJ.exe
  C:\Windows\System\kUWUKgJ.exe
  2⤵
  PID:10080
- C:\Windows\System\yjvZkxf.exe
  C:\Windows\System\yjvZkxf.exe
  2⤵
  PID:10224
- C:\Windows\System\nNjViEI.exe
  C:\Windows\System\nNjViEI.exe
  2⤵
  PID:10268
- C:\Windows\System\yzNXJEh.exe
  C:\Windows\System\yzNXJEh.exe
  2⤵
  PID:8932
- C:\Windows\System\fNoKabP.exe
  C:\Windows\System\fNoKabP.exe
  2⤵
  PID:8968
- C:\Windows\System\iztXomK.exe
  C:\Windows\System\iztXomK.exe
  2⤵
  PID:11352
- C:\Windows\System\AgNQpJj.exe
  C:\Windows\System\AgNQpJj.exe
  2⤵
  PID:11408
- C:\Windows\System\MNQIKBS.exe
  C:\Windows\System\MNQIKBS.exe
  2⤵
  PID:11432
- C:\Windows\System\ONLomyI.exe
  C:\Windows\System\ONLomyI.exe
  2⤵
  PID:6620
- C:\Windows\System\XPMNZGE.exe
  C:\Windows\System\XPMNZGE.exe
  2⤵
  PID:9364
- C:\Windows\System\ADQATzO.exe
  C:\Windows\System\ADQATzO.exe
  2⤵
  PID:9564
- C:\Windows\System\KjdFeTR.exe
  C:\Windows\System\KjdFeTR.exe
  2⤵
  PID:5960
- C:\Windows\System\TIXPQVK.exe
  C:\Windows\System\TIXPQVK.exe
  2⤵
  PID:9272
- C:\Windows\System\wgcVxyp.exe
  C:\Windows\System\wgcVxyp.exe
  2⤵
  PID:10076
- C:\Windows\System\kvWoYRh.exe
  C:\Windows\System\kvWoYRh.exe
  2⤵
  PID:12388
- C:\Windows\System\CbkelqC.exe
  C:\Windows\System\CbkelqC.exe
  2⤵
  PID:10356
- C:\Windows\System\hyBCAKY.exe
  C:\Windows\System\hyBCAKY.exe
  2⤵
  PID:8420
- C:\Windows\System\VIGiRrq.exe
  C:\Windows\System\VIGiRrq.exe
  2⤵
  PID:8460
- C:\Windows\System\Hqmqstz.exe
  C:\Windows\System\Hqmqstz.exe
  2⤵
  PID:8504
- C:\Windows\System\uvfyKlU.exe
  C:\Windows\System\uvfyKlU.exe
  2⤵
  PID:8556
- C:\Windows\System\YDJFjzB.exe
  C:\Windows\System\YDJFjzB.exe
  2⤵
  PID:8604
- C:\Windows\System\xetVeMV.exe
  C:\Windows\System\xetVeMV.exe
  2⤵
  PID:8824
- C:\Windows\System\opykTDC.exe
  C:\Windows\System\opykTDC.exe
  2⤵
  PID:5264
- C:\Windows\System\hFfOQDr.exe
  C:\Windows\System\hFfOQDr.exe
  2⤵
  PID:9188
- C:\Windows\System\UkVQdnU.exe
  C:\Windows\System\UkVQdnU.exe
  2⤵
  PID:9944
- C:\Windows\System\nPtPyBe.exe
  C:\Windows\System\nPtPyBe.exe
  2⤵
  PID:2692
- C:\Windows\System\szfeeNI.exe
  C:\Windows\System\szfeeNI.exe
  2⤵
  PID:6420
- C:\Windows\System\GgIWEjT.exe
  C:\Windows\System\GgIWEjT.exe
  2⤵
  PID:3928
- C:\Windows\System\KZorhId.exe
  C:\Windows\System\KZorhId.exe
  2⤵
  PID:13220
- C:\Windows\System\DytquzI.exe
  C:\Windows\System\DytquzI.exe
  2⤵
  PID:5724
- C:\Windows\System\YwtanuP.exe
  C:\Windows\System\YwtanuP.exe
  2⤵
  PID:6988
- C:\Windows\System\xcIgSPJ.exe
  C:\Windows\System\xcIgSPJ.exe
  2⤵
  PID:12208
- C:\Windows\System\YaiytIy.exe
  C:\Windows\System\YaiytIy.exe
  2⤵
  PID:8856
- C:\Windows\System\fAAxVcL.exe
  C:\Windows\System\fAAxVcL.exe
  2⤵
  PID:8984
- C:\Windows\System\KGYsUoF.exe
  C:\Windows\System\KGYsUoF.exe
  2⤵
  PID:5364
- C:\Windows\System\lVnWEPc.exe
  C:\Windows\System\lVnWEPc.exe
  2⤵
  PID:8600
- C:\Windows\System\kpwseJi.exe
  C:\Windows\System\kpwseJi.exe
  2⤵
  PID:8488
- C:\Windows\System\kXhxLew.exe
  C:\Windows\System\kXhxLew.exe
  2⤵
  PID:10552
- C:\Windows\System\WjJJqrc.exe
  C:\Windows\System\WjJJqrc.exe
  2⤵
  PID:12592
- C:\Windows\System\fAKjEKz.exe
  C:\Windows\System\fAKjEKz.exe
  2⤵
  PID:9592
- C:\Windows\System\BgbDTiT.exe
  C:\Windows\System\BgbDTiT.exe
  2⤵
  PID:9616
- C:\Windows\System\hydYCtg.exe
  C:\Windows\System\hydYCtg.exe
  2⤵
  PID:9336
- C:\Windows\System\eEQxodf.exe
  C:\Windows\System\eEQxodf.exe
  2⤵
  PID:7156
- C:\Windows\System\tNylCgw.exe
  C:\Windows\System\tNylCgw.exe
  2⤵
  PID:5016
- C:\Windows\System\umQjwMB.exe
  C:\Windows\System\umQjwMB.exe
  2⤵
  PID:12624
- C:\Windows\System\RHkchOp.exe
  C:\Windows\System\RHkchOp.exe
  2⤵
  PID:10328
- C:\Windows\System\XpDmzec.exe
  C:\Windows\System\XpDmzec.exe
  2⤵
  PID:10436
- C:\Windows\System\ARWIIXN.exe
  C:\Windows\System\ARWIIXN.exe
  2⤵
  PID:10780
- C:\Windows\System\rTWlUCh.exe
  C:\Windows\System\rTWlUCh.exe
  2⤵
  PID:11064
- C:\Windows\System\rZpDODK.exe
  C:\Windows\System\rZpDODK.exe
  2⤵
  PID:12264
- C:\Windows\System\hmlRqDy.exe
  C:\Windows\System\hmlRqDy.exe
  2⤵
  PID:10272
- C:\Windows\System\EWgMYye.exe
  C:\Windows\System\EWgMYye.exe
  2⤵
  PID:9716
- C:\Windows\System\FQOyKKn.exe
  C:\Windows\System\FQOyKKn.exe
  2⤵
  PID:3104
- C:\Windows\System\ERBSGzD.exe
  C:\Windows\System\ERBSGzD.exe
  2⤵
  PID:5756
- C:\Windows\System\tcCvCry.exe
  C:\Windows\System\tcCvCry.exe
  2⤵
  PID:2812
- C:\Windows\System\wERjKqQ.exe
  C:\Windows\System\wERjKqQ.exe
  2⤵
  PID:12300
- C:\Windows\System\icKimwN.exe
  C:\Windows\System\icKimwN.exe
  2⤵
  PID:13044
- C:\Windows\System\BPkxGuJ.exe
  C:\Windows\System\BPkxGuJ.exe
  2⤵
  PID:12572
- C:\Windows\System\CcRZPJy.exe
  C:\Windows\System\CcRZPJy.exe
  2⤵
  PID:9028
- C:\Windows\System\BbdSrFy.exe
  C:\Windows\System\BbdSrFy.exe
  2⤵
  PID:9144
- C:\Windows\System\pSEnWEw.exe
  C:\Windows\System\pSEnWEw.exe
  2⤵
  PID:5368
- C:\Windows\System\rZBpGTy.exe
  C:\Windows\System\rZBpGTy.exe
  2⤵
  PID:9196
- C:\Windows\System\btfMOyn.exe
  C:\Windows\System\btfMOyn.exe
  2⤵
  PID:8524
- C:\Windows\System\jMeoNDC.exe
  C:\Windows\System\jMeoNDC.exe
  2⤵
  PID:10168
- C:\Windows\System\IyWVNki.exe
  C:\Windows\System\IyWVNki.exe
  2⤵
  PID:9760
- C:\Windows\System\OYMkUeK.exe
  C:\Windows\System\OYMkUeK.exe
  2⤵
  PID:9728
- C:\Windows\System\VBiDnRT.exe
  C:\Windows\System\VBiDnRT.exe
  2⤵
  PID:9320
- C:\Windows\System\evjKNuE.exe
  C:\Windows\System\evjKNuE.exe
  2⤵
  PID:4152
- C:\Windows\System\WYZVciD.exe
  C:\Windows\System\WYZVciD.exe
  2⤵
  PID:12460
- C:\Windows\System\KCweeNB.exe
  C:\Windows\System\KCweeNB.exe
  2⤵
  PID:12496
- C:\Windows\System\bXMiWsM.exe
  C:\Windows\System\bXMiWsM.exe
  2⤵
  PID:6516
- C:\Windows\System\aoFJQUi.exe
  C:\Windows\System\aoFJQUi.exe
  2⤵
  PID:2228
- C:\Windows\System\cacrCnq.exe
  C:\Windows\System\cacrCnq.exe
  2⤵
  PID:12704
- C:\Windows\System\EAqEooC.exe
  C:\Windows\System\EAqEooC.exe
  2⤵
  PID:11384
- C:\Windows\System\QuPhApF.exe
  C:\Windows\System\QuPhApF.exe
  2⤵
  PID:4692
- C:\Windows\System\RxHYmzR.exe
  C:\Windows\System\RxHYmzR.exe
  2⤵
  PID:12764
- C:\Windows\System\eXUmqAV.exe
  C:\Windows\System\eXUmqAV.exe
  2⤵
  PID:12984
- C:\Windows\System\SImvSUx.exe
  C:\Windows\System\SImvSUx.exe
  2⤵
  PID:12556
- C:\Windows\System\JmbUVQz.exe
  C:\Windows\System\JmbUVQz.exe
  2⤵
  PID:13088
- C:\Windows\System\ZwpsxaW.exe
  C:\Windows\System\ZwpsxaW.exe
  2⤵
  PID:8964
- C:\Windows\System\dzljCVC.exe
  C:\Windows\System\dzljCVC.exe
  2⤵
  PID:11100
- C:\Windows\System\BXsuNSv.exe
  C:\Windows\System\BXsuNSv.exe
  2⤵
  PID:10384
- C:\Windows\System\ePCiWPo.exe
  C:\Windows\System\ePCiWPo.exe
  2⤵
  PID:10928
- C:\Windows\System\ZIzDUwJ.exe
  C:\Windows\System\ZIzDUwJ.exe
  2⤵
  PID:4616
- C:\Windows\System\UhoWHHq.exe
  C:\Windows\System\UhoWHHq.exe
  2⤵
  PID:8016
- C:\Windows\System\vduqQmr.exe
  C:\Windows\System\vduqQmr.exe
  2⤵
  PID:11992
- C:\Windows\System\mqAdtLh.exe
  C:\Windows\System\mqAdtLh.exe
  2⤵
  PID:11520
- C:\Windows\System\BIPMdSC.exe
  C:\Windows\System\BIPMdSC.exe
  2⤵
  PID:6896
- C:\Windows\System\AQpUHmD.exe
  C:\Windows\System\AQpUHmD.exe
  2⤵
  PID:10988
- C:\Windows\System\AmcyncW.exe
  C:\Windows\System\AmcyncW.exe
  2⤵
  PID:10524
- C:\Windows\System\nwvktVW.exe
  C:\Windows\System\nwvktVW.exe
  2⤵
  PID:12904
- C:\Windows\System\BRolnWK.exe
  C:\Windows\System\BRolnWK.exe
  2⤵
  PID:12340
- C:\Windows\System\vTLEXBy.exe
  C:\Windows\System\vTLEXBy.exe
  2⤵
  PID:8540
- C:\Windows\System\RGjibXv.exe
  C:\Windows\System\RGjibXv.exe
  2⤵
  PID:10092
- C:\Windows\System\QBnBRfc.exe
  C:\Windows\System\QBnBRfc.exe
  2⤵
  PID:12604
- C:\Windows\System\fVmVyna.exe
  C:\Windows\System\fVmVyna.exe
  2⤵
  PID:4240
- C:\Windows\System\yOUWIfo.exe
  C:\Windows\System\yOUWIfo.exe
  2⤵
  PID:12712
- C:\Windows\System\yvUZYAE.exe
  C:\Windows\System\yvUZYAE.exe
  2⤵
  PID:9312
- C:\Windows\System\DoZeJtx.exe
  C:\Windows\System\DoZeJtx.exe
  2⤵
  PID:12424
- C:\Windows\System\KBkrxLD.exe
  C:\Windows\System\KBkrxLD.exe
  2⤵
  PID:13492
- C:\Windows\System\smblkPs.exe
  C:\Windows\System\smblkPs.exe
  2⤵
  PID:13508
- C:\Windows\System\EiBDVPV.exe
  C:\Windows\System\EiBDVPV.exe
  2⤵
  PID:13536
- C:\Windows\System\iKRyRem.exe
  C:\Windows\System\iKRyRem.exe
  2⤵
  PID:13556
- C:\Windows\System\vWZlDYz.exe
  C:\Windows\System\vWZlDYz.exe
  2⤵
  PID:13632
- C:\Windows\System\hXNlhjB.exe
  C:\Windows\System\hXNlhjB.exe
  2⤵
  PID:13656
- C:\Windows\System\pesRIvp.exe
  C:\Windows\System\pesRIvp.exe
  2⤵
  PID:13676
- C:\Windows\System\ozafGKS.exe
  C:\Windows\System\ozafGKS.exe
  2⤵
  PID:13724
- C:\Windows\System\XfTJLge.exe
  C:\Windows\System\XfTJLge.exe
  2⤵
  PID:13740
- C:\Windows\System\xPJKXdZ.exe
  C:\Windows\System\xPJKXdZ.exe
  2⤵
  PID:13760
- C:\Windows\System\mKAmcQB.exe
  C:\Windows\System\mKAmcQB.exe
  2⤵
  PID:13792
- C:\Windows\System\zvJRDLP.exe
  C:\Windows\System\zvJRDLP.exe
  2⤵
  PID:13812
- C:\Windows\System\WuLOpCl.exe
  C:\Windows\System\WuLOpCl.exe
  2⤵
  PID:13832
- C:\Windows\System\twzxroN.exe
  C:\Windows\System\twzxroN.exe
  2⤵
  PID:13956
- C:\Windows\System\rnAqiZr.exe
  C:\Windows\System\rnAqiZr.exe
  2⤵
  PID:13992
- C:\Windows\System\oDosHsA.exe
  C:\Windows\System\oDosHsA.exe
  2⤵
  PID:14020
- C:\Windows\System\qSLpUJq.exe
  C:\Windows\System\qSLpUJq.exe
  2⤵
  PID:14040
- C:\Windows\System\oaofyIT.exe
  C:\Windows\System\oaofyIT.exe
  2⤵
  PID:14056
- C:\Windows\System\bxZNwzV.exe
  C:\Windows\System\bxZNwzV.exe
  2⤵
  PID:14076
- C:\Windows\System\CcXAYws.exe
  C:\Windows\System\CcXAYws.exe
  2⤵
  PID:14096
- C:\Windows\System\ugNAgvY.exe
  C:\Windows\System\ugNAgvY.exe
  2⤵
  PID:14116
- C:\Windows\System\cNNWkFd.exe
  C:\Windows\System\cNNWkFd.exe
  2⤵
  PID:14132
- C:\Windows\System\rqEqfCJ.exe
  C:\Windows\System\rqEqfCJ.exe
  2⤵
  PID:14152
- C:\Windows\System\LgmJWnx.exe
  C:\Windows\System\LgmJWnx.exe
  2⤵
  PID:14176
- C:\Windows\System\chaYSLg.exe
  C:\Windows\System\chaYSLg.exe
  2⤵
  PID:14200
- C:\Windows\System\koaYDpw.exe
  C:\Windows\System\koaYDpw.exe
  2⤵
  PID:14220
- C:\Windows\System\CYaBOwP.exe
  C:\Windows\System\CYaBOwP.exe
  2⤵
  PID:14240
- C:\Windows\System\mvVNkRp.exe
  C:\Windows\System\mvVNkRp.exe
  2⤵
  PID:11608
- C:\Windows\System\wJGbbqw.exe
  C:\Windows\System\wJGbbqw.exe
  2⤵
  PID:13388
- C:\Windows\System\FaKBaFJ.exe
  C:\Windows\System\FaKBaFJ.exe
  2⤵
  PID:13336
- C:\Windows\System\sdOcCFE.exe
  C:\Windows\System\sdOcCFE.exe
  2⤵
  PID:13372
- C:\Windows\System\DDBbCQT.exe
  C:\Windows\System\DDBbCQT.exe
  2⤵
  PID:13456
- C:\Windows\System\MvEnZKK.exe
  C:\Windows\System\MvEnZKK.exe
  2⤵
  PID:7580
- C:\Windows\System\juuBKwR.exe
  C:\Windows\System\juuBKwR.exe
  2⤵
  PID:13436
- C:\Windows\System\RauCiLk.exe
  C:\Windows\System\RauCiLk.exe
  2⤵
  PID:2580
- C:\Windows\System\gfGSmLv.exe
  C:\Windows\System\gfGSmLv.exe
  2⤵
  PID:13652
- C:\Windows\System\PeXNIrt.exe
  C:\Windows\System\PeXNIrt.exe
  2⤵
  PID:13548
- C:\Windows\System\aZgzquh.exe
  C:\Windows\System\aZgzquh.exe
  2⤵
  PID:13808
- C:\Windows\System\QSePfXj.exe
  C:\Windows\System\QSePfXj.exe
  2⤵
  PID:4996
- C:\Windows\System\JyccxQj.exe
  C:\Windows\System\JyccxQj.exe
  2⤵
  PID:13984
- C:\Windows\System\ttikEwW.exe
  C:\Windows\System\ttikEwW.exe
  2⤵
  PID:3624
- C:\Windows\System\TBPykND.exe
  C:\Windows\System\TBPykND.exe
  2⤵
  PID:3636
- C:\Windows\System\VetzUHS.exe
  C:\Windows\System\VetzUHS.exe
  2⤵
  PID:7388
- C:\Windows\System\yLKOzrD.exe
  C:\Windows\System\yLKOzrD.exe
  2⤵
  PID:3976
- C:\Windows\System\zUXtJkx.exe
  C:\Windows\System\zUXtJkx.exe
  2⤵
  PID:13460
- C:\Windows\System\QencQTq.exe
  C:\Windows\System\QencQTq.exe
  2⤵
  PID:13484
- C:\Windows\System\OaWCDAH.exe
  C:\Windows\System\OaWCDAH.exe
  2⤵
  PID:13624
- C:\Windows\System\fqfnbRo.exe
  C:\Windows\System\fqfnbRo.exe
  2⤵
  PID:4860
- C:\Windows\System\uSXelsq.exe
  C:\Windows\System\uSXelsq.exe
  2⤵
  PID:13720
- C:\Windows\System\uiNhknP.exe
  C:\Windows\System\uiNhknP.exe
  2⤵
  PID:13384
- C:\Windows\System\YPAzNjF.exe
  C:\Windows\System\YPAzNjF.exe
  2⤵
  PID:7828
- C:\Windows\System\cYOjKwQ.exe
  C:\Windows\System\cYOjKwQ.exe
  2⤵
  PID:14320
- C:\Windows\System\MhqLgyy.exe
  C:\Windows\System\MhqLgyy.exe
  2⤵
  PID:9772
- C:\Windows\System\vebuJrj.exe
  C:\Windows\System\vebuJrj.exe
  2⤵
  PID:3408
- C:\Windows\System\npdcnkZ.exe
  C:\Windows\System\npdcnkZ.exe
  2⤵
  PID:3376
- C:\Windows\System\QfjuWhl.exe
  C:\Windows\System\QfjuWhl.exe
  2⤵
  PID:3364
- C:\Windows\System\beEdfya.exe
  C:\Windows\System\beEdfya.exe
  2⤵
  PID:4368
- C:\Windows\System\vRVdtJR.exe
  C:\Windows\System\vRVdtJR.exe
  2⤵
  PID:316
- C:\Windows\System\VIDwIAN.exe
  C:\Windows\System\VIDwIAN.exe
  2⤵
  PID:13472
- C:\Windows\System\brCBAos.exe
  C:\Windows\System\brCBAos.exe
  2⤵
  PID:1276
- C:\Windows\System\GfoRtnM.exe
  C:\Windows\System\GfoRtnM.exe
  2⤵
  PID:13716
- C:\Windows\System\elYSSiQ.exe
  C:\Windows\System\elYSSiQ.exe
  2⤵
  PID:396
- C:\Windows\System\osiFEQN.exe
  C:\Windows\System\osiFEQN.exe
  2⤵
  PID:2640
- C:\Windows\System\DkAyuMe.exe
  C:\Windows\System\DkAyuMe.exe
  2⤵
  PID:9548
- C:\Windows\System\LwVkufY.exe
  C:\Windows\System\LwVkufY.exe
  2⤵
  PID:8404
- C:\Windows\System\anjpBpE.exe
  C:\Windows\System\anjpBpE.exe
  2⤵
  PID:13980
- C:\Windows\System\zeisDJU.exe
  C:\Windows\System\zeisDJU.exe
  2⤵
  PID:1328
- C:\Windows\System\TXyDoxK.exe
  C:\Windows\System\TXyDoxK.exe
  2⤵
  PID:4832
- C:\Windows\System\npncXPd.exe
  C:\Windows\System\npncXPd.exe
  2⤵
  PID:13640
- C:\Windows\System\bhzJfJL.exe
  C:\Windows\System\bhzJfJL.exe
  2⤵
  PID:13820
- C:\Windows\System\DltaTFU.exe
  C:\Windows\System\DltaTFU.exe
  2⤵
  PID:2992
- C:\Windows\System\hfKYYfe.exe
  C:\Windows\System\hfKYYfe.exe
  2⤵
  PID:13804
- C:\Windows\System\aQawZRv.exe
  C:\Windows\System\aQawZRv.exe
  2⤵
  PID:2060
- C:\Windows\System\mVXknvr.exe
  C:\Windows\System\mVXknvr.exe
  2⤵
  PID:13352
- C:\Windows\System\ThalsLi.exe
  C:\Windows\System\ThalsLi.exe
  2⤵
  PID:2764
- C:\Windows\System\bakqbxi.exe
  C:\Windows\System\bakqbxi.exe
  2⤵
  PID:13320
- C:\Windows\System\ZqffFuy.exe
  C:\Windows\System\ZqffFuy.exe
  2⤵
  PID:13524
- C:\Windows\System\qlvISOq.exe
  C:\Windows\System\qlvISOq.exe
  2⤵
  PID:14232
- C:\Windows\System\pqXtJFj.exe
  C:\Windows\System\pqXtJFj.exe
  2⤵
  PID:10864
- C:\Windows\System\zrsEUkq.exe
  C:\Windows\System\zrsEUkq.exe
  2⤵
  PID:8400
- C:\Windows\System\pnIQByL.exe
  C:\Windows\System\pnIQByL.exe
  2⤵
  PID:2248
- C:\Windows\System\TopJGSf.exe
  C:\Windows\System\TopJGSf.exe
  2⤵
  PID:3048
- C:\Windows\System\sNEqgND.exe
  C:\Windows\System\sNEqgND.exe
  2⤵
  PID:2624
- C:\Windows\System\yDnJIFK.exe
  C:\Windows\System\yDnJIFK.exe
  2⤵
  PID:13360
- C:\Windows\System\eXKrpHq.exe
  C:\Windows\System\eXKrpHq.exe
  2⤵
  PID:12852
- C:\Windows\System\fTUknBF.exe
  C:\Windows\System\fTUknBF.exe
  2⤵
  PID:14084
- C:\Windows\System\wDzkroN.exe
  C:\Windows\System\wDzkroN.exe
  2⤵
  PID:3260
- C:\Windows\System\JvgHXZn.exe
  C:\Windows\System\JvgHXZn.exe
  2⤵
  PID:7660
- C:\Windows\System\nZxHIbp.exe
  C:\Windows\System\nZxHIbp.exe
  2⤵
  PID:4408
- C:\Windows\System\ihkrzwF.exe
  C:\Windows\System\ihkrzwF.exe
  2⤵
  PID:4608
- C:\Windows\System\byOrBmd.exe
  C:\Windows\System\byOrBmd.exe
  2⤵
  PID:14000
- C:\Windows\System\EvPDSJI.exe
  C:\Windows\System\EvPDSJI.exe
  2⤵
  PID:468
- C:\Windows\System\fRsLfPf.exe
  C:\Windows\System\fRsLfPf.exe
  2⤵
  PID:4360
- C:\Windows\System\ORcZJgu.exe
  C:\Windows\System\ORcZJgu.exe
  2⤵
  PID:3492
- C:\Windows\System\nkGfSDL.exe
  C:\Windows\System\nkGfSDL.exe
  2⤵
  PID:14172
- C:\Windows\System\MEDLJqV.exe
  C:\Windows\System\MEDLJqV.exe
  2⤵
  PID:8880
- C:\Windows\System\guInlTu.exe
  C:\Windows\System\guInlTu.exe
  2⤵
  PID:2492
- C:\Windows\System\UbVIOGv.exe
  C:\Windows\System\UbVIOGv.exe
  2⤵
  PID:12836
- C:\Windows\System\eFwjICp.exe
  C:\Windows\System\eFwjICp.exe
  2⤵
  PID:2416
- C:\Windows\System\xcpSzjs.exe
  C:\Windows\System\xcpSzjs.exe
  2⤵
  PID:13504
- C:\Windows\System\olwQxgz.exe
  C:\Windows\System\olwQxgz.exe
  2⤵
  PID:1852
- C:\Windows\System\jbMjAHX.exe
  C:\Windows\System\jbMjAHX.exe
  2⤵
  PID:656
- C:\Windows\System\xkxrOfB.exe
  C:\Windows\System\xkxrOfB.exe
  2⤵
  PID:14008
- C:\Windows\System\nkJfFpr.exe
  C:\Windows\System\nkJfFpr.exe
  2⤵
  PID:4256
- C:\Windows\System\tJjXLjU.exe
  C:\Windows\System\tJjXLjU.exe
  2⤵
  PID:4732
- C:\Windows\System\nhzwijy.exe
  C:\Windows\System\nhzwijy.exe
  2⤵
  PID:5268
- C:\Windows\System\kobEltS.exe
  C:\Windows\System\kobEltS.exe
  2⤵
  PID:3496
- C:\Windows\System\nhutqwl.exe
  C:\Windows\System\nhutqwl.exe
  2⤵
  PID:8408
- C:\Windows\System\JgWumwS.exe
  C:\Windows\System\JgWumwS.exe
  2⤵
  PID:692
- C:\Windows\System\ggllNVa.exe
  C:\Windows\System\ggllNVa.exe
  2⤵
  PID:2364
- C:\Windows\System\rwvODWV.exe
  C:\Windows\System\rwvODWV.exe
  2⤵
  PID:5820
- C:\Windows\System\arngwNB.exe
  C:\Windows\System\arngwNB.exe
  2⤵
  PID:5464
- C:\Windows\System\xWHlJsR.exe
  C:\Windows\System\xWHlJsR.exe
  2⤵
  PID:5648
- C:\Windows\System\CdMUNgM.exe
  C:\Windows\System\CdMUNgM.exe
  2⤵
  PID:12640
- C:\Windows\System\lAOMulS.exe
  C:\Windows\System\lAOMulS.exe
  2⤵
  PID:2072
- C:\Windows\System\IjySVKF.exe
  C:\Windows\System\IjySVKF.exe
  2⤵
  PID:6388
- C:\Windows\System\QwCQDRs.exe
  C:\Windows\System\QwCQDRs.exe
  2⤵
  PID:13972
- C:\Windows\System\kbSviIE.exe
  C:\Windows\System\kbSviIE.exe
  2⤵
  PID:1788
- C:\Windows\System\jwCrtLT.exe
  C:\Windows\System\jwCrtLT.exe
  2⤵
  PID:6132
- C:\Windows\System\RNloSJg.exe
  C:\Windows\System\RNloSJg.exe
  2⤵
  PID:4916
- C:\Windows\System\cAJpczQ.exe
  C:\Windows\System\cAJpczQ.exe
  2⤵
  PID:2400
- C:\Windows\System\KohAPdY.exe
  C:\Windows\System\KohAPdY.exe
  2⤵
  PID:6476
- C:\Windows\System\KrBkylI.exe
  C:\Windows\System\KrBkylI.exe
  2⤵
  PID:7392
- C:\Windows\System\KtVayiR.exe
  C:\Windows\System\KtVayiR.exe
  2⤵
  PID:5444
- C:\Windows\System\oyyKAiH.exe
  C:\Windows\System\oyyKAiH.exe
  2⤵
  PID:5712
- C:\Windows\System\vZmXEzt.exe
  C:\Windows\System\vZmXEzt.exe
  2⤵
  PID:5896
- C:\Windows\System\qMVDsia.exe
  C:\Windows\System\qMVDsia.exe
  2⤵
  PID:12404
- C:\Windows\System\mIVzeWA.exe
  C:\Windows\System\mIVzeWA.exe
  2⤵
  PID:7552
- C:\Windows\System\UTnaKsM.exe
  C:\Windows\System\UTnaKsM.exe
  2⤵
  PID:4588
- C:\Windows\System\jHEMPHO.exe
  C:\Windows\System\jHEMPHO.exe
  2⤵
  PID:5604
- C:\Windows\System\fHdXFbL.exe
  C:\Windows\System\fHdXFbL.exe
  2⤵
  PID:8340
- C:\Windows\System\DLtODwH.exe
  C:\Windows\System\DLtODwH.exe
  2⤵
  PID:5952
- C:\Windows\System\MqwFpvu.exe
  C:\Windows\System\MqwFpvu.exe
  2⤵
  PID:8388
- C:\Windows\System\ngZbSYA.exe
  C:\Windows\System\ngZbSYA.exe
  2⤵
  PID:4892
- C:\Windows\System\TrfxqPj.exe
  C:\Windows\System\TrfxqPj.exe
  2⤵
  PID:2648
- C:\Windows\System\nNjWiCL.exe
  C:\Windows\System\nNjWiCL.exe
  2⤵
  PID:13932
- C:\Windows\System\nnKJqnW.exe
  C:\Windows\System\nnKJqnW.exe
  2⤵
  PID:748
- C:\Windows\System\eMRMXhf.exe
  C:\Windows\System\eMRMXhf.exe
  2⤵
  PID:10572
- C:\Windows\System\dStQzhH.exe
  C:\Windows\System\dStQzhH.exe
  2⤵
  PID:4512
- C:\Windows\System\DATFxMl.exe
  C:\Windows\System\DATFxMl.exe
  2⤵
  PID:8716
- C:\Windows\System\VsAXjnR.exe
  C:\Windows\System\VsAXjnR.exe
  2⤵
  PID:4500
- C:\Windows\System\RCLERMB.exe
  C:\Windows\System\RCLERMB.exe
  2⤵
  PID:11196
- C:\Windows\System\fdyDMTr.exe
  C:\Windows\System\fdyDMTr.exe
  2⤵
  PID:11240
- C:\Windows\System\TLkLOeL.exe
  C:\Windows\System\TLkLOeL.exe
  2⤵
  PID:11460
- C:\Windows\System\bmfYnSJ.exe
  C:\Windows\System\bmfYnSJ.exe
  2⤵
  PID:11492
- C:\Windows\System\NIGrVMa.exe
  C:\Windows\System\NIGrVMa.exe
  2⤵
  PID:11532
- C:\Windows\System\LpYShiJ.exe
  C:\Windows\System\LpYShiJ.exe
  2⤵
  PID:3792
- C:\Windows\System\AeqyIRY.exe
  C:\Windows\System\AeqyIRY.exe
  2⤵
  PID:11624
- C:\Windows\System\rquUSLU.exe
  C:\Windows\System\rquUSLU.exe
  2⤵
  PID:6968
- C:\Windows\System\uwCpqXM.exe
  C:\Windows\System\uwCpqXM.exe
  2⤵
  PID:11980
- C:\Windows\System\OebkYTI.exe
  C:\Windows\System\OebkYTI.exe
  2⤵
  PID:8296
- C:\Windows\System\qPICVgO.exe
  C:\Windows\System\qPICVgO.exe
  2⤵
  PID:7024
- C:\Windows\System\DWDbSBb.exe
  C:\Windows\System\DWDbSBb.exe
  2⤵
  PID:5432
- C:\Windows\System\zGDbMbq.exe
  C:\Windows\System\zGDbMbq.exe
  2⤵
  PID:13616
- C:\Windows\System\JjqVICc.exe
  C:\Windows\System\JjqVICc.exe
  2⤵
  PID:3740
- C:\Windows\System\MjfgeGq.exe
  C:\Windows\System\MjfgeGq.exe
  2⤵
  PID:5892
- C:\Windows\System\sFBBPqj.exe
  C:\Windows\System\sFBBPqj.exe
  2⤵
  PID:9508
- C:\Windows\System\KMVKVFz.exe
  C:\Windows\System\KMVKVFz.exe
  2⤵
  PID:12108
- C:\Windows\System\WmiMolz.exe
  C:\Windows\System\WmiMolz.exe
  2⤵
  PID:8748
- C:\Windows\System\vNDudpu.exe
  C:\Windows\System\vNDudpu.exe
  2⤵
  PID:4444
- C:\Windows\System\WYpGGsu.exe
  C:\Windows\System\WYpGGsu.exe
  2⤵
  PID:7480
- C:\Windows\System\dAFpBam.exe
  C:\Windows\System\dAFpBam.exe
  2⤵
  PID:8324
- C:\Windows\System\boLKNMu.exe
  C:\Windows\System\boLKNMu.exe
  2⤵
  PID:10584
- C:\Windows\System\pfivaUr.exe
  C:\Windows\System\pfivaUr.exe
  2⤵
  PID:12756
- C:\Windows\System\UFGRihf.exe
  C:\Windows\System\UFGRihf.exe
  2⤵
  PID:7792
- C:\Windows\System\XQUOlnz.exe
  C:\Windows\System\XQUOlnz.exe
  2⤵
  PID:8708
- C:\Windows\System\hzuXvnv.exe
  C:\Windows\System\hzuXvnv.exe
  2⤵
  PID:14124
- C:\Windows\System\rYtrBVQ.exe
  C:\Windows\System\rYtrBVQ.exe
  2⤵
  PID:11348
- C:\Windows\System\tiGjsoa.exe
  C:\Windows\System\tiGjsoa.exe
  2⤵
  PID:11456
- C:\Windows\System\czrNLVh.exe
  C:\Windows\System\czrNLVh.exe
  2⤵
  PID:5336
- C:\Windows\System\pxTuHJd.exe
  C:\Windows\System\pxTuHJd.exe
  2⤵
  PID:7104
- C:\Windows\System\LCOHCBo.exe
  C:\Windows\System\LCOHCBo.exe
  2⤵
  PID:12824
- C:\Windows\System\SgUAqpn.exe
  C:\Windows\System\SgUAqpn.exe
  2⤵
  PID:9172
- C:\Windows\System\VzIauMd.exe
  C:\Windows\System\VzIauMd.exe
  2⤵
  PID:3368
- C:\Windows\System\WnYlJbv.exe
  C:\Windows\System\WnYlJbv.exe
  2⤵
  PID:12004
- C:\Windows\System\MKnyUJD.exe
  C:\Windows\System\MKnyUJD.exe
  2⤵
  PID:11400
- C:\Windows\System\ygIieoT.exe
  C:\Windows\System\ygIieoT.exe
  2⤵
  PID:9720
- C:\Windows\System\CCbuHes.exe
  C:\Windows\System\CCbuHes.exe
  2⤵
  PID:7428
- C:\Windows\System\tPVplGH.exe
  C:\Windows\System\tPVplGH.exe
  2⤵
  PID:7524
- C:\Windows\System\qIpOIAL.exe
  C:\Windows\System\qIpOIAL.exe
  2⤵
  PID:7192
- C:\Windows\System\VpuSuVE.exe
  C:\Windows\System\VpuSuVE.exe
  2⤵
  PID:13252
- C:\Windows\System\jbJdkZo.exe
  C:\Windows\System\jbJdkZo.exe
  2⤵
  PID:4072
- C:\Windows\System\WvDPthZ.exe
  C:\Windows\System\WvDPthZ.exe
  2⤵
  PID:11468
- C:\Windows\System\dJyoyzf.exe
  C:\Windows\System\dJyoyzf.exe
  2⤵
  PID:13544
- C:\Windows\System\UfFkmJR.exe
  C:\Windows\System\UfFkmJR.exe
  2⤵
  PID:13272
- C:\Windows\System\VxcsiVL.exe
  C:\Windows\System\VxcsiVL.exe
  2⤵
  PID:6940
- C:\Windows\System\YLIiKRe.exe
  C:\Windows\System\YLIiKRe.exe
  2⤵
  PID:10000
- C:\Windows\System\LGcvwFX.exe
  C:\Windows\System\LGcvwFX.exe
  2⤵
  PID:5900
- C:\Windows\System\PvMWrUc.exe
  C:\Windows\System\PvMWrUc.exe
  2⤵
  PID:11572
- C:\Windows\System\WRYSExA.exe
  C:\Windows\System\WRYSExA.exe
  2⤵
  PID:5296
- C:\Windows\System\nCpUVIv.exe
  C:\Windows\System\nCpUVIv.exe
  2⤵
  PID:7872
- C:\Windows\System\BURaAtp.exe
  C:\Windows\System\BURaAtp.exe
  2⤵
  PID:7500
- C:\Windows\System\DtPqdWs.exe
  C:\Windows\System\DtPqdWs.exe
  2⤵
  PID:11764
- C:\Windows\System\rqiDHSf.exe
  C:\Windows\System\rqiDHSf.exe
  2⤵
  PID:7136
- C:\Windows\System\LilYBOa.exe
  C:\Windows\System\LilYBOa.exe
  2⤵
  PID:12748
- C:\Windows\System\jgEqtQt.exe
  C:\Windows\System\jgEqtQt.exe
  2⤵
  PID:2464
- C:\Windows\System\cstuAon.exe
  C:\Windows\System\cstuAon.exe
  2⤵
  PID:7800
- C:\Windows\System\PkbVhsv.exe
  C:\Windows\System\PkbVhsv.exe
  2⤵
  PID:11776
- C:\Windows\System\KwKLIeg.exe
  C:\Windows\System\KwKLIeg.exe
  2⤵
  PID:12248
- C:\Windows\System\prorlRO.exe
  C:\Windows\System\prorlRO.exe
  2⤵
  PID:12740
- C:\Windows\System\CauXjYP.exe
  C:\Windows\System\CauXjYP.exe
  2⤵
  PID:9800
- C:\Windows\System\tapleYn.exe
  C:\Windows\System\tapleYn.exe
  2⤵
  PID:9572
- C:\Windows\System\nlRBKmK.exe
  C:\Windows\System\nlRBKmK.exe
  2⤵
  PID:12060
- C:\Windows\System\gicgIih.exe
  C:\Windows\System\gicgIih.exe
  2⤵
  PID:9652
- C:\Windows\System\BxnGLmc.exe
  C:\Windows\System\BxnGLmc.exe
  2⤵
  PID:12084
- C:\Windows\System\UWiCNxa.exe
  C:\Windows\System\UWiCNxa.exe
  2⤵
  PID:9660
- C:\Windows\System\LUeONZu.exe
  C:\Windows\System\LUeONZu.exe
  2⤵
  PID:13108
- C:\Windows\System\NNotUrB.exe
  C:\Windows\System\NNotUrB.exe
  2⤵
  PID:8692
- C:\Windows\System\ihQZaTb.exe
  C:\Windows\System\ihQZaTb.exe
  2⤵
  PID:7832
- C:\Windows\System\ZbszryI.exe
  C:\Windows\System\ZbszryI.exe
  2⤵
  PID:12320
- C:\Windows\System\liHAPSA.exe
  C:\Windows\System\liHAPSA.exe
  2⤵
  PID:8760
- C:\Windows\System\ZhvNHJE.exe
  C:\Windows\System\ZhvNHJE.exe
  2⤵
  PID:5772
- C:\Windows\System\QtheOOX.exe
  C:\Windows\System\QtheOOX.exe
  2⤵
  PID:8320
- C:\Windows\System\dvonocE.exe
  C:\Windows\System\dvonocE.exe
  2⤵
  PID:9292
- C:\Windows\System\EmeTxZW.exe
  C:\Windows\System\EmeTxZW.exe
  2⤵
  PID:9820
- C:\Windows\System\xATDRxH.exe
  C:\Windows\System\xATDRxH.exe
  2⤵
  PID:3912
- C:\Windows\System\jHWgkqW.exe
  C:\Windows\System\jHWgkqW.exe
  2⤵
  PID:8744
- C:\Windows\System\zzmjFYC.exe
  C:\Windows\System\zzmjFYC.exe
  2⤵
  PID:10648
- C:\Windows\System\crcLlKa.exe
  C:\Windows\System\crcLlKa.exe
  2⤵
  PID:8680
- C:\Windows\System\esmOOCZ.exe
  C:\Windows\System\esmOOCZ.exe
  2⤵
  PID:8612
- C:\Windows\System\JUnluWK.exe
  C:\Windows\System\JUnluWK.exe
  2⤵
  PID:11812
- C:\Windows\System\DaEGUhk.exe
  C:\Windows\System\DaEGUhk.exe
  2⤵
  PID:8996
- C:\Windows\System\kwhfOhh.exe
  C:\Windows\System\kwhfOhh.exe
  2⤵
  PID:9792
- C:\Windows\System\mIRsdVD.exe
  C:\Windows\System\mIRsdVD.exe
  2⤵
  PID:11512
- C:\Windows\System\HyUePCX.exe
  C:\Windows\System\HyUePCX.exe
  2⤵
  PID:10264
- C:\Windows\System\lxUfkgq.exe
  C:\Windows\System\lxUfkgq.exe
  2⤵
  PID:13224
- C:\Windows\System\SkjMEaD.exe
  C:\Windows\System\SkjMEaD.exe
  2⤵
  PID:6252
- C:\Windows\System\hrTOxMc.exe
  C:\Windows\System\hrTOxMc.exe
  2⤵
  PID:12284
- C:\Windows\System\ozRiWZc.exe
  C:\Windows\System\ozRiWZc.exe
  2⤵
  PID:9796
- C:\Windows\System\focMCby.exe
  C:\Windows\System\focMCby.exe
  2⤵
  PID:13240
- C:\Windows\System\UejhlRL.exe
  C:\Windows\System\UejhlRL.exe
  2⤵
  PID:8292
- C:\Windows\System\LvjtwiV.exe
  C:\Windows\System\LvjtwiV.exe
  2⤵
  PID:2212
- C:\Windows\System\vXIlibu.exe
  C:\Windows\System\vXIlibu.exe
  2⤵
  PID:12372
- C:\Windows\System\AdbaUqK.exe
  C:\Windows\System\AdbaUqK.exe
  2⤵
  PID:11084
- C:\Windows\System\bvCWAyH.exe
  C:\Windows\System\bvCWAyH.exe
  2⤵
  PID:3516
- C:\Windows\System\VMzPOEA.exe
  C:\Windows\System\VMzPOEA.exe
  2⤵
  PID:11580
- C:\Windows\System\AiERmro.exe
  C:\Windows\System\AiERmro.exe
  2⤵
  PID:9176
- C:\Windows\System\iEsttzo.exe
  C:\Windows\System\iEsttzo.exe
  2⤵
  PID:6232
- C:\Windows\System\XiAYgqG.exe
  C:\Windows\System\XiAYgqG.exe
  2⤵
  PID:9440
- C:\Windows\System\WTCbTaU.exe
  C:\Windows\System\WTCbTaU.exe
  2⤵
  PID:7728
- C:\Windows\System\mXdfciW.exe
  C:\Windows\System\mXdfciW.exe
  2⤵
  PID:10728
- C:\Windows\System\FLjIWDA.exe
  C:\Windows\System\FLjIWDA.exe
  2⤵
  PID:8672
- C:\Windows\System\aJVUzQP.exe
  C:\Windows\System\aJVUzQP.exe
  2⤵
  PID:10624
- C:\Windows\System\dZPTtMp.exe
  C:\Windows\System\dZPTtMp.exe
  2⤵
  PID:10616
- C:\Windows\System\yPwvQkr.exe
  C:\Windows\System\yPwvQkr.exe
  2⤵
  PID:8520
- C:\Windows\System\CNGSXqs.exe
  C:\Windows\System\CNGSXqs.exe
  2⤵
  PID:4576
- C:\Windows\System\PlMlaaa.exe
  C:\Windows\System\PlMlaaa.exe
  2⤵
  PID:12400
- C:\Windows\System\NPWeGui.exe
  C:\Windows\System\NPWeGui.exe
  2⤵
  PID:12788
- C:\Windows\System\XCtUwhD.exe
  C:\Windows\System\XCtUwhD.exe
  2⤵
  PID:12012
- C:\Windows\System\SDiJtPf.exe
  C:\Windows\System\SDiJtPf.exe
  2⤵
  PID:9160
- C:\Windows\System\TKBnsJL.exe
  C:\Windows\System\TKBnsJL.exe
  2⤵
  PID:11428
- C:\Windows\System\rHoOLmj.exe
  C:\Windows\System\rHoOLmj.exe
  2⤵
  PID:680
- C:\Windows\System\HPbodts.exe
  C:\Windows\System\HPbodts.exe
  2⤵
  PID:7348
- C:\Windows\System\NrzruMD.exe
  C:\Windows\System\NrzruMD.exe
  2⤵
  PID:11896
- C:\Windows\System\uEfrVRe.exe
  C:\Windows\System\uEfrVRe.exe
  2⤵
  PID:11484
- C:\Windows\System\pCpIEcp.exe
  C:\Windows\System\pCpIEcp.exe
  2⤵
  PID:8012
- C:\Windows\System\triWFSX.exe
  C:\Windows\System\triWFSX.exe
  2⤵
  PID:6540
- C:\Windows\System\vdTMmLO.exe
  C:\Windows\System\vdTMmLO.exe
  2⤵
  PID:6536
- C:\Windows\System\EwSfrWp.exe
  C:\Windows\System\EwSfrWp.exe
  2⤵
  PID:11636
- C:\Windows\System\aSfjVLw.exe
  C:\Windows\System\aSfjVLw.exe
  2⤵
  PID:10912
- C:\Windows\System\FVnqRQv.exe
  C:\Windows\System\FVnqRQv.exe
  2⤵
  PID:11920
- C:\Windows\System\MeDbLoW.exe
  C:\Windows\System\MeDbLoW.exe
  2⤵
  PID:13592
- C:\Windows\System\FpZbKXL.exe
  C:\Windows\System\FpZbKXL.exe
  2⤵
  PID:13256
- C:\Windows\System\UnPrHzF.exe
  C:\Windows\System\UnPrHzF.exe
  2⤵
  PID:6524
- C:\Windows\System\EdaLFCm.exe
  C:\Windows\System\EdaLFCm.exe
  2⤵
  PID:2856
- C:\Windows\System\NBAANON.exe
  C:\Windows\System\NBAANON.exe
  2⤵
  PID:11740
- C:\Windows\System\xOSpljN.exe
  C:\Windows\System\xOSpljN.exe
  2⤵
  PID:13528
- C:\Windows\System\PNscaPy.exe
  C:\Windows\System\PNscaPy.exe
  2⤵
  PID:4296
- C:\Windows\System\RQrcKGW.exe
  C:\Windows\System\RQrcKGW.exe
  2⤵
  PID:13748
- C:\Windows\System\PsLHsRC.exe
  C:\Windows\System\PsLHsRC.exe
  2⤵
  PID:13888
- C:\Windows\System\anivqCC.exe
  C:\Windows\System\anivqCC.exe
  2⤵
  PID:5172
- C:\Windows\System\vRFygLC.exe
  C:\Windows\System\vRFygLC.exe
  2⤵
  PID:3692
- C:\Windows\System\kocnLOv.exe
  C:\Windows\System\kocnLOv.exe
  2⤵
  PID:7788
- C:\Windows\System\eWhBaJg.exe
  C:\Windows\System\eWhBaJg.exe
  2⤵
  PID:11600
- C:\Windows\System\sJUGlJi.exe
  C:\Windows\System\sJUGlJi.exe
  2⤵
  PID:11052
- C:\Windows\System\slXsUYi.exe
  C:\Windows\System\slXsUYi.exe
  2⤵
  PID:7736
- C:\Windows\System\mzaroKH.exe
  C:\Windows\System\mzaroKH.exe
  2⤵
  PID:14160
- C:\Windows\System\Jconppw.exe
  C:\Windows\System\Jconppw.exe
  2⤵
  PID:9100
- C:\Windows\System\hLAbKwl.exe
  C:\Windows\System\hLAbKwl.exe
  2⤵
  PID:7868
- C:\Windows\System\YnPaIBI.exe
  C:\Windows\System\YnPaIBI.exe
  2⤵
  PID:13324
- C:\Windows\System\VlLmfhA.exe
  C:\Windows\System\VlLmfhA.exe
  2⤵
  PID:14036
- C:\Windows\System\hoMBPfr.exe
  C:\Windows\System\hoMBPfr.exe
  2⤵
  PID:11684
- C:\Windows\System\bxEPlmH.exe
  C:\Windows\System\bxEPlmH.exe
  2⤵
  PID:5380
- C:\Windows\System\vupybox.exe
  C:\Windows\System\vupybox.exe
  2⤵
  PID:7704
- C:\Windows\System\AYXuTSE.exe
  C:\Windows\System\AYXuTSE.exe
  2⤵
  PID:10364
- C:\Windows\System\BVhBRac.exe
  C:\Windows\System\BVhBRac.exe
  2⤵
  PID:10976
- C:\Windows\System\ADwuqfB.exe
  C:\Windows\System\ADwuqfB.exe
  2⤵
  PID:6392
- C:\Windows\System\aZxOKcz.exe
  C:\Windows\System\aZxOKcz.exe
  2⤵
  PID:12152
- C:\Windows\System\iYQDRnL.exe
  C:\Windows\System\iYQDRnL.exe
  2⤵
  PID:12032
- C:\Windows\System\onHfMBY.exe
  C:\Windows\System\onHfMBY.exe
  2⤵
  PID:12080
- C:\Windows\System\ZiqBKjz.exe
  C:\Windows\System\ZiqBKjz.exe
  2⤵
  PID:2588
- C:\Windows\System\GmrWpte.exe
  C:\Windows\System\GmrWpte.exe
  2⤵
  PID:3196
- C:\Windows\System\ZHTqAtE.exe
  C:\Windows\System\ZHTqAtE.exe
  2⤵
  PID:14284
- C:\Windows\System\oVPpFHI.exe
  C:\Windows\System\oVPpFHI.exe
  2⤵
  PID:13076
- C:\Windows\System\BZnLzxN.exe
  C:\Windows\System\BZnLzxN.exe
  2⤵
  PID:8796
- C:\Windows\System\oUDzReG.exe
  C:\Windows\System\oUDzReG.exe
  2⤵
  PID:10768
- C:\Windows\System\YAhXIEQ.exe
  C:\Windows\System\YAhXIEQ.exe
  2⤵
  PID:10692
- C:\Windows\System\iMSBaks.exe
  C:\Windows\System\iMSBaks.exe
  2⤵
  PID:10044
- C:\Windows\System\RDaRUzS.exe
  C:\Windows\System\RDaRUzS.exe
  2⤵
  PID:8732
- C:\Windows\System\aXLHPee.exe
  C:\Windows\System\aXLHPee.exe
  2⤵
  PID:7628
- C:\Windows\System\HWxFYAY.exe
  C:\Windows\System\HWxFYAY.exe
  2⤵
  PID:13416
- C:\Windows\System\oOiQjJi.exe
  C:\Windows\System\oOiQjJi.exe
  2⤵
  PID:10496
- C:\Windows\System\vpTVTsH.exe
  C:\Windows\System\vpTVTsH.exe
  2⤵
  PID:8652
- C:\Windows\System\pDGAtqF.exe
  C:\Windows\System\pDGAtqF.exe
  2⤵
  PID:13176
- C:\Windows\System\Vmulmje.exe
  C:\Windows\System\Vmulmje.exe
  2⤵
  PID:10736
- C:\Windows\System\uAysRqv.exe
  C:\Windows\System\uAysRqv.exe
  2⤵
  PID:12456
- C:\Windows\System\DlCnYqT.exe
  C:\Windows\System\DlCnYqT.exe
  2⤵
  PID:10192
- C:\Windows\System\oHmxFue.exe
  C:\Windows\System\oHmxFue.exe
  2⤵
  PID:1952
- C:\Windows\System\NUsQszi.exe
  C:\Windows\System\NUsQszi.exe
  2⤵
  PID:9012
- C:\Windows\System\WtJuOzw.exe
  C:\Windows\System\WtJuOzw.exe
  2⤵
  PID:7260
- C:\Windows\System\IpEIUgI.exe
  C:\Windows\System\IpEIUgI.exe
  2⤵
  PID:5300
- C:\Windows\System\nEDUwsk.exe
  C:\Windows\System\nEDUwsk.exe
  2⤵
  PID:2076
- C:\Windows\System\lWlIgav.exe
  C:\Windows\System\lWlIgav.exe
  2⤵
  PID:4864
- C:\Windows\System\eIYnibV.exe
  C:\Windows\System\eIYnibV.exe
  2⤵
  PID:10020
- C:\Windows\System\jnAjdhF.exe
  C:\Windows\System\jnAjdhF.exe
  2⤵
  PID:2772
- C:\Windows\System\qojWOBc.exe
  C:\Windows\System\qojWOBc.exe
  2⤵
  PID:8624
- C:\Windows\System\wRrOlTN.exe
  C:\Windows\System\wRrOlTN.exe
  2⤵
  PID:9164
- C:\Windows\System\qbtISfF.exe
  C:\Windows\System\qbtISfF.exe
  2⤵
  PID:8756
- C:\Windows\System\sTOTnMi.exe
  C:\Windows\System\sTOTnMi.exe
  2⤵
  PID:1196
- C:\Windows\System\peItTMF.exe
  C:\Windows\System\peItTMF.exe
  2⤵
  PID:12772
- C:\Windows\System\yJOURzH.exe
  C:\Windows\System\yJOURzH.exe
  2⤵
  PID:9404
- C:\Windows\System\wVECvaL.exe
  C:\Windows\System\wVECvaL.exe
  2⤵
  PID:10784
- C:\Windows\System\lLpyxOz.exe
  C:\Windows\System\lLpyxOz.exe
  2⤵
  PID:3732
- C:\Windows\System\rTFtxzR.exe
  C:\Windows\System\rTFtxzR.exe
  2⤵
  PID:11916
- C:\Windows\System\OVvNZJf.exe
  C:\Windows\System\OVvNZJf.exe
  2⤵
  PID:11816
- C:\Windows\System\VHkgXQw.exe
  C:\Windows\System\VHkgXQw.exe
  2⤵
  PID:11412
- C:\Windows\System\VePkdeY.exe
  C:\Windows\System\VePkdeY.exe
  2⤵
  PID:13448
- C:\Windows\System\kFbWzSL.exe
  C:\Windows\System\kFbWzSL.exe
  2⤵
  PID:10484
- C:\Windows\System\OtPYfUX.exe
  C:\Windows\System\OtPYfUX.exe
  2⤵
  PID:13152
- C:\Windows\System\krjkVrO.exe
  C:\Windows\System\krjkVrO.exe
  2⤵
  PID:13908
- C:\Windows\System\yihFakU.exe
  C:\Windows\System\yihFakU.exe
  2⤵
  PID:6024
- C:\Windows\System\jaGnDQy.exe
  C:\Windows\System\jaGnDQy.exe
  2⤵
  PID:5612
- C:\Windows\System\EDQOYZT.exe
  C:\Windows\System\EDQOYZT.exe
  2⤵
  PID:440
- C:\Windows\System\nxLCjLp.exe
  C:\Windows\System\nxLCjLp.exe
  2⤵
  PID:14256
- C:\Windows\System\dmbowoJ.exe
  C:\Windows\System\dmbowoJ.exe
  2⤵
  PID:3032
- C:\Windows\System\cynbzNd.exe
  C:\Windows\System\cynbzNd.exe
  2⤵
  PID:9744
- C:\Windows\System\ZXFJYAD.exe
  C:\Windows\System\ZXFJYAD.exe
  2⤵
  PID:3752
- C:\Windows\System\CFtLRGq.exe
  C:\Windows\System\CFtLRGq.exe
  2⤵
  PID:9928
- C:\Windows\System\ECAwkXf.exe
  C:\Windows\System\ECAwkXf.exe
  2⤵
  PID:10212
- C:\Windows\System\pTyjpwx.exe
  C:\Windows\System\pTyjpwx.exe
  2⤵
  PID:10128
- C:\Windows\System\aiXfapV.exe
  C:\Windows\System\aiXfapV.exe
  2⤵
  PID:8052
- C:\Windows\System\dGgIpJe.exe
  C:\Windows\System\dGgIpJe.exe
  2⤵
  PID:3480
- C:\Windows\System\doyrdKI.exe
  C:\Windows\System\doyrdKI.exe
  2⤵
  PID:4188
- C:\Windows\System\YUcUrEw.exe
  C:\Windows\System\YUcUrEw.exe
  2⤵
  PID:8900
- C:\Windows\System\rTQHlNu.exe
  C:\Windows\System\rTQHlNu.exe
  2⤵
  PID:12212
- C:\Windows\System\RtXkyEx.exe
  C:\Windows\System\RtXkyEx.exe
  2⤵
  PID:13692
- C:\Windows\System\DdpLyuK.exe
  C:\Windows\System\DdpLyuK.exe
  2⤵
  PID:320
- C:\Windows\System\DGQjBDO.exe
  C:\Windows\System\DGQjBDO.exe
  2⤵
  PID:4760
- C:\Windows\System\uUlUEuk.exe
  C:\Windows\System\uUlUEuk.exe
  2⤵
  PID:4160
- C:\Windows\System\GtZrjpf.exe
  C:\Windows\System\GtZrjpf.exe
  2⤵
  PID:6152
- C:\Windows\System\GxwKMwU.exe
  C:\Windows\System\GxwKMwU.exe
  2⤵
  PID:8412
- C:\Windows\System\jeLviKw.exe
  C:\Windows\System\jeLviKw.exe
  2⤵
  PID:13000
- C:\Windows\System\eqabxcE.exe
  C:\Windows\System\eqabxcE.exe
  2⤵
  PID:5480
- C:\Windows\System\RdkDJkt.exe
  C:\Windows\System\RdkDJkt.exe
  2⤵
  PID:5428
- C:\Windows\System\BJVcbXL.exe
  C:\Windows\System\BJVcbXL.exe
  2⤵
  PID:14004
- C:\Windows\System\DtwhyuE.exe
  C:\Windows\System\DtwhyuE.exe
  2⤵
  PID:5068
- C:\Windows\System\HmtBCMp.exe
  C:\Windows\System\HmtBCMp.exe
  2⤵
  PID:10940
- C:\Windows\System\BllZqDy.exe
  C:\Windows\System\BllZqDy.exe
  2⤵
  PID:9208
- C:\Windows\System\KUsTKdp.exe
  C:\Windows\System\KUsTKdp.exe
  2⤵
  PID:7756
- C:\Windows\System\UcJgcgO.exe
  C:\Windows\System\UcJgcgO.exe
  2⤵
  PID:13924
- C:\Windows\System\WtRkdsH.exe
  C:\Windows\System\WtRkdsH.exe
  2⤵
  PID:1572
- C:\Windows\System\pwjufhq.exe
  C:\Windows\System\pwjufhq.exe
  2⤵
  PID:10680
- C:\Windows\System\mheujfJ.exe
  C:\Windows\System\mheujfJ.exe
  2⤵
  PID:13900
- C:\Windows\System\pERnTTP.exe
  C:\Windows\System\pERnTTP.exe
  2⤵
  PID:6396
- C:\Windows\System\neSYURl.exe
  C:\Windows\System\neSYURl.exe
  2⤵
  PID:7812
- C:\Windows\System\avEoNQa.exe
  C:\Windows\System\avEoNQa.exe
  2⤵
  PID:7484
- C:\Windows\System\glTzzLy.exe
  C:\Windows\System\glTzzLy.exe
  2⤵
  PID:8348
- C:\Windows\System\acpWdIt.exe
  C:\Windows\System\acpWdIt.exe
  2⤵
  PID:8804
- C:\Windows\System\atJBIgm.exe
  C:\Windows\System\atJBIgm.exe
  2⤵
  PID:5224
- C:\Windows\System\rZbLrIb.exe
  C:\Windows\System\rZbLrIb.exe
  2⤵
  PID:13904
- C:\Windows\System\tVgmzFb.exe
  C:\Windows\System\tVgmzFb.exe
  2⤵
  PID:10400
- C:\Windows\System\JvTnhjE.exe
  C:\Windows\System\JvTnhjE.exe
  2⤵
  PID:10380
- C:\Windows\System\tjWeIaN.exe
  C:\Windows\System\tjWeIaN.exe
  2⤵
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_begbk2bp.p2c.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BgFreTY.exe

Filesize
1.5MB

MD5
9ac81293f8ba0e602b4fdc1dd2f4ea06

SHA1
240fcb1fbf72292129c57610bca39b1557eab773

SHA256
6187a3a24712f6d1c3b9f4ebd49012c2b89749b7b41f010cf99cfffe6857105b

SHA512
628f9147470999f874eeeed7e602277c3132806b575383c8b28daf8bda83bd79d1a23043ff75d6d5de5b8433e42a00f212deebd879fe12a9ad7253ae82a68643

Download Submit
C:\Windows\System\BvLHFHI.exe

Filesize
1.5MB

MD5
42b08503e3b0d54149601ac2829e1f5d

SHA1
20266cc2dcffb28d93f5defd9eecc5a6b98e9ca2

SHA256
bfc9a9a6543bea97c261f702849ed5eb08e54fb2255a23a547a93e47586a62b1

SHA512
bbcdcc72e4638acdb5b1e4697ef025cee3bb93c589ad2e9345722cf6409f08f089c28d61ed97aa2d49fbbdcde6f7b017b75044dedf50c774818351ffdc508c81

Download Submit
C:\Windows\System\DGqCMmZ.exe

Filesize
1.5MB

MD5
2c97e6813e4790450d96019403022fb8

SHA1
60b23ce31df179711d6f0b2f0033efd560d40107

SHA256
8a530eb0467767bc41ecfab4a6b80be56922f0c1a9a208bd4e7199d62796b12b

SHA512
b6e8b7fbaf62e571118555a8ee145102aba5f69238f3a8120e7898e07d9aacb07515dca99673dc99aed0bbadc472e288abe897dad9b932956ddc0e9d9be780a0

Download Submit
C:\Windows\System\FmkgxuK.exe

Filesize
1.5MB

MD5
7d8bf66781c823885f9ad8ef7bcb7d26

SHA1
184fc45ace2f76e689acd9a294752bb7efa6967d

SHA256
7fe75ef316d338f74067189c5f5348111f2bc2cc6cfc83f1c2c211ed21da4c9f

SHA512
3ed8b547a8253d0643956be56e650cfc611fc84aa896f1961d12d635fe94b43a6e7431b343c83d1806ad70d3e949e98744822da90f6bee26c5279f16955e5d11

Download Submit
C:\Windows\System\HSSbpqt.exe

Filesize
1.5MB

MD5
fffad3cfdd9c103f51aea2018fe569a3

SHA1
98db5a92edac4a350c4230e97beec085130d37c9

SHA256
bb6255dad7584f2633e6d45e9f7bfeea117b21da3acb9f6356e274b478632f5c

SHA512
8417d4c05596e86b877896e16088177404c36ddd9e1113c96660e47a4dd80d86e15d9670308e4e375930ac8365e869f8e6447b3db8536af2836d561740e4841b

Download Submit
C:\Windows\System\HjWoURL.exe

Filesize
1.5MB

MD5
da00a026041e50bd8f67780df330ddb2

SHA1
d6dbbf008286d3251fab2da6b00c101b0ef8b3eb

SHA256
dede9403a9d89ce6f7fd659f5c5de652cb5530015cf2adff786df8c7abfe3c6a

SHA512
5bca1ea1d9ae00ef611d340559b3bb89442660c81d147a78a29bdee3d5b91f18a6bc8bf0b396fc0d0b68ac07826252ee4bab1249e957c875ca3d8abe7f90f79b

Download Submit
C:\Windows\System\HpGXMcP.exe

Filesize
1.5MB

MD5
265561b08bcac00b4c8a290b11b8ed03

SHA1
2449f2c0402e3122d4a51b560cc20b5e5a76de16

SHA256
e3f977a3d44cae245a124dcbaa632eeff3b77729d7e0dcd920186751d54d1625

SHA512
a1eb3a0f181578d6c4f012228fd8078cc345eebfa34a3fb548b6f391eb281d42e4ae390aa90df0115ddd5e42db9b9c78580549baf1e67bc1147b409bedb060a4

Download Submit
C:\Windows\System\JjsoMDe.exe

Filesize
1.5MB

MD5
29b8be409881e571d3a1956ad3594a06

SHA1
f22c87c87ad2500328f4c0bd147ae38b89353d3a

SHA256
7a6313e7f93a33d90c49ffc73d00689bdfea21c79c7f1303ec41a1fe808546b5

SHA512
988eea2a8134cd4dbc3ce838c02707d12fefb5c9853390c6c1ca5e6504767df7c184f657c20fa194321587eef92d823b4232484a85766caa6e1bbc83949927b7

Download Submit
C:\Windows\System\LvNBpBU.exe

Filesize
1.5MB

MD5
99952fe1af700babfdb0394f81955d0f

SHA1
750b4ede7c82ba01be2ed9c2f3676ee7dd6efb5e

SHA256
41cb1cc2b2684eb5dda149f829598b242102146f31b5933b31f0c529f43c1455

SHA512
925f1b47adc79035e41c09acda72b354ca9a57d9040ad26e3500c955fe24329817cc64f7c84614325bcbf6f59f6fcc5f44d72f4dcde07a8ef60b26ad2f689b6d

Download Submit
C:\Windows\System\QKTCcHK.exe

Filesize
1.5MB

MD5
7209da55951ff75d7f152119469f250b

SHA1
41b1516cc890ad9e8d4f4d098c78eeb02d0c2005

SHA256
b47c42953a45b2b3cc1b7fc5d63e0b8812ec41ea4bfe399e3a58286a70f2c783

SHA512
a1171a1aa9e96720f3b65b337d0dff0ded84407fea49be07c5e44ff2161424ef409d484f5575031f8fa601ea81fe39a3deb06617859e55e430f192ab95b99ac0

Download Submit
C:\Windows\System\RGDZscc.exe

Filesize
1.5MB

MD5
3812b17e61d87044400133580899c453

SHA1
63412fd9d7eb92317f304b9aaed64b9768f315d2

SHA256
38aacc8979438f4cef583c8413290be4a784ba70a47d08a8acbb07429f25670a

SHA512
a494268b25bf3d6ce33dd4a5f7152eb15b62e82dad6098c0c6199ba1d0ecd4a4fa7b5845ca7a6ed7100a13c615a46e56f65ac2767804878f0c1a5c6550ce5c09

Download Submit
C:\Windows\System\Rxihfcm.exe

Filesize
1.5MB

MD5
f7e900d3f7d2b5a4b71366473b130f99

SHA1
d31cc65e3b8c6f410ddebd888fc5d0c2218ab4e1

SHA256
7d318fb401ef1b5585b73bf8eab4c88a19936c37b7319a3bc6381ec18de0c3be

SHA512
abcb9816137929bf621a2880ef46936d4f2e4b8d901c085164cd1dcba43c31881676626fc90b213cb0d27e85e1c80000c7b161699d0af5e95a5cc84f456f5330

Download Submit
C:\Windows\System\TlcyPKN.exe

Filesize
1.5MB

MD5
150bce58fd7a76ff0f8389423de2c3f8

SHA1
9bc042f3d7cbeddc979e881aea47e7a3bc18f2e4

SHA256
7386bd61ef2e1d79866c358fa687a8ff6858f4af29df3afd9829c33a00e57348

SHA512
a4e88be75dd044e87f8d9501d84f73c38025294569d1aeb294760920e4f7fbdd0bb90143a96978cd24310358b4126a0a517c3616f6995aded974642eb11c877b

Download Submit
C:\Windows\System\WMAKwTs.exe

Filesize
1.5MB

MD5
569565a2392589c3607414a1b7306909

SHA1
58777c1b562a76054a9bf59cd25ddccb3b28d988

SHA256
ec1dcd63f3165dcd2817edbd1480d42800bd2351c724b64996dc5ccd5d7208f3

SHA512
f3597eff53554116439c7c0bf8659841c688ae148f20f5d10e6b6992b2576fe74824ee65957a173f4b96fb0da789b3ba812b23ea5a0111f75607cb344b0a1826

Download Submit
C:\Windows\System\WajPEXw.exe

Filesize
1.5MB

MD5
67edb4e908bd18fb676a97100219d3aa

SHA1
97972e2bd3d13b799a87e01cb7da0fadd239f271

SHA256
c2aee59d7814140f7f338fd0442a6c2b1da53d99535638e3a7503662967f4fee

SHA512
bbfeeabed89699c79a6e882568b9b2fbefc6df2b71304bc829ad704abc71d07e3e0976c006c5d6e7024fecb13b4f13a037516d1066e89cd2f2047b9f58075aaf

Download Submit
C:\Windows\System\Xbqqnsz.exe

Filesize
1.5MB

MD5
e03b0bbf671e10946ddf0ab210b07512

SHA1
61e2fc6fc620b34ec7a8d2e7d4e98b5828f8183c

SHA256
b362d5fb8dded37a5e703af9e279113a53729267dce20f6bb635bae42937856a

SHA512
070794504001f052282ee2790f4b182844797364c8240976ede0bb2d8eb556f37d477d5451eec9c7eeca885f3f5bf969e88aff90966b6b4a21131f4e3bc6fe7d

Download Submit
C:\Windows\System\XcQgdwz.exe

Filesize
1.5MB

MD5
d57e7421a7120294ac1c219a413997b6

SHA1
02ac5dd010c6452b47b764286f29aeec0c038d3b

SHA256
b2ec3c660a773a2ade43b775aac07ed11133240e095f765ec13757c999733037

SHA512
8e7e0a321f347394057b3826ca7c6973c57c5d1f2193063b22ac5a388442822217072bf28bc1e9dedbbb42ad56a4b9a5e4c99700cdb5d1de9af765233d86841e

Download Submit
C:\Windows\System\YKKFbmD.exe

Filesize
1.5MB

MD5
32ef2270291d03380c412e19f8e23665

SHA1
45e9e58afa606bc64cfe10b4a521f2d4c9af4418

SHA256
c325799fc415a60326b5ca0ff6b070f4b49d911c468e3560884d5ac00fb4fae9

SHA512
f69d826e36c977ed7f2b5944f31086a271e8e863ef957b53682d475b8598a54d4be1e05fa31202f358f7a0c49d0ecf5eedc9fdeb7cfbaec337cd682314b8417b

Download Submit
C:\Windows\System\ZyZNGvd.exe

Filesize
1.5MB

MD5
c5260fcb3b02749ff5e046fe7f339cbd

SHA1
d61512bd2f625bca5fccf07e214ce1f8d8ac035b

SHA256
6800c25aeee830cceb469ab9a72ee213e425ab86d699d324d159f6be632c2878

SHA512
70ee0f464a3c15679c9767c920ba57d4acf60d51486ce51936343de8b05502e7229674bffc0e3a62cff8a32968527c590c9f94a3df9a9020fe84690152b4f8a7

Download Submit
C:\Windows\System\bqENHOu.exe

Filesize
1.5MB

MD5
e4b0a9e9936911c23b36839d7dfdb8bf

SHA1
32dbde38421868cc370488b76a6e8d7a0f492ad7

SHA256
888b24862064fc9d380ba00bcbe0f8ece93c77a266e4333e5caf5eadda3afdce

SHA512
b3561cf97b06c6c28c3860a0d9e627eccb3904a2a1f1689baf5efbaa4fa30e54f436f7d43bcd422cb3aba0e4f447c1bfe4c54a2b21f6c64540c5b5cffec14629

Download Submit
C:\Windows\System\cwkBRtz.exe

Filesize
1.5MB

MD5
da1fdf1d9a8b993c664df73b1977362f

SHA1
b4edee4d892a2e2b4bfacd52df506c04e3df1e60

SHA256
04dfe03af2f6311de763663a2d8c1dd346ae7ef26f721b8f2a0ff356217bd7a3

SHA512
add1bf232586974eac84adae713891aa8bde371251a197bb3fc6d7ebf3071136c8081ef47359086400ef700f0a55472050b8cd6a1f20b59b5ff30884e19ac9f1

Download Submit
C:\Windows\System\denDQrO.exe

Filesize
1.5MB

MD5
0a5c265920e97e7f9fa6e80d9e2a294d

SHA1
9dd25695b1cd278434573af20d38b6468f1bf009

SHA256
8e8b5ce708b3ae24412aee73c8a588ae1eee3da6df49a92ea6afc5b0b4314f2f

SHA512
a3e066c9b2f2ee723683b6439246699da86e0e086e12db638157d4e5f273af3ea383eaf8b755e2301874f01881cf0ac81763c65e14e29a1693164c4486559668

Download Submit
C:\Windows\System\fXherZB.exe

Filesize
1.5MB

MD5
6f3caeed632e179737cf50f1e8fb5f72

SHA1
910f31241524ce6a1dc30b3aee23f3b3bc86a659

SHA256
ec000f8dfb3b1d6d2ee018868c19da4bff9fe3a1a9504bf5bf5562c8920e7000

SHA512
ade85f121b3a1fea0dc18db91e20e45606235e8763ed9266c97708a73a924e2ede1df20f424640de48ffba2d6e2ed5a9098e32f358c7ed45b9a53281e2d5f71b

Download Submit
C:\Windows\System\gcIFndl.exe

Filesize
1.5MB

MD5
60811138ee49d351edc22745479134b1

SHA1
d2b307f114f403e3e5de31b21fdaf61cbf9a8334

SHA256
c912d8c421e373ec21cae8676ed8f9a40f27a30063a8a90b9dc814418fef866a

SHA512
bc9d4e05cfcea01a5c630d4ddb3dbf10582cf01c20aa59730cb0ac20bd0f7886f1bef38d2b5c205c6e3262e7f1a08b16d7a0901458058912c584f5c3db452f02

Download Submit
C:\Windows\System\hbLuLtc.exe

Filesize
1.5MB

MD5
7f7ae31252b2d27dcdec2f8fe57c70d6

SHA1
0f5c20c9aeac8ae0ffc3ebecaaa0a265baf9c107

SHA256
fc8b09e3253a77afe40e43a838bd8b447efb6dd572f454decb81dcbb300cdd6b

SHA512
228214676336f2f2c1e69f07bb9fa866aa96b03160affb714d2304b4529d8b222d4756f548a7f483e9fc9c344b8931b157caa6b003011a8bd76ab23fef0d9cdf

Download Submit
C:\Windows\System\iDJmlAZ.exe

Filesize
1.5MB

MD5
1f5c2bc9cc3e911838345469f9bb4b68

SHA1
e3c75efc9163e6d3eb0017783bbacef1bcb3d95d

SHA256
aef7fda2ade0e136b04d121f848fd9ba6c6fc7c80dcfb2e2a3b7339f5f351f93

SHA512
a65247ab211dd926e4f873e8d41636c2345359650da9ab1e4d63afae02a15fae4ca36add58b4ff0ec66737af2f4af9a0db261348c3fd911f28ecb38d144f07d3

Download Submit
C:\Windows\System\jVGhfke.exe

Filesize
1.5MB

MD5
ff9fda06ce0bfe5eb077e452462edb58

SHA1
96375cc03c114c2a59ef8824e2a6e76f23b62ed1

SHA256
3f3434f99a84536f7b4892dea075427b4975021c734984ee3a3098c759129cd4

SHA512
c44c103b7972cab37e7eeca4ca8d96e8aa4384772be8c3f6236cb5a02851c512aafe24aa445793a3778528e3961cc967ff6e1e9b20cf0207222fb5410e639d6e

Download Submit
C:\Windows\System\jjvGbHn.exe

Filesize
1.5MB

MD5
f5f18128aeee3a1ef5a978f99938a13f

SHA1
f5331991d31a6f9791566ca9f1b6aaf201a45a6e

SHA256
3eca65796c446a0cada477aba66677f2594a50d4a88f2e234d373144653d8f85

SHA512
8620634fa0f333735f4c043edd2ab8aead6fb8c019dd6f600452e4867122cbb16430672e6905dd7c57b568c26060a2d94a96baeeea00ee639de97bd66993dacc

Download Submit
C:\Windows\System\jzcExOG.exe

Filesize
1.5MB

MD5
98b9450882c274ed704b1ac46a4053f0

SHA1
273b76398b0a70a0694a7ff121465b7c39230f4a

SHA256
7408d6377545d59ebf2ccb2cdf947ac3ef3b8ebc245f2058bd67549ad855861d

SHA512
313097a97eaa9d5b8d42ed5e725edffba2dda829306cad9587d81478d25db6562e622b5719ca477c515bf4c5f0814ca8627a3dc2232534b0f3828d333ddb6440

Download Submit
C:\Windows\System\lGfxJkJ.exe

Filesize
1.5MB

MD5
87eaecf7fa0ce89c04b4b23217ac10df

SHA1
d1524c6bf9b825cb107fd568181fb447e1f8f6ce

SHA256
df2daa45df5d82fd634759214ae0cdfa23b2a7a14844ab699d2e477334916580

SHA512
d05f6e858e7322c020620fec7219189e5078c74a7e866b5eb7e6c3e512ed65dcd7c51783c2b28743643a46a439ec8e6bf02c523e55b0b29cb2679055f835d68a

Download Submit
C:\Windows\System\lZYHthR.exe

Filesize
1.5MB

MD5
5e12cff3c0eda3d3ec641db629bc5bba

SHA1
74f2cea8544d434e1da5cb7b8003068cd81764a5

SHA256
40ea092c947de4c4904fcffbf43d87e63568256c4013be2709c33b6849ede78d

SHA512
a813b8d4e7c0236c864bd89c27635f6aa9f5ea6ead85e40a9bccf2faa05e71ba83f335052fc67f4ad0e635df2ca3be5da73d51337673ea34d06b004c6e76203b

Download Submit
C:\Windows\System\nMvwLdT.exe

Filesize
1.5MB

MD5
3661c0233753b24a78873cf1dcff0ff3

SHA1
156f8725486db1dcb62fef58e4fe2a2b617b5991

SHA256
28a70daae4082c2c3bc91b459a88f5f4c95ff857217ae17478b661cb0f7ca540

SHA512
c7716e518e5bf74df5c81d81766864051a074d6b403a9562fdb455dd2cb46e7eeec29b5329f9fe5071c725c9d39852133b27319370bcd9f81c1accfb3c69dd7d

Download Submit
C:\Windows\System\neHuawJ.exe

Filesize
1.5MB

MD5
865c00fd5470a193c7932393b754ccb2

SHA1
fa9f2099dd16ae2d8c16b7bf96a6b84f649d32fb

SHA256
eb4423e31c4061374497bceb4f53499f4625aece337002fd7445cff8bec97d28

SHA512
0e1724fa1a054c350f6bb19d5691c84390fcbf6f984865762abcf77723db58b233e7b0fcffc26431d427fb133e9fb12b8ff1c7d80deef90e78de1dcff01e91b6

Download Submit
C:\Windows\System\oLupQWE.exe

Filesize
1.5MB

MD5
0741f2e5bee1e7e537bcc17db5dbe896

SHA1
92853ed64fbc8103f3ab6fa3293e57d553d88729

SHA256
c592fd077523f49a0e4a2718431e34f62323f56c30482d81753dad3fd8cf53c6

SHA512
2cb3efb8aec605eeea3596ebfb3fa8baeec2f5ed408b2baf90d158f25531c78912e306796a7affba1c47c560db1678b70afe268b9910aa502d821e03ea3b2231

Download Submit
C:\Windows\System\ommPoNh.exe

Filesize
1.5MB

MD5
aa01923c6a43396683c1961852d531ab

SHA1
7ffffd58864074ede1280194f6d9a2c4da60e4b4

SHA256
52a9ad7ffa4aace087d53493f8c313c73bcd4c48031e5c582173a6e4275fe2cb

SHA512
d030b772aebeb03e5f8cc3caf36a6a22b30c179a30e73bb8639fa4251c30e4060e2abdfd4c22d270c314165f4482e8aab1f855e33734b83811686c3ebf47b152

Download Submit
C:\Windows\System\oxSEjlY.exe

Filesize
1.5MB

MD5
275e762c88f40d0cf1967e31506aa65d

SHA1
edad142970e6043ef6bb97ec0f5d005e33bffb60

SHA256
d4e3ed11056f51e8cdba760b26c5ba29ba857aa706621b99e64882a9089cdf32

SHA512
0051f9b07f7e3b33b3f17877fb1488ab2f7f9e77857d54d818a507fb4ba03d57e02952c66a4941bb5a47114b4fdeff185d7694000b0c849de975f711a03745e3

Download Submit
C:\Windows\System\qRxKoxf.exe

Filesize
1.5MB

MD5
65a148ded60edc20634aa2bca56fba91

SHA1
deb13aa2e2588d4d243ab49e8c90161827124e95

SHA256
84361d0432ed09d39a83d24f6385660d309db53665d2bd151dbe5a6c3f531c40

SHA512
0cf4240a4b460d62f9fa4b936c454e4fb2f76b38ee51dab9270e984fd0ac5f7776f81d52af72b5a6645fd8b9129a40673cf04d36258dacf16534457f1a96f543

Download Submit
C:\Windows\System\sVObKat.exe

Filesize
18B

MD5
bde15b2ead8c80bd9adb93196fa26dbd

SHA1
dc2f51a48e5d52847073f853245e5bf80527fa84

SHA256
897a554176d39e9ef1a3494c4af72e02ec36d8ca92881b63e220a966c7aa27fe

SHA512
6a8b4d4b782e0d5eb3f0177188a94042b4c9e59512454c55775a50f9b1a123a2a12f4522c49fed572948865a1b6160bc9ec1d35a4c5a7500be5c6e91edfa9d45

Download Submit
C:\Windows\System\usqwNcv.exe

Filesize
1.5MB

MD5
fb8fec6cbbdd687cb41ccd1581e411da

SHA1
d2f77e939ed64f4cba236d4a9b244cd5124a1dc6

SHA256
2db0a2344e7bcbd56422878a99ac31cb4852362b986c2f2f33171e1bf609bcd4

SHA512
152b0b65e6aaa539a691147e9fe6ee5a97994f46a8c926036292a178f300b86f514c549922ab81a30aa704b7fceed9354b6b00a556e6ea098af439ffacf66966

Download Submit
C:\Windows\System\veqquRo.exe

Filesize
1.5MB

MD5
6d203c9e32e1de62dbdcc6b3c8863af1

SHA1
fd229283336c2baa79ab1de4c452129420d19594

SHA256
c925f98319bb2b8ec5c86e8ee26ad94ca42e619919211cabcf7e2ff387c8d335

SHA512
503744c97f84c5d08a3f157bf908e755155efff83e759e4090972ae8e110b872eaf2b27883ae2abf4d9f9c02110e424b12a5981fcafb031adc44afa7460b6c80

Download Submit
C:\Windows\System\xGsQLJY.exe

Filesize
1.5MB

MD5
c4bb9269619f2b0f3b999ff949debcf4

SHA1
d005df3b1d33b32232930ef3c9c5d78682f42e53

SHA256
32982360d8295aee5d80b095d7a6405a6fc1f17d2f1e70a8ff7320472157f7d0

SHA512
3aa204aa1adea45839237067f71d174115d8865e512825416d76bc8abeb81178f92a89fcde5acc66a111684760a9fc410d4eeb2bf22ae9d820690cfdd4fbf0de

Download Submit
memory/496-784-0x00007FF693160000-0x00007FF693552000-memory.dmp

Filesize
3.9MB

Download
memory/532-440-0x00007FF6E8170000-0x00007FF6E8562000-memory.dmp

Filesize
3.9MB

Download
memory/564-255-0x00007FF6F2050000-0x00007FF6F2442000-memory.dmp

Filesize
3.9MB

Download
memory/1076-88-0x00007FF6E02A0000-0x00007FF6E0692000-memory.dmp

Filesize
3.9MB

Download
memory/1088-203-0x00007FF762230000-0x00007FF762622000-memory.dmp

Filesize
3.9MB

Download
memory/1272-124-0x00007FF66A4F0000-0x00007FF66A8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-785-0x00007FF66C4B0000-0x00007FF66C8A2000-memory.dmp

Filesize
3.9MB

Download
memory/1956-783-0x00007FF7416B0000-0x00007FF741AA2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-194-0x00007FF6A8BB0000-0x00007FF6A8FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-8127-0x00007FF715F50000-0x00007FF716342000-memory.dmp

Filesize
3.9MB

Download
memory/2620-786-0x00007FF715F50000-0x00007FF716342000-memory.dmp

Filesize
3.9MB

Download
memory/2680-302-0x00007FF7C0A90000-0x00007FF7C0E82000-memory.dmp

Filesize
3.9MB

Download
memory/2868-781-0x00007FF776620000-0x00007FF776A12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-8131-0x00007FF776620000-0x00007FF776A12000-memory.dmp

Filesize
3.9MB

Download
memory/2940-1-0x000001E485B10000-0x000001E485B20000-memory.dmp

Filesize
64KB

Download
memory/2940-0-0x00007FF7D4F50000-0x00007FF7D5342000-memory.dmp

Filesize
3.9MB

Download
memory/3180-116-0x000002576CC40000-0x000002576CC62000-memory.dmp

Filesize
136KB

Download
memory/3180-5-0x00007FF900193000-0x00007FF900195000-memory.dmp

Filesize
8KB

Download
memory/3180-53-0x00007FF900190000-0x00007FF900C51000-memory.dmp

Filesize
10.8MB

Download
memory/3180-782-0x00007FF900190000-0x00007FF900C51000-memory.dmp

Filesize
10.8MB

Download
memory/3924-204-0x00007FF73D800000-0x00007FF73DBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-263-0x00007FF7D82C0000-0x00007FF7D86B2000-memory.dmp

Filesize
3.9MB

Download
memory/3972-8148-0x00007FF7D82C0000-0x00007FF7D86B2000-memory.dmp

Filesize
3.9MB

Download
memory/4116-448-0x00007FF7CD930000-0x00007FF7CDD22000-memory.dmp

Filesize
3.9MB

Download
memory/4116-8124-0x00007FF7CD930000-0x00007FF7CDD22000-memory.dmp

Filesize
3.9MB

Download
memory/4268-330-0x00007FF6CB490000-0x00007FF6CB882000-memory.dmp

Filesize
3.9MB

Download
memory/4308-673-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp

Filesize
3.9MB

Download
memory/4308-8151-0x00007FF7BD990000-0x00007FF7BDD82000-memory.dmp

Filesize
3.9MB

Download
memory/4352-174-0x00007FF76C8C0000-0x00007FF76CCB2000-memory.dmp

Filesize
3.9MB

Download
memory/4352-7945-0x00007FF76C8C0000-0x00007FF76CCB2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-664-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp

Filesize
3.9MB

Download
memory/4712-8154-0x00007FF6DC390000-0x00007FF6DC782000-memory.dmp

Filesize
3.9MB

Download
memory/4724-333-0x00007FF6DB970000-0x00007FF6DBD62000-memory.dmp

Filesize
3.9MB

Download
memory/4724-8166-0x00007FF6DB970000-0x00007FF6DBD62000-memory.dmp

Filesize
3.9MB

Download
memory/4788-8024-0x00007FF6204C0000-0x00007FF6208B2000-memory.dmp

Filesize
3.9MB

Download
memory/4788-389-0x00007FF6204C0000-0x00007FF6208B2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-60-0x00007FF6949F0000-0x00007FF694DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-195-0x00007FF7883E0000-0x00007FF7887D2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-8156-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-526-0x00007FF719DE0000-0x00007FF71A1D2000-memory.dmp

Filesize
3.9MB

Download