xmrig | 3f35d5968ba9c361ced29b9c4f7f30245d9565345210d9a005aac13e9caed1d6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
Size

1.4MB
MD5

29aa236be55b64fa8b3bf25878e26600
SHA1

fc7fa8843d83c75fee11dc503038dfd0b717740b
SHA256

3f35d5968ba9c361ced29b9c4f7f30245d9565345210d9a005aac13e9caed1d6
SHA512

73f4d16b639c71178007d07f926ca4f09eebe63426e4245daf441fdbbf9fe20772d53932c89010b01f04ca514847c285f753c49ce656b8dd015e4f706458303e
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6rdwwviY:Lz071uv4BPMkFfdk2afGwwvH

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4524-63-0x00007FF782910000-0x00007FF782D02000-memory.dmp	xmrig
behavioral2/memory/1344-111-0x00007FF74AD90000-0x00007FF74B182000-memory.dmp	xmrig
behavioral2/memory/444-115-0x00007FF75A980000-0x00007FF75AD72000-memory.dmp	xmrig
behavioral2/memory/4596-119-0x00007FF71A1B0000-0x00007FF71A5A2000-memory.dmp	xmrig
behavioral2/memory/3600-123-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp	xmrig
behavioral2/memory/4980-127-0x00007FF754FA0000-0x00007FF755392000-memory.dmp	xmrig
behavioral2/memory/2208-128-0x00007FF77F000000-0x00007FF77F3F2000-memory.dmp	xmrig
behavioral2/memory/2424-126-0x00007FF6F7550000-0x00007FF6F7942000-memory.dmp	xmrig
behavioral2/memory/1008-630-0x00007FF722390000-0x00007FF722782000-memory.dmp	xmrig
behavioral2/memory/3268-633-0x00007FF7DE550000-0x00007FF7DE942000-memory.dmp	xmrig
behavioral2/memory/4204-634-0x00007FF62D2A0000-0x00007FF62D692000-memory.dmp	xmrig
behavioral2/memory/2936-632-0x00007FF682260000-0x00007FF682652000-memory.dmp	xmrig
behavioral2/memory/2244-631-0x00007FF74CC50000-0x00007FF74D042000-memory.dmp	xmrig
behavioral2/memory/3592-125-0x00007FF71BC80000-0x00007FF71C072000-memory.dmp	xmrig
behavioral2/memory/2660-124-0x00007FF65AD50000-0x00007FF65B142000-memory.dmp	xmrig
behavioral2/memory/1860-122-0x00007FF63A180000-0x00007FF63A572000-memory.dmp	xmrig
behavioral2/memory/2692-121-0x00007FF60BBE0000-0x00007FF60BFD2000-memory.dmp	xmrig
behavioral2/memory/796-120-0x00007FF73A650000-0x00007FF73AA42000-memory.dmp	xmrig
behavioral2/memory/5116-118-0x00007FF647930000-0x00007FF647D22000-memory.dmp	xmrig
behavioral2/memory/956-117-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp	xmrig
behavioral2/memory/4592-116-0x00007FF6EFE00000-0x00007FF6F01F2000-memory.dmp	xmrig
behavioral2/memory/1032-112-0x00007FF7AB160000-0x00007FF7AB552000-memory.dmp	xmrig
behavioral2/memory/2524-110-0x00007FF61D750000-0x00007FF61DB42000-memory.dmp	xmrig
behavioral2/memory/1944-78-0x00007FF628E40000-0x00007FF629232000-memory.dmp	xmrig
behavioral2/memory/1944-3591-0x00007FF628E40000-0x00007FF629232000-memory.dmp	xmrig
behavioral2/memory/1032-3594-0x00007FF7AB160000-0x00007FF7AB552000-memory.dmp	xmrig
behavioral2/memory/4524-3604-0x00007FF782910000-0x00007FF782D02000-memory.dmp	xmrig
behavioral2/memory/444-3610-0x00007FF75A980000-0x00007FF75AD72000-memory.dmp	xmrig
behavioral2/memory/4592-3606-0x00007FF6EFE00000-0x00007FF6F01F2000-memory.dmp	xmrig
behavioral2/memory/796-3656-0x00007FF73A650000-0x00007FF73AA42000-memory.dmp	xmrig
behavioral2/memory/2660-3723-0x00007FF65AD50000-0x00007FF65B142000-memory.dmp	xmrig
behavioral2/memory/2208-3727-0x00007FF77F000000-0x00007FF77F3F2000-memory.dmp	xmrig
behavioral2/memory/4204-3832-0x00007FF62D2A0000-0x00007FF62D692000-memory.dmp	xmrig
behavioral2/memory/3268-3828-0x00007FF7DE550000-0x00007FF7DE942000-memory.dmp	xmrig
behavioral2/memory/2936-3824-0x00007FF682260000-0x00007FF682652000-memory.dmp	xmrig
behavioral2/memory/2244-3822-0x00007FF74CC50000-0x00007FF74D042000-memory.dmp	xmrig
behavioral2/memory/1008-3820-0x00007FF722390000-0x00007FF722782000-memory.dmp	xmrig
behavioral2/memory/3600-3707-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp	xmrig
behavioral2/memory/1860-3681-0x00007FF63A180000-0x00007FF63A572000-memory.dmp	xmrig
behavioral2/memory/4980-3658-0x00007FF754FA0000-0x00007FF755392000-memory.dmp	xmrig
behavioral2/memory/2692-3662-0x00007FF60BBE0000-0x00007FF60BFD2000-memory.dmp	xmrig
behavioral2/memory/2424-3625-0x00007FF6F7550000-0x00007FF6F7942000-memory.dmp	xmrig
behavioral2/memory/5116-3624-0x00007FF647930000-0x00007FF647D22000-memory.dmp	xmrig
behavioral2/memory/956-3622-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp	xmrig
behavioral2/memory/4596-3620-0x00007FF71A1B0000-0x00007FF71A5A2000-memory.dmp	xmrig
behavioral2/memory/3600-4212-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	2604	powershell.exe
12	2604	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2604	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3592	UEfjXUq.exe
4524	AFumJfx.exe
1944	hFYwvHR.exe
2524	DxKTzVs.exe
1344	hCyJopv.exe
1032	ysuKDmV.exe
444	AhbqMgn.exe
4592	LrMlEsv.exe
2424	KibZPeh.exe
956	OJBAfMP.exe
5116	xjiHJfJ.exe
4596	tBpXwyT.exe
796	KuBjjAr.exe
2692	UZLInEj.exe
4980	rQjeegX.exe
1860	dXdWtjS.exe
3600	CrjvfAk.exe
2660	ECaFSJF.exe
2208	NLwbHmK.exe
1008	RNodEBO.exe
2244	lzhWBsB.exe
2936	jGYcOPO.exe
3268	WAKPlPJ.exe
4204	UCvZntN.exe
4748	lKzqeyo.exe
2976	zYdACiz.exe
440	IWOnmEL.exe
2748	MZtyDlC.exe
3632	PrOHRsO.exe
2024	CzlRBHr.exe
5032	tkdXNcY.exe
1424	toukMMP.exe
1180	NqQyCwx.exe
4272	mqPMjOE.exe
3972	Fctqahf.exe
4752	iZVJnej.exe
4620	OGjUKum.exe
1220	DdUUmDq.exe
5100	NgdeIrc.exe
716	NJNXKIk.exe
2128	gAReZHb.exe
2816	NlaQLUI.exe
1688	xUmnPNB.exe
4560	OFukeKg.exe
3532	PhBYCOa.exe
456	shiitBJ.exe
2724	VbnRDlI.exe
468	FMwoPud.exe
4208	CRXfvez.exe
1172	TQsZraA.exe
2012	RlqNWCH.exe
3964	qfuDGLS.exe
2008	psnBhkg.exe
1692	OLqHXmI.exe
1004	DJwJgcE.exe
4348	JvqjfoS.exe
2044	LjTEYlg.exe
2256	rmulSbo.exe
4168	FhlIgwE.exe
3984	zeXIeQD.exe
4872	yBopFnz.exe
736	FuceJmr.exe
5148	ibhDBvV.exe
5172	qwuhHuw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4300-0-0x00007FF6BE6D0000-0x00007FF6BEAC2000-memory.dmp	upx
behavioral2/files/0x00070000000233e6-6.dat	upx
behavioral2/files/0x00070000000233e7-18.dat	upx
behavioral2/files/0x00070000000233e9-22.dat	upx
behavioral2/files/0x00070000000233ea-49.dat	upx
behavioral2/files/0x00070000000233ef-54.dat	upx
behavioral2/memory/4524-63-0x00007FF782910000-0x00007FF782D02000-memory.dmp	upx
behavioral2/files/0x00070000000233f0-84.dat	upx
behavioral2/files/0x00070000000233f5-88.dat	upx
behavioral2/files/0x00070000000233f4-94.dat	upx
behavioral2/memory/1344-111-0x00007FF74AD90000-0x00007FF74B182000-memory.dmp	upx
behavioral2/memory/444-115-0x00007FF75A980000-0x00007FF75AD72000-memory.dmp	upx
behavioral2/memory/4596-119-0x00007FF71A1B0000-0x00007FF71A5A2000-memory.dmp	upx
behavioral2/memory/3600-123-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp	upx
behavioral2/memory/4980-127-0x00007FF754FA0000-0x00007FF755392000-memory.dmp	upx
behavioral2/memory/2208-128-0x00007FF77F000000-0x00007FF77F3F2000-memory.dmp	upx
behavioral2/memory/2424-126-0x00007FF6F7550000-0x00007FF6F7942000-memory.dmp	upx
behavioral2/files/0x0007000000023400-174.dat	upx
behavioral2/files/0x0007000000023404-194.dat	upx
behavioral2/memory/1008-630-0x00007FF722390000-0x00007FF722782000-memory.dmp	upx
behavioral2/memory/3268-633-0x00007FF7DE550000-0x00007FF7DE942000-memory.dmp	upx
behavioral2/memory/4204-634-0x00007FF62D2A0000-0x00007FF62D692000-memory.dmp	upx
behavioral2/memory/2936-632-0x00007FF682260000-0x00007FF682652000-memory.dmp	upx
behavioral2/memory/2244-631-0x00007FF74CC50000-0x00007FF74D042000-memory.dmp	upx
behavioral2/files/0x0007000000023402-192.dat	upx
behavioral2/files/0x0007000000023403-189.dat	upx
behavioral2/files/0x0007000000023401-187.dat	upx
behavioral2/files/0x00070000000233ff-177.dat	upx
behavioral2/files/0x00070000000233fe-172.dat	upx
behavioral2/files/0x00070000000233fd-167.dat	upx
behavioral2/files/0x00070000000233fc-162.dat	upx
behavioral2/files/0x00070000000233fb-155.dat	upx
behavioral2/files/0x00070000000233fa-150.dat	upx
behavioral2/files/0x00070000000233f9-145.dat	upx
behavioral2/files/0x00080000000233f8-140.dat	upx
behavioral2/files/0x00070000000233f6-135.dat	upx
behavioral2/memory/3592-125-0x00007FF71BC80000-0x00007FF71C072000-memory.dmp	upx
behavioral2/memory/2660-124-0x00007FF65AD50000-0x00007FF65B142000-memory.dmp	upx
behavioral2/memory/1860-122-0x00007FF63A180000-0x00007FF63A572000-memory.dmp	upx
behavioral2/memory/2692-121-0x00007FF60BBE0000-0x00007FF60BFD2000-memory.dmp	upx
behavioral2/memory/796-120-0x00007FF73A650000-0x00007FF73AA42000-memory.dmp	upx
behavioral2/memory/5116-118-0x00007FF647930000-0x00007FF647D22000-memory.dmp	upx
behavioral2/memory/956-117-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp	upx
behavioral2/memory/4592-116-0x00007FF6EFE00000-0x00007FF6F01F2000-memory.dmp	upx
behavioral2/files/0x00080000000233e2-113.dat	upx
behavioral2/memory/1032-112-0x00007FF7AB160000-0x00007FF7AB552000-memory.dmp	upx
behavioral2/memory/2524-110-0x00007FF61D750000-0x00007FF61DB42000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-92.dat	upx
behavioral2/files/0x00070000000233f2-90.dat	upx
behavioral2/files/0x00070000000233f1-86.dat	upx
behavioral2/memory/1944-78-0x00007FF628E40000-0x00007FF629232000-memory.dmp	upx
behavioral2/files/0x00070000000233ee-73.dat	upx
behavioral2/files/0x00070000000233ed-67.dat	upx
behavioral2/files/0x00070000000233eb-64.dat	upx
behavioral2/files/0x00070000000233ec-59.dat	upx
behavioral2/files/0x00070000000233e8-40.dat	upx
behavioral2/files/0x00070000000233e5-26.dat	upx
behavioral2/files/0x000a0000000233dd-25.dat	upx
behavioral2/memory/1944-3591-0x00007FF628E40000-0x00007FF629232000-memory.dmp	upx
behavioral2/memory/1032-3594-0x00007FF7AB160000-0x00007FF7AB552000-memory.dmp	upx
behavioral2/memory/4524-3604-0x00007FF782910000-0x00007FF782D02000-memory.dmp	upx
behavioral2/memory/444-3610-0x00007FF75A980000-0x00007FF75AD72000-memory.dmp	upx
behavioral2/memory/4592-3606-0x00007FF6EFE00000-0x00007FF6F01F2000-memory.dmp	upx
behavioral2/memory/796-3656-0x00007FF73A650000-0x00007FF73AA42000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VOZVAfk.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\WWUuDBu.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\JKFiILp.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\ECojHHn.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\MZtyDlC.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\ygUrhhH.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\MIYQkUZ.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\RmLMtIU.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\txLQSuQ.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\XghvbvK.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\IrrWOoi.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\rmFPUln.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\DSRqXSE.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\JBvuihn.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\xwgIkHl.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\lLmJaLh.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\ggPtaaO.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\NdbLsly.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\BMHoDIP.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\NTxAHhc.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\RgoLxcG.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\PttLadR.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\SwszXKz.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\fFYRIXB.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\diGusBC.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\obSsErF.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\hoivfUv.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\UDrqDfZ.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\kDZwzld.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\iDSfFSf.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\hyzFbPX.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\uoJwwou.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\sLRCpgm.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\kIKBqua.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\uJBgcgB.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\YaAYJer.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\auFKeCY.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\sYQdnsW.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\PbYvirK.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\NJRUxqC.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\EHzDaTU.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\tAVfXFl.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\aDKaLpG.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\utouzEJ.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\crMVWbY.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\DPwVdQW.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\voJQqlm.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\PaGmTIL.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\VxmIfJT.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\YfYeZEx.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\pZTwEfN.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\csOEUmn.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\lSCXnNk.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\wJeuopg.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\TRMJdnv.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\NwxoVio.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\JPWKXZJ.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\MvbeqwP.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\mbTtezw.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\XrwkBZs.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\EYqqNXc.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\cHlUxxM.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\AcvqKue.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
File created	C:\Windows\System\oZnKRjM.exe	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2604	powershell.exe
2604	powershell.exe
2604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeLockMemoryPrivilege	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2604	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	84
PID 4300 wrote to memory of 2604	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	84
PID 4300 wrote to memory of 3592	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	85
PID 4300 wrote to memory of 3592	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	85
PID 4300 wrote to memory of 1344	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	86
PID 4300 wrote to memory of 1344	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	86
PID 4300 wrote to memory of 4524	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	87
PID 4300 wrote to memory of 4524	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	87
PID 4300 wrote to memory of 1944	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	88
PID 4300 wrote to memory of 1944	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	88
PID 4300 wrote to memory of 2524	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	89
PID 4300 wrote to memory of 2524	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	89
PID 4300 wrote to memory of 1032	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	90
PID 4300 wrote to memory of 1032	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	90
PID 4300 wrote to memory of 444	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	91
PID 4300 wrote to memory of 444	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	91
PID 4300 wrote to memory of 2424	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	92
PID 4300 wrote to memory of 2424	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	92
PID 4300 wrote to memory of 4592	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	93
PID 4300 wrote to memory of 4592	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	93
PID 4300 wrote to memory of 956	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	94
PID 4300 wrote to memory of 956	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	94
PID 4300 wrote to memory of 5116	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	95
PID 4300 wrote to memory of 5116	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	95
PID 4300 wrote to memory of 4596	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	96
PID 4300 wrote to memory of 4596	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	96
PID 4300 wrote to memory of 796	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	97
PID 4300 wrote to memory of 796	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	97
PID 4300 wrote to memory of 2692	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	98
PID 4300 wrote to memory of 2692	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	98
PID 4300 wrote to memory of 4980	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	99
PID 4300 wrote to memory of 4980	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	99
PID 4300 wrote to memory of 1860	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	100
PID 4300 wrote to memory of 1860	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	100
PID 4300 wrote to memory of 3600	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	101
PID 4300 wrote to memory of 3600	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	101
PID 4300 wrote to memory of 2660	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	102
PID 4300 wrote to memory of 2660	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	102
PID 4300 wrote to memory of 2208	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	103
PID 4300 wrote to memory of 2208	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	103
PID 4300 wrote to memory of 1008	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	104
PID 4300 wrote to memory of 1008	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	104
PID 4300 wrote to memory of 2244	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	105
PID 4300 wrote to memory of 2244	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	105
PID 4300 wrote to memory of 2936	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	106
PID 4300 wrote to memory of 2936	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	106
PID 4300 wrote to memory of 3268	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	107
PID 4300 wrote to memory of 3268	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	107
PID 4300 wrote to memory of 4204	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	108
PID 4300 wrote to memory of 4204	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	108
PID 4300 wrote to memory of 4748	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	109
PID 4300 wrote to memory of 4748	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	109
PID 4300 wrote to memory of 2976	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	110
PID 4300 wrote to memory of 2976	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	110
PID 4300 wrote to memory of 440	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	111
PID 4300 wrote to memory of 440	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	111
PID 4300 wrote to memory of 2748	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	112
PID 4300 wrote to memory of 2748	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	112
PID 4300 wrote to memory of 3632	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	113
PID 4300 wrote to memory of 3632	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	113
PID 4300 wrote to memory of 2024	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	114
PID 4300 wrote to memory of 2024	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	114
PID 4300 wrote to memory of 5032	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	115
PID 4300 wrote to memory of 5032	4300	29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\29aa236be55b64fa8b3bf25878e26600_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2604
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2604" "3008" "2944" "3012" "0" "0" "3016" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13500
- C:\Windows\System\UEfjXUq.exe
  C:\Windows\System\UEfjXUq.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\hCyJopv.exe
  C:\Windows\System\hCyJopv.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\AFumJfx.exe
  C:\Windows\System\AFumJfx.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\hFYwvHR.exe
  C:\Windows\System\hFYwvHR.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\DxKTzVs.exe
  C:\Windows\System\DxKTzVs.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ysuKDmV.exe
  C:\Windows\System\ysuKDmV.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\AhbqMgn.exe
  C:\Windows\System\AhbqMgn.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\KibZPeh.exe
  C:\Windows\System\KibZPeh.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\LrMlEsv.exe
  C:\Windows\System\LrMlEsv.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\OJBAfMP.exe
  C:\Windows\System\OJBAfMP.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\xjiHJfJ.exe
  C:\Windows\System\xjiHJfJ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\tBpXwyT.exe
  C:\Windows\System\tBpXwyT.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\KuBjjAr.exe
  C:\Windows\System\KuBjjAr.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\UZLInEj.exe
  C:\Windows\System\UZLInEj.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\rQjeegX.exe
  C:\Windows\System\rQjeegX.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\dXdWtjS.exe
  C:\Windows\System\dXdWtjS.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\CrjvfAk.exe
  C:\Windows\System\CrjvfAk.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\ECaFSJF.exe
  C:\Windows\System\ECaFSJF.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\NLwbHmK.exe
  C:\Windows\System\NLwbHmK.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\RNodEBO.exe
  C:\Windows\System\RNodEBO.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\lzhWBsB.exe
  C:\Windows\System\lzhWBsB.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\jGYcOPO.exe
  C:\Windows\System\jGYcOPO.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\WAKPlPJ.exe
  C:\Windows\System\WAKPlPJ.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\UCvZntN.exe
  C:\Windows\System\UCvZntN.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\lKzqeyo.exe
  C:\Windows\System\lKzqeyo.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\zYdACiz.exe
  C:\Windows\System\zYdACiz.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\IWOnmEL.exe
  C:\Windows\System\IWOnmEL.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\MZtyDlC.exe
  C:\Windows\System\MZtyDlC.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\PrOHRsO.exe
  C:\Windows\System\PrOHRsO.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\CzlRBHr.exe
  C:\Windows\System\CzlRBHr.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\tkdXNcY.exe
  C:\Windows\System\tkdXNcY.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\toukMMP.exe
  C:\Windows\System\toukMMP.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\NqQyCwx.exe
  C:\Windows\System\NqQyCwx.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\mqPMjOE.exe
  C:\Windows\System\mqPMjOE.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\Fctqahf.exe
  C:\Windows\System\Fctqahf.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\iZVJnej.exe
  C:\Windows\System\iZVJnej.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\OGjUKum.exe
  C:\Windows\System\OGjUKum.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\DdUUmDq.exe
  C:\Windows\System\DdUUmDq.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\NgdeIrc.exe
  C:\Windows\System\NgdeIrc.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\NJNXKIk.exe
  C:\Windows\System\NJNXKIk.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\gAReZHb.exe
  C:\Windows\System\gAReZHb.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\NlaQLUI.exe
  C:\Windows\System\NlaQLUI.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\xUmnPNB.exe
  C:\Windows\System\xUmnPNB.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\OFukeKg.exe
  C:\Windows\System\OFukeKg.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\PhBYCOa.exe
  C:\Windows\System\PhBYCOa.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\shiitBJ.exe
  C:\Windows\System\shiitBJ.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\VbnRDlI.exe
  C:\Windows\System\VbnRDlI.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\FMwoPud.exe
  C:\Windows\System\FMwoPud.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\CRXfvez.exe
  C:\Windows\System\CRXfvez.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\TQsZraA.exe
  C:\Windows\System\TQsZraA.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\RlqNWCH.exe
  C:\Windows\System\RlqNWCH.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\qfuDGLS.exe
  C:\Windows\System\qfuDGLS.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\psnBhkg.exe
  C:\Windows\System\psnBhkg.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\OLqHXmI.exe
  C:\Windows\System\OLqHXmI.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\DJwJgcE.exe
  C:\Windows\System\DJwJgcE.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\JvqjfoS.exe
  C:\Windows\System\JvqjfoS.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\LjTEYlg.exe
  C:\Windows\System\LjTEYlg.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\rmulSbo.exe
  C:\Windows\System\rmulSbo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\FhlIgwE.exe
  C:\Windows\System\FhlIgwE.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\zeXIeQD.exe
  C:\Windows\System\zeXIeQD.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\yBopFnz.exe
  C:\Windows\System\yBopFnz.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\FuceJmr.exe
  C:\Windows\System\FuceJmr.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\ibhDBvV.exe
  C:\Windows\System\ibhDBvV.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\qwuhHuw.exe
  C:\Windows\System\qwuhHuw.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\phxQhyX.exe
  C:\Windows\System\phxQhyX.exe
  2⤵
  PID:5200
- C:\Windows\System\vgGriBa.exe
  C:\Windows\System\vgGriBa.exe
  2⤵
  PID:5228
- C:\Windows\System\CtQOiNS.exe
  C:\Windows\System\CtQOiNS.exe
  2⤵
  PID:5260
- C:\Windows\System\ibyPzHH.exe
  C:\Windows\System\ibyPzHH.exe
  2⤵
  PID:5288
- C:\Windows\System\tgHqrxw.exe
  C:\Windows\System\tgHqrxw.exe
  2⤵
  PID:5320
- C:\Windows\System\mKGAixb.exe
  C:\Windows\System\mKGAixb.exe
  2⤵
  PID:5352
- C:\Windows\System\cCtClck.exe
  C:\Windows\System\cCtClck.exe
  2⤵
  PID:5380
- C:\Windows\System\IPfBHXy.exe
  C:\Windows\System\IPfBHXy.exe
  2⤵
  PID:5408
- C:\Windows\System\omsLFpE.exe
  C:\Windows\System\omsLFpE.exe
  2⤵
  PID:5440
- C:\Windows\System\jvIbjGg.exe
  C:\Windows\System\jvIbjGg.exe
  2⤵
  PID:5468
- C:\Windows\System\RoMJYle.exe
  C:\Windows\System\RoMJYle.exe
  2⤵
  PID:5492
- C:\Windows\System\xOOftbQ.exe
  C:\Windows\System\xOOftbQ.exe
  2⤵
  PID:5520
- C:\Windows\System\ZSozATT.exe
  C:\Windows\System\ZSozATT.exe
  2⤵
  PID:5548
- C:\Windows\System\rcWSsCY.exe
  C:\Windows\System\rcWSsCY.exe
  2⤵
  PID:5576
- C:\Windows\System\HZaovmR.exe
  C:\Windows\System\HZaovmR.exe
  2⤵
  PID:5604
- C:\Windows\System\qEfydFm.exe
  C:\Windows\System\qEfydFm.exe
  2⤵
  PID:5636
- C:\Windows\System\DiqkWwI.exe
  C:\Windows\System\DiqkWwI.exe
  2⤵
  PID:5660
- C:\Windows\System\QWeLJEz.exe
  C:\Windows\System\QWeLJEz.exe
  2⤵
  PID:5692
- C:\Windows\System\PbQxKlv.exe
  C:\Windows\System\PbQxKlv.exe
  2⤵
  PID:5720
- C:\Windows\System\snSafVu.exe
  C:\Windows\System\snSafVu.exe
  2⤵
  PID:5748
- C:\Windows\System\AExUZua.exe
  C:\Windows\System\AExUZua.exe
  2⤵
  PID:5776
- C:\Windows\System\KjjOfBk.exe
  C:\Windows\System\KjjOfBk.exe
  2⤵
  PID:5808
- C:\Windows\System\CsPTUXW.exe
  C:\Windows\System\CsPTUXW.exe
  2⤵
  PID:5832
- C:\Windows\System\fWDorhd.exe
  C:\Windows\System\fWDorhd.exe
  2⤵
  PID:5860
- C:\Windows\System\DQqshfC.exe
  C:\Windows\System\DQqshfC.exe
  2⤵
  PID:5888
- C:\Windows\System\LdtcbRX.exe
  C:\Windows\System\LdtcbRX.exe
  2⤵
  PID:5916
- C:\Windows\System\UDRKiXQ.exe
  C:\Windows\System\UDRKiXQ.exe
  2⤵
  PID:5952
- C:\Windows\System\EZcvjFL.exe
  C:\Windows\System\EZcvjFL.exe
  2⤵
  PID:5980
- C:\Windows\System\IairSyU.exe
  C:\Windows\System\IairSyU.exe
  2⤵
  PID:6000
- C:\Windows\System\EyeIphp.exe
  C:\Windows\System\EyeIphp.exe
  2⤵
  PID:6028
- C:\Windows\System\tLRhNhe.exe
  C:\Windows\System\tLRhNhe.exe
  2⤵
  PID:6056
- C:\Windows\System\LGnHjJR.exe
  C:\Windows\System\LGnHjJR.exe
  2⤵
  PID:6084
- C:\Windows\System\UdboVtA.exe
  C:\Windows\System\UdboVtA.exe
  2⤵
  PID:6112
- C:\Windows\System\qjEkwyy.exe
  C:\Windows\System\qjEkwyy.exe
  2⤵
  PID:6140
- C:\Windows\System\FTKIeYn.exe
  C:\Windows\System\FTKIeYn.exe
  2⤵
  PID:4172
- C:\Windows\System\wZssIFq.exe
  C:\Windows\System\wZssIFq.exe
  2⤵
  PID:3264
- C:\Windows\System\AHBqvBm.exe
  C:\Windows\System\AHBqvBm.exe
  2⤵
  PID:1188
- C:\Windows\System\HdyzPFe.exe
  C:\Windows\System\HdyzPFe.exe
  2⤵
  PID:1028
- C:\Windows\System\TdiQFJt.exe
  C:\Windows\System\TdiQFJt.exe
  2⤵
  PID:5112
- C:\Windows\System\gJvkNBI.exe
  C:\Windows\System\gJvkNBI.exe
  2⤵
  PID:3940
- C:\Windows\System\YTZuNeM.exe
  C:\Windows\System\YTZuNeM.exe
  2⤵
  PID:5164
- C:\Windows\System\KvianEi.exe
  C:\Windows\System\KvianEi.exe
  2⤵
  PID:5220
- C:\Windows\System\pOEBTSk.exe
  C:\Windows\System\pOEBTSk.exe
  2⤵
  PID:5256
- C:\Windows\System\lSxwPJl.exe
  C:\Windows\System\lSxwPJl.exe
  2⤵
  PID:5340
- C:\Windows\System\gdHRqVp.exe
  C:\Windows\System\gdHRqVp.exe
  2⤵
  PID:5396
- C:\Windows\System\FcLflVC.exe
  C:\Windows\System\FcLflVC.exe
  2⤵
  PID:5428
- C:\Windows\System\KCboKHk.exe
  C:\Windows\System\KCboKHk.exe
  2⤵
  PID:5488
- C:\Windows\System\uKyATDm.exe
  C:\Windows\System\uKyATDm.exe
  2⤵
  PID:5544
- C:\Windows\System\wSYIEiW.exe
  C:\Windows\System\wSYIEiW.exe
  2⤵
  PID:4528
- C:\Windows\System\hoGRMGh.exe
  C:\Windows\System\hoGRMGh.exe
  2⤵
  PID:4976
- C:\Windows\System\lZUNcCL.exe
  C:\Windows\System\lZUNcCL.exe
  2⤵
  PID:5684
- C:\Windows\System\xPBcbXr.exe
  C:\Windows\System\xPBcbXr.exe
  2⤵
  PID:5740
- C:\Windows\System\QTASVIb.exe
  C:\Windows\System\QTASVIb.exe
  2⤵
  PID:5816
- C:\Windows\System\SuqCqvk.exe
  C:\Windows\System\SuqCqvk.exe
  2⤵
  PID:4396
- C:\Windows\System\FlkZTth.exe
  C:\Windows\System\FlkZTth.exe
  2⤵
  PID:2856
- C:\Windows\System\eyQkywR.exe
  C:\Windows\System\eyQkywR.exe
  2⤵
  PID:5964
- C:\Windows\System\YtFxqHS.exe
  C:\Windows\System\YtFxqHS.exe
  2⤵
  PID:6020
- C:\Windows\System\jAbFHEV.exe
  C:\Windows\System\jAbFHEV.exe
  2⤵
  PID:668
- C:\Windows\System\UPUfVZG.exe
  C:\Windows\System\UPUfVZG.exe
  2⤵
  PID:6124
- C:\Windows\System\OfdsqOc.exe
  C:\Windows\System\OfdsqOc.exe
  2⤵
  PID:2968
- C:\Windows\System\dPBWZds.exe
  C:\Windows\System\dPBWZds.exe
  2⤵
  PID:4688
- C:\Windows\System\uFcjcpl.exe
  C:\Windows\System\uFcjcpl.exe
  2⤵
  PID:2780
- C:\Windows\System\LIOtljK.exe
  C:\Windows\System\LIOtljK.exe
  2⤵
  PID:5196
- C:\Windows\System\ggHDqJW.exe
  C:\Windows\System\ggHDqJW.exe
  2⤵
  PID:5368
- C:\Windows\System\YORfWlc.exe
  C:\Windows\System\YORfWlc.exe
  2⤵
  PID:5460
- C:\Windows\System\pzeoVhA.exe
  C:\Windows\System\pzeoVhA.exe
  2⤵
  PID:5592
- C:\Windows\System\EzGtIIx.exe
  C:\Windows\System\EzGtIIx.exe
  2⤵
  PID:5708
- C:\Windows\System\cVrDphA.exe
  C:\Windows\System\cVrDphA.exe
  2⤵
  PID:5848
- C:\Windows\System\XbpIliW.exe
  C:\Windows\System\XbpIliW.exe
  2⤵
  PID:5944
- C:\Windows\System\XpeFFnV.exe
  C:\Windows\System\XpeFFnV.exe
  2⤵
  PID:6096
- C:\Windows\System\sAqApOA.exe
  C:\Windows\System\sAqApOA.exe
  2⤵
  PID:3708
- C:\Windows\System\QzcUlIq.exe
  C:\Windows\System\QzcUlIq.exe
  2⤵
  PID:3380
- C:\Windows\System\rRniAdI.exe
  C:\Windows\System\rRniAdI.exe
  2⤵
  PID:5104
- C:\Windows\System\EiAJkJW.exe
  C:\Windows\System\EiAJkJW.exe
  2⤵
  PID:6172
- C:\Windows\System\FkpqMAW.exe
  C:\Windows\System\FkpqMAW.exe
  2⤵
  PID:6196
- C:\Windows\System\CLYCyft.exe
  C:\Windows\System\CLYCyft.exe
  2⤵
  PID:6228
- C:\Windows\System\YJgLeSk.exe
  C:\Windows\System\YJgLeSk.exe
  2⤵
  PID:6256
- C:\Windows\System\mPWmQrh.exe
  C:\Windows\System\mPWmQrh.exe
  2⤵
  PID:6284
- C:\Windows\System\ByLQoHQ.exe
  C:\Windows\System\ByLQoHQ.exe
  2⤵
  PID:6312
- C:\Windows\System\fnxBCFc.exe
  C:\Windows\System\fnxBCFc.exe
  2⤵
  PID:6340
- C:\Windows\System\BBQCZvZ.exe
  C:\Windows\System\BBQCZvZ.exe
  2⤵
  PID:6368
- C:\Windows\System\QVCcoQr.exe
  C:\Windows\System\QVCcoQr.exe
  2⤵
  PID:6396
- C:\Windows\System\NChePyz.exe
  C:\Windows\System\NChePyz.exe
  2⤵
  PID:6424
- C:\Windows\System\XmmvqkB.exe
  C:\Windows\System\XmmvqkB.exe
  2⤵
  PID:6452
- C:\Windows\System\OMGZydi.exe
  C:\Windows\System\OMGZydi.exe
  2⤵
  PID:6480
- C:\Windows\System\WsDGDFW.exe
  C:\Windows\System\WsDGDFW.exe
  2⤵
  PID:6508
- C:\Windows\System\vIeVDlg.exe
  C:\Windows\System\vIeVDlg.exe
  2⤵
  PID:6536
- C:\Windows\System\NMckpdL.exe
  C:\Windows\System\NMckpdL.exe
  2⤵
  PID:6564
- C:\Windows\System\iuLbfDo.exe
  C:\Windows\System\iuLbfDo.exe
  2⤵
  PID:6592
- C:\Windows\System\eoSjlMV.exe
  C:\Windows\System\eoSjlMV.exe
  2⤵
  PID:6616
- C:\Windows\System\uCnwzuf.exe
  C:\Windows\System\uCnwzuf.exe
  2⤵
  PID:6648
- C:\Windows\System\GSpZKBh.exe
  C:\Windows\System\GSpZKBh.exe
  2⤵
  PID:6676
- C:\Windows\System\ggqKBxY.exe
  C:\Windows\System\ggqKBxY.exe
  2⤵
  PID:6704
- C:\Windows\System\UQtsUaP.exe
  C:\Windows\System\UQtsUaP.exe
  2⤵
  PID:6732
- C:\Windows\System\euDsPsg.exe
  C:\Windows\System\euDsPsg.exe
  2⤵
  PID:6756
- C:\Windows\System\JjMZPic.exe
  C:\Windows\System\JjMZPic.exe
  2⤵
  PID:6784
- C:\Windows\System\rtYEbcP.exe
  C:\Windows\System\rtYEbcP.exe
  2⤵
  PID:6812
- C:\Windows\System\xWvfxbn.exe
  C:\Windows\System\xWvfxbn.exe
  2⤵
  PID:6892
- C:\Windows\System\gsKlfzp.exe
  C:\Windows\System\gsKlfzp.exe
  2⤵
  PID:6916
- C:\Windows\System\zGeNcmW.exe
  C:\Windows\System\zGeNcmW.exe
  2⤵
  PID:6932
- C:\Windows\System\RTyYSwq.exe
  C:\Windows\System\RTyYSwq.exe
  2⤵
  PID:6952
- C:\Windows\System\xaqtLSS.exe
  C:\Windows\System\xaqtLSS.exe
  2⤵
  PID:7024
- C:\Windows\System\SnhlMlh.exe
  C:\Windows\System\SnhlMlh.exe
  2⤵
  PID:7068
- C:\Windows\System\nAKxlHv.exe
  C:\Windows\System\nAKxlHv.exe
  2⤵
  PID:7116
- C:\Windows\System\RemcIHB.exe
  C:\Windows\System\RemcIHB.exe
  2⤵
  PID:7132
- C:\Windows\System\TcqIZCB.exe
  C:\Windows\System\TcqIZCB.exe
  2⤵
  PID:7156
- C:\Windows\System\EztCvDI.exe
  C:\Windows\System\EztCvDI.exe
  2⤵
  PID:5652
- C:\Windows\System\BsCZwle.exe
  C:\Windows\System\BsCZwle.exe
  2⤵
  PID:2544
- C:\Windows\System\cbdrWxV.exe
  C:\Windows\System\cbdrWxV.exe
  2⤵
  PID:4820
- C:\Windows\System\uYfRVTX.exe
  C:\Windows\System\uYfRVTX.exe
  2⤵
  PID:6160
- C:\Windows\System\MldZAXY.exe
  C:\Windows\System\MldZAXY.exe
  2⤵
  PID:6164
- C:\Windows\System\yeUnlhl.exe
  C:\Windows\System\yeUnlhl.exe
  2⤵
  PID:376
- C:\Windows\System\jACTxfx.exe
  C:\Windows\System\jACTxfx.exe
  2⤵
  PID:6272
- C:\Windows\System\yxMQlCs.exe
  C:\Windows\System\yxMQlCs.exe
  2⤵
  PID:6408
- C:\Windows\System\kHmkXCm.exe
  C:\Windows\System\kHmkXCm.exe
  2⤵
  PID:6448
- C:\Windows\System\iwyvzJN.exe
  C:\Windows\System\iwyvzJN.exe
  2⤵
  PID:6496
- C:\Windows\System\mUszDqX.exe
  C:\Windows\System\mUszDqX.exe
  2⤵
  PID:6548
- C:\Windows\System\ydXqwzJ.exe
  C:\Windows\System\ydXqwzJ.exe
  2⤵
  PID:6604
- C:\Windows\System\Meultwz.exe
  C:\Windows\System\Meultwz.exe
  2⤵
  PID:6664
- C:\Windows\System\icjabZG.exe
  C:\Windows\System\icjabZG.exe
  2⤵
  PID:6696
- C:\Windows\System\FgBvUAY.exe
  C:\Windows\System\FgBvUAY.exe
  2⤵
  PID:6748
- C:\Windows\System\xBwHixF.exe
  C:\Windows\System\xBwHixF.exe
  2⤵
  PID:1420
- C:\Windows\System\qkjtaCm.exe
  C:\Windows\System\qkjtaCm.exe
  2⤵
  PID:6840
- C:\Windows\System\Cotmpya.exe
  C:\Windows\System\Cotmpya.exe
  2⤵
  PID:6880
- C:\Windows\System\bgvzuIf.exe
  C:\Windows\System\bgvzuIf.exe
  2⤵
  PID:6888
- C:\Windows\System\IQmibLD.exe
  C:\Windows\System\IQmibLD.exe
  2⤵
  PID:6928
- C:\Windows\System\kqxldme.exe
  C:\Windows\System\kqxldme.exe
  2⤵
  PID:7000
- C:\Windows\System\lSwmHIP.exe
  C:\Windows\System\lSwmHIP.exe
  2⤵
  PID:1440
- C:\Windows\System\ZBDvGEh.exe
  C:\Windows\System\ZBDvGEh.exe
  2⤵
  PID:5940
- C:\Windows\System\KqSZVXL.exe
  C:\Windows\System\KqSZVXL.exe
  2⤵
  PID:4680
- C:\Windows\System\IbtsoMO.exe
  C:\Windows\System\IbtsoMO.exe
  2⤵
  PID:6048
- C:\Windows\System\EkZJfRC.exe
  C:\Windows\System\EkZJfRC.exe
  2⤵
  PID:2136
- C:\Windows\System\rcSekLS.exe
  C:\Windows\System\rcSekLS.exe
  2⤵
  PID:4548
- C:\Windows\System\dIDnvjD.exe
  C:\Windows\System\dIDnvjD.exe
  2⤵
  PID:4476
- C:\Windows\System\lKATcQh.exe
  C:\Windows\System\lKATcQh.exe
  2⤵
  PID:6240
- C:\Windows\System\wZtDTGT.exe
  C:\Windows\System\wZtDTGT.exe
  2⤵
  PID:6332
- C:\Windows\System\utouzEJ.exe
  C:\Windows\System\utouzEJ.exe
  2⤵
  PID:6612
- C:\Windows\System\DZUvyRP.exe
  C:\Windows\System\DZUvyRP.exe
  2⤵
  PID:6720
- C:\Windows\System\PWncdoz.exe
  C:\Windows\System\PWncdoz.exe
  2⤵
  PID:392
- C:\Windows\System\NiFmRFp.exe
  C:\Windows\System\NiFmRFp.exe
  2⤵
  PID:6884
- C:\Windows\System\aTEaeLU.exe
  C:\Windows\System\aTEaeLU.exe
  2⤵
  PID:7080
- C:\Windows\System\igloQma.exe
  C:\Windows\System\igloQma.exe
  2⤵
  PID:5040
- C:\Windows\System\AIieAeG.exe
  C:\Windows\System\AIieAeG.exe
  2⤵
  PID:5788
- C:\Windows\System\vFndMcc.exe
  C:\Windows\System\vFndMcc.exe
  2⤵
  PID:1764
- C:\Windows\System\ZePtDYC.exe
  C:\Windows\System\ZePtDYC.exe
  2⤵
  PID:1972
- C:\Windows\System\XiqRMEx.exe
  C:\Windows\System\XiqRMEx.exe
  2⤵
  PID:6528
- C:\Windows\System\dbNPVDY.exe
  C:\Windows\System\dbNPVDY.exe
  2⤵
  PID:5044
- C:\Windows\System\opoDPZt.exe
  C:\Windows\System\opoDPZt.exe
  2⤵
  PID:6912
- C:\Windows\System\zTOhotL.exe
  C:\Windows\System\zTOhotL.exe
  2⤵
  PID:1612
- C:\Windows\System\TVqzfUQ.exe
  C:\Windows\System\TVqzfUQ.exe
  2⤵
  PID:6364
- C:\Windows\System\EtTZhqN.exe
  C:\Windows\System\EtTZhqN.exe
  2⤵
  PID:7200
- C:\Windows\System\vFpeIOX.exe
  C:\Windows\System\vFpeIOX.exe
  2⤵
  PID:7268
- C:\Windows\System\JhColpu.exe
  C:\Windows\System\JhColpu.exe
  2⤵
  PID:7304
- C:\Windows\System\pTTyVMR.exe
  C:\Windows\System\pTTyVMR.exe
  2⤵
  PID:7324
- C:\Windows\System\kwyqVOQ.exe
  C:\Windows\System\kwyqVOQ.exe
  2⤵
  PID:7348
- C:\Windows\System\VAkSRDP.exe
  C:\Windows\System\VAkSRDP.exe
  2⤵
  PID:7368
- C:\Windows\System\cYmtwMe.exe
  C:\Windows\System\cYmtwMe.exe
  2⤵
  PID:7396
- C:\Windows\System\JgzWilx.exe
  C:\Windows\System\JgzWilx.exe
  2⤵
  PID:7420
- C:\Windows\System\MagNIKb.exe
  C:\Windows\System\MagNIKb.exe
  2⤵
  PID:7436
- C:\Windows\System\hKeEFQK.exe
  C:\Windows\System\hKeEFQK.exe
  2⤵
  PID:7484
- C:\Windows\System\ElrpROi.exe
  C:\Windows\System\ElrpROi.exe
  2⤵
  PID:7520
- C:\Windows\System\EgxmYdG.exe
  C:\Windows\System\EgxmYdG.exe
  2⤵
  PID:7544
- C:\Windows\System\esbOFHd.exe
  C:\Windows\System\esbOFHd.exe
  2⤵
  PID:7568
- C:\Windows\System\XXVQTOR.exe
  C:\Windows\System\XXVQTOR.exe
  2⤵
  PID:7584
- C:\Windows\System\dNkmhMD.exe
  C:\Windows\System\dNkmhMD.exe
  2⤵
  PID:7604
- C:\Windows\System\gsYvPin.exe
  C:\Windows\System\gsYvPin.exe
  2⤵
  PID:7624
- C:\Windows\System\KRbPzHi.exe
  C:\Windows\System\KRbPzHi.exe
  2⤵
  PID:7660
- C:\Windows\System\AKxOqdT.exe
  C:\Windows\System\AKxOqdT.exe
  2⤵
  PID:7708
- C:\Windows\System\rfeInvG.exe
  C:\Windows\System\rfeInvG.exe
  2⤵
  PID:7728
- C:\Windows\System\GgGyjDv.exe
  C:\Windows\System\GgGyjDv.exe
  2⤵
  PID:7764
- C:\Windows\System\aSXrApb.exe
  C:\Windows\System\aSXrApb.exe
  2⤵
  PID:7784
- C:\Windows\System\CfucXFT.exe
  C:\Windows\System\CfucXFT.exe
  2⤵
  PID:7824
- C:\Windows\System\wgifwSc.exe
  C:\Windows\System\wgifwSc.exe
  2⤵
  PID:7848
- C:\Windows\System\dltZcEM.exe
  C:\Windows\System\dltZcEM.exe
  2⤵
  PID:7868
- C:\Windows\System\MZFvORB.exe
  C:\Windows\System\MZFvORB.exe
  2⤵
  PID:7884
- C:\Windows\System\eeGajXy.exe
  C:\Windows\System\eeGajXy.exe
  2⤵
  PID:7920
- C:\Windows\System\LSLTUcw.exe
  C:\Windows\System\LSLTUcw.exe
  2⤵
  PID:7936
- C:\Windows\System\OaazsbF.exe
  C:\Windows\System\OaazsbF.exe
  2⤵
  PID:7972
- C:\Windows\System\WbRToUu.exe
  C:\Windows\System\WbRToUu.exe
  2⤵
  PID:8036
- C:\Windows\System\DFpvCFu.exe
  C:\Windows\System\DFpvCFu.exe
  2⤵
  PID:8052
- C:\Windows\System\fIdcSnC.exe
  C:\Windows\System\fIdcSnC.exe
  2⤵
  PID:8072
- C:\Windows\System\QVvYhNZ.exe
  C:\Windows\System\QVvYhNZ.exe
  2⤵
  PID:8088
- C:\Windows\System\YfGsTTI.exe
  C:\Windows\System\YfGsTTI.exe
  2⤵
  PID:8108
- C:\Windows\System\VAKeYCt.exe
  C:\Windows\System\VAKeYCt.exe
  2⤵
  PID:8160
- C:\Windows\System\fjrbFvu.exe
  C:\Windows\System\fjrbFvu.exe
  2⤵
  PID:8184
- C:\Windows\System\bJpqSTS.exe
  C:\Windows\System\bJpqSTS.exe
  2⤵
  PID:6688
- C:\Windows\System\HLyDJwE.exe
  C:\Windows\System\HLyDJwE.exe
  2⤵
  PID:4368
- C:\Windows\System\HynRLSQ.exe
  C:\Windows\System\HynRLSQ.exe
  2⤵
  PID:7220
- C:\Windows\System\IYNEQMM.exe
  C:\Windows\System\IYNEQMM.exe
  2⤵
  PID:7316
- C:\Windows\System\bkWTdcR.exe
  C:\Windows\System\bkWTdcR.exe
  2⤵
  PID:7360
- C:\Windows\System\DwvjUoG.exe
  C:\Windows\System\DwvjUoG.exe
  2⤵
  PID:7412
- C:\Windows\System\NDVzNVd.exe
  C:\Windows\System\NDVzNVd.exe
  2⤵
  PID:7472
- C:\Windows\System\GzDlttK.exe
  C:\Windows\System\GzDlttK.exe
  2⤵
  PID:7536
- C:\Windows\System\njeKiJB.exe
  C:\Windows\System\njeKiJB.exe
  2⤵
  PID:7656
- C:\Windows\System\gPoPpNB.exe
  C:\Windows\System\gPoPpNB.exe
  2⤵
  PID:7684
- C:\Windows\System\IESpwNc.exe
  C:\Windows\System\IESpwNc.exe
  2⤵
  PID:7748
- C:\Windows\System\DjwrEBQ.exe
  C:\Windows\System\DjwrEBQ.exe
  2⤵
  PID:7860
- C:\Windows\System\UhqqLmm.exe
  C:\Windows\System\UhqqLmm.exe
  2⤵
  PID:7908
- C:\Windows\System\MwFkqkJ.exe
  C:\Windows\System\MwFkqkJ.exe
  2⤵
  PID:7984
- C:\Windows\System\jOWmXVv.exe
  C:\Windows\System\jOWmXVv.exe
  2⤵
  PID:8020
- C:\Windows\System\bCygMFm.exe
  C:\Windows\System\bCygMFm.exe
  2⤵
  PID:8060
- C:\Windows\System\ySQpZJm.exe
  C:\Windows\System\ySQpZJm.exe
  2⤵
  PID:8120
- C:\Windows\System\BrlUDoH.exe
  C:\Windows\System\BrlUDoH.exe
  2⤵
  PID:8144
- C:\Windows\System\YhHDQmy.exe
  C:\Windows\System\YhHDQmy.exe
  2⤵
  PID:2684
- C:\Windows\System\mfUsSwK.exe
  C:\Windows\System\mfUsSwK.exe
  2⤵
  PID:1984
- C:\Windows\System\IVGvmgf.exe
  C:\Windows\System\IVGvmgf.exe
  2⤵
  PID:7596
- C:\Windows\System\wiPpWEF.exe
  C:\Windows\System\wiPpWEF.exe
  2⤵
  PID:7780
- C:\Windows\System\axhnPFK.exe
  C:\Windows\System\axhnPFK.exe
  2⤵
  PID:7928
- C:\Windows\System\JLRusoA.exe
  C:\Windows\System\JLRusoA.exe
  2⤵
  PID:7956
- C:\Windows\System\ZuHOmRp.exe
  C:\Windows\System\ZuHOmRp.exe
  2⤵
  PID:7380
- C:\Windows\System\pvuPosE.exe
  C:\Windows\System\pvuPosE.exe
  2⤵
  PID:6908
- C:\Windows\System\GJgkEBB.exe
  C:\Windows\System\GJgkEBB.exe
  2⤵
  PID:7516
- C:\Windows\System\wUfuclr.exe
  C:\Windows\System\wUfuclr.exe
  2⤵
  PID:7864
- C:\Windows\System\CYXGpGf.exe
  C:\Windows\System\CYXGpGf.exe
  2⤵
  PID:8068
- C:\Windows\System\jXSKCCr.exe
  C:\Windows\System\jXSKCCr.exe
  2⤵
  PID:8200
- C:\Windows\System\YIaBcwZ.exe
  C:\Windows\System\YIaBcwZ.exe
  2⤵
  PID:8224
- C:\Windows\System\CVEDBOk.exe
  C:\Windows\System\CVEDBOk.exe
  2⤵
  PID:8248
- C:\Windows\System\WrgYdQH.exe
  C:\Windows\System\WrgYdQH.exe
  2⤵
  PID:8268
- C:\Windows\System\YEpslyj.exe
  C:\Windows\System\YEpslyj.exe
  2⤵
  PID:8288
- C:\Windows\System\dqNgnHF.exe
  C:\Windows\System\dqNgnHF.exe
  2⤵
  PID:8308
- C:\Windows\System\iHqYZMy.exe
  C:\Windows\System\iHqYZMy.exe
  2⤵
  PID:8328
- C:\Windows\System\OYaVLvv.exe
  C:\Windows\System\OYaVLvv.exe
  2⤵
  PID:8368
- C:\Windows\System\MfLYpPN.exe
  C:\Windows\System\MfLYpPN.exe
  2⤵
  PID:8388
- C:\Windows\System\ZIzJTnJ.exe
  C:\Windows\System\ZIzJTnJ.exe
  2⤵
  PID:8420
- C:\Windows\System\CuMLmWB.exe
  C:\Windows\System\CuMLmWB.exe
  2⤵
  PID:8452
- C:\Windows\System\KEXhsrK.exe
  C:\Windows\System\KEXhsrK.exe
  2⤵
  PID:8484
- C:\Windows\System\rDvKQMv.exe
  C:\Windows\System\rDvKQMv.exe
  2⤵
  PID:8512
- C:\Windows\System\UJzcFxt.exe
  C:\Windows\System\UJzcFxt.exe
  2⤵
  PID:8540
- C:\Windows\System\MyKPOoq.exe
  C:\Windows\System\MyKPOoq.exe
  2⤵
  PID:8560
- C:\Windows\System\LOAMlgD.exe
  C:\Windows\System\LOAMlgD.exe
  2⤵
  PID:8624
- C:\Windows\System\LoiOBMD.exe
  C:\Windows\System\LoiOBMD.exe
  2⤵
  PID:8648
- C:\Windows\System\sacLMwe.exe
  C:\Windows\System\sacLMwe.exe
  2⤵
  PID:8672
- C:\Windows\System\OzMtcpr.exe
  C:\Windows\System\OzMtcpr.exe
  2⤵
  PID:8688
- C:\Windows\System\EPmrXCD.exe
  C:\Windows\System\EPmrXCD.exe
  2⤵
  PID:8712
- C:\Windows\System\gVNsjUI.exe
  C:\Windows\System\gVNsjUI.exe
  2⤵
  PID:8732
- C:\Windows\System\wKEUBbY.exe
  C:\Windows\System\wKEUBbY.exe
  2⤵
  PID:8768
- C:\Windows\System\SAkYnXJ.exe
  C:\Windows\System\SAkYnXJ.exe
  2⤵
  PID:8788
- C:\Windows\System\BixTSPO.exe
  C:\Windows\System\BixTSPO.exe
  2⤵
  PID:8808
- C:\Windows\System\QKnDSzd.exe
  C:\Windows\System\QKnDSzd.exe
  2⤵
  PID:8840
- C:\Windows\System\kzkVfWV.exe
  C:\Windows\System\kzkVfWV.exe
  2⤵
  PID:8892
- C:\Windows\System\gKWCajA.exe
  C:\Windows\System\gKWCajA.exe
  2⤵
  PID:8912
- C:\Windows\System\atcqsoJ.exe
  C:\Windows\System\atcqsoJ.exe
  2⤵
  PID:8944
- C:\Windows\System\XLMRhJd.exe
  C:\Windows\System\XLMRhJd.exe
  2⤵
  PID:8992
- C:\Windows\System\ZLSlolI.exe
  C:\Windows\System\ZLSlolI.exe
  2⤵
  PID:9020
- C:\Windows\System\jiKgauL.exe
  C:\Windows\System\jiKgauL.exe
  2⤵
  PID:9052
- C:\Windows\System\jBVAFGK.exe
  C:\Windows\System\jBVAFGK.exe
  2⤵
  PID:9080
- C:\Windows\System\OxswDPi.exe
  C:\Windows\System\OxswDPi.exe
  2⤵
  PID:9100
- C:\Windows\System\LHtzzgv.exe
  C:\Windows\System\LHtzzgv.exe
  2⤵
  PID:9120
- C:\Windows\System\XrwkBZs.exe
  C:\Windows\System\XrwkBZs.exe
  2⤵
  PID:9136
- C:\Windows\System\FHqcniB.exe
  C:\Windows\System\FHqcniB.exe
  2⤵
  PID:9196
- C:\Windows\System\rNdtBfo.exe
  C:\Windows\System\rNdtBfo.exe
  2⤵
  PID:8236
- C:\Windows\System\VEcWwPW.exe
  C:\Windows\System\VEcWwPW.exe
  2⤵
  PID:8264
- C:\Windows\System\AyvpsJw.exe
  C:\Windows\System\AyvpsJw.exe
  2⤵
  PID:8280
- C:\Windows\System\TABZFfM.exe
  C:\Windows\System\TABZFfM.exe
  2⤵
  PID:8376
- C:\Windows\System\PPTPjQf.exe
  C:\Windows\System\PPTPjQf.exe
  2⤵
  PID:8348
- C:\Windows\System\xWmdvya.exe
  C:\Windows\System\xWmdvya.exe
  2⤵
  PID:8508
- C:\Windows\System\AHSQbNX.exe
  C:\Windows\System\AHSQbNX.exe
  2⤵
  PID:8552
- C:\Windows\System\ODDuQPt.exe
  C:\Windows\System\ODDuQPt.exe
  2⤵
  PID:8588
- C:\Windows\System\PlyhCiq.exe
  C:\Windows\System\PlyhCiq.exe
  2⤵
  PID:8684
- C:\Windows\System\OkNWkiF.exe
  C:\Windows\System\OkNWkiF.exe
  2⤵
  PID:8664
- C:\Windows\System\lxedGcA.exe
  C:\Windows\System\lxedGcA.exe
  2⤵
  PID:8796
- C:\Windows\System\IFvPLIQ.exe
  C:\Windows\System\IFvPLIQ.exe
  2⤵
  PID:8856
- C:\Windows\System\EYcKXWa.exe
  C:\Windows\System\EYcKXWa.exe
  2⤵
  PID:8920
- C:\Windows\System\hWfYXIh.exe
  C:\Windows\System\hWfYXIh.exe
  2⤵
  PID:8980
- C:\Windows\System\FHnYhJb.exe
  C:\Windows\System\FHnYhJb.exe
  2⤵
  PID:9044
- C:\Windows\System\sqcWBSm.exe
  C:\Windows\System\sqcWBSm.exe
  2⤵
  PID:9116
- C:\Windows\System\ynPNeRx.exe
  C:\Windows\System\ynPNeRx.exe
  2⤵
  PID:9192
- C:\Windows\System\ZIkauBH.exe
  C:\Windows\System\ZIkauBH.exe
  2⤵
  PID:8444
- C:\Windows\System\yqgvEJR.exe
  C:\Windows\System\yqgvEJR.exe
  2⤵
  PID:8600
- C:\Windows\System\SCtPsZI.exe
  C:\Windows\System\SCtPsZI.exe
  2⤵
  PID:8632
- C:\Windows\System\xdmScVv.exe
  C:\Windows\System\xdmScVv.exe
  2⤵
  PID:8744
- C:\Windows\System\osPabeG.exe
  C:\Windows\System\osPabeG.exe
  2⤵
  PID:8748
- C:\Windows\System\DsVhIGx.exe
  C:\Windows\System\DsVhIGx.exe
  2⤵
  PID:9092
- C:\Windows\System\uQrOwPY.exe
  C:\Windows\System\uQrOwPY.exe
  2⤵
  PID:9212
- C:\Windows\System\PijPIra.exe
  C:\Windows\System\PijPIra.exe
  2⤵
  PID:8548
- C:\Windows\System\RVqSXcI.exe
  C:\Windows\System\RVqSXcI.exe
  2⤵
  PID:8800
- C:\Windows\System\bIECUeN.exe
  C:\Windows\System\bIECUeN.exe
  2⤵
  PID:9108
- C:\Windows\System\BWSOTyt.exe
  C:\Windows\System\BWSOTyt.exe
  2⤵
  PID:8532
- C:\Windows\System\jafpGgx.exe
  C:\Windows\System\jafpGgx.exe
  2⤵
  PID:8432
- C:\Windows\System\ParfZbd.exe
  C:\Windows\System\ParfZbd.exe
  2⤵
  PID:9228
- C:\Windows\System\YCTDheq.exe
  C:\Windows\System\YCTDheq.exe
  2⤵
  PID:9244
- C:\Windows\System\zfNWmlg.exe
  C:\Windows\System\zfNWmlg.exe
  2⤵
  PID:9292
- C:\Windows\System\AwclBbk.exe
  C:\Windows\System\AwclBbk.exe
  2⤵
  PID:9324
- C:\Windows\System\hYUrHiD.exe
  C:\Windows\System\hYUrHiD.exe
  2⤵
  PID:9344
- C:\Windows\System\skuSzJd.exe
  C:\Windows\System\skuSzJd.exe
  2⤵
  PID:9360
- C:\Windows\System\JxXyrXe.exe
  C:\Windows\System\JxXyrXe.exe
  2⤵
  PID:9388
- C:\Windows\System\UYPYBSM.exe
  C:\Windows\System\UYPYBSM.exe
  2⤵
  PID:9408
- C:\Windows\System\gxcvqSn.exe
  C:\Windows\System\gxcvqSn.exe
  2⤵
  PID:9428
- C:\Windows\System\lAwDpNp.exe
  C:\Windows\System\lAwDpNp.exe
  2⤵
  PID:9448
- C:\Windows\System\HvVDUih.exe
  C:\Windows\System\HvVDUih.exe
  2⤵
  PID:9468
- C:\Windows\System\vIYGkKX.exe
  C:\Windows\System\vIYGkKX.exe
  2⤵
  PID:9492
- C:\Windows\System\GorifGN.exe
  C:\Windows\System\GorifGN.exe
  2⤵
  PID:9540
- C:\Windows\System\KuYQwFv.exe
  C:\Windows\System\KuYQwFv.exe
  2⤵
  PID:9600
- C:\Windows\System\cdnenhk.exe
  C:\Windows\System\cdnenhk.exe
  2⤵
  PID:9616
- C:\Windows\System\KLYThMU.exe
  C:\Windows\System\KLYThMU.exe
  2⤵
  PID:9672
- C:\Windows\System\cFLPYMj.exe
  C:\Windows\System\cFLPYMj.exe
  2⤵
  PID:9692
- C:\Windows\System\qBkLErM.exe
  C:\Windows\System\qBkLErM.exe
  2⤵
  PID:9712
- C:\Windows\System\WwegjZt.exe
  C:\Windows\System\WwegjZt.exe
  2⤵
  PID:9736
- C:\Windows\System\IpDoXDu.exe
  C:\Windows\System\IpDoXDu.exe
  2⤵
  PID:9756
- C:\Windows\System\DOYGrQl.exe
  C:\Windows\System\DOYGrQl.exe
  2⤵
  PID:9804
- C:\Windows\System\LSfsoxQ.exe
  C:\Windows\System\LSfsoxQ.exe
  2⤵
  PID:9824
- C:\Windows\System\zATHDtr.exe
  C:\Windows\System\zATHDtr.exe
  2⤵
  PID:9840
- C:\Windows\System\yYcVifO.exe
  C:\Windows\System\yYcVifO.exe
  2⤵
  PID:9868
- C:\Windows\System\egvjbRK.exe
  C:\Windows\System\egvjbRK.exe
  2⤵
  PID:9884
- C:\Windows\System\iCbVwNj.exe
  C:\Windows\System\iCbVwNj.exe
  2⤵
  PID:9912
- C:\Windows\System\JjHklWy.exe
  C:\Windows\System\JjHklWy.exe
  2⤵
  PID:9948
- C:\Windows\System\LlbDIQe.exe
  C:\Windows\System\LlbDIQe.exe
  2⤵
  PID:9980
- C:\Windows\System\xOVAdWC.exe
  C:\Windows\System\xOVAdWC.exe
  2⤵
  PID:10016
- C:\Windows\System\KwjorNG.exe
  C:\Windows\System\KwjorNG.exe
  2⤵
  PID:10036
- C:\Windows\System\rXlNwmy.exe
  C:\Windows\System\rXlNwmy.exe
  2⤵
  PID:10056
- C:\Windows\System\cYwNjTY.exe
  C:\Windows\System\cYwNjTY.exe
  2⤵
  PID:10076
- C:\Windows\System\wocrifC.exe
  C:\Windows\System\wocrifC.exe
  2⤵
  PID:10100
- C:\Windows\System\XYqvMGy.exe
  C:\Windows\System\XYqvMGy.exe
  2⤵
  PID:10140
- C:\Windows\System\lkXGFVf.exe
  C:\Windows\System\lkXGFVf.exe
  2⤵
  PID:10168
- C:\Windows\System\Ptwueav.exe
  C:\Windows\System\Ptwueav.exe
  2⤵
  PID:10192
- C:\Windows\System\dnmIIkM.exe
  C:\Windows\System\dnmIIkM.exe
  2⤵
  PID:10208
- C:\Windows\System\DjFZAuR.exe
  C:\Windows\System\DjFZAuR.exe
  2⤵
  PID:10228
- C:\Windows\System\pxFtVYi.exe
  C:\Windows\System\pxFtVYi.exe
  2⤵
  PID:9220
- C:\Windows\System\MDZQsuI.exe
  C:\Windows\System\MDZQsuI.exe
  2⤵
  PID:9340
- C:\Windows\System\nswWXPd.exe
  C:\Windows\System\nswWXPd.exe
  2⤵
  PID:9404
- C:\Windows\System\QTyxoHV.exe
  C:\Windows\System\QTyxoHV.exe
  2⤵
  PID:9460
- C:\Windows\System\AVraYOT.exe
  C:\Windows\System\AVraYOT.exe
  2⤵
  PID:9532
- C:\Windows\System\NdxTpwy.exe
  C:\Windows\System\NdxTpwy.exe
  2⤵
  PID:9564
- C:\Windows\System\JdeJPTn.exe
  C:\Windows\System\JdeJPTn.exe
  2⤵
  PID:9640
- C:\Windows\System\jOEVoDn.exe
  C:\Windows\System\jOEVoDn.exe
  2⤵
  PID:9664
- C:\Windows\System\ynDuaoz.exe
  C:\Windows\System\ynDuaoz.exe
  2⤵
  PID:9720
- C:\Windows\System\NvkGwfr.exe
  C:\Windows\System\NvkGwfr.exe
  2⤵
  PID:9784
- C:\Windows\System\SIgmNEQ.exe
  C:\Windows\System\SIgmNEQ.exe
  2⤵
  PID:9836
- C:\Windows\System\bZumVHQ.exe
  C:\Windows\System\bZumVHQ.exe
  2⤵
  PID:9864
- C:\Windows\System\hkAmSgp.exe
  C:\Windows\System\hkAmSgp.exe
  2⤵
  PID:10068
- C:\Windows\System\qtVRKDJ.exe
  C:\Windows\System\qtVRKDJ.exe
  2⤵
  PID:10148
- C:\Windows\System\uwvDDHd.exe
  C:\Windows\System\uwvDDHd.exe
  2⤵
  PID:1664
- C:\Windows\System\RPssjTX.exe
  C:\Windows\System\RPssjTX.exe
  2⤵
  PID:9376
- C:\Windows\System\uIeNQci.exe
  C:\Windows\System\uIeNQci.exe
  2⤵
  PID:9612
- C:\Windows\System\zBUINMi.exe
  C:\Windows\System\zBUINMi.exe
  2⤵
  PID:9704
- C:\Windows\System\SGuwoEh.exe
  C:\Windows\System\SGuwoEh.exe
  2⤵
  PID:9576
- C:\Windows\System\KavuTPu.exe
  C:\Windows\System\KavuTPu.exe
  2⤵
  PID:9684
- C:\Windows\System\CZvuwtI.exe
  C:\Windows\System\CZvuwtI.exe
  2⤵
  PID:10276
- C:\Windows\System\VLonVau.exe
  C:\Windows\System\VLonVau.exe
  2⤵
  PID:10292
- C:\Windows\System\labnWJo.exe
  C:\Windows\System\labnWJo.exe
  2⤵
  PID:10308
- C:\Windows\System\OKVlyYp.exe
  C:\Windows\System\OKVlyYp.exe
  2⤵
  PID:10324
- C:\Windows\System\WebNsVY.exe
  C:\Windows\System\WebNsVY.exe
  2⤵
  PID:10340
- C:\Windows\System\oBfdllz.exe
  C:\Windows\System\oBfdllz.exe
  2⤵
  PID:10356
- C:\Windows\System\mDYZHqY.exe
  C:\Windows\System\mDYZHqY.exe
  2⤵
  PID:10376
- C:\Windows\System\cXddYMM.exe
  C:\Windows\System\cXddYMM.exe
  2⤵
  PID:10392
- C:\Windows\System\zdDItPe.exe
  C:\Windows\System\zdDItPe.exe
  2⤵
  PID:10408
- C:\Windows\System\vRrODJU.exe
  C:\Windows\System\vRrODJU.exe
  2⤵
  PID:10424
- C:\Windows\System\zIqovYx.exe
  C:\Windows\System\zIqovYx.exe
  2⤵
  PID:10440
- C:\Windows\System\lIaEiKF.exe
  C:\Windows\System\lIaEiKF.exe
  2⤵
  PID:10456
- C:\Windows\System\ZSbRnqs.exe
  C:\Windows\System\ZSbRnqs.exe
  2⤵
  PID:10472
- C:\Windows\System\CqCOUAi.exe
  C:\Windows\System\CqCOUAi.exe
  2⤵
  PID:10492
- C:\Windows\System\mwCQfab.exe
  C:\Windows\System\mwCQfab.exe
  2⤵
  PID:10516
- C:\Windows\System\VOZVAfk.exe
  C:\Windows\System\VOZVAfk.exe
  2⤵
  PID:10532
- C:\Windows\System\bZAFyZS.exe
  C:\Windows\System\bZAFyZS.exe
  2⤵
  PID:10556
- C:\Windows\System\fklWGIq.exe
  C:\Windows\System\fklWGIq.exe
  2⤵
  PID:10604
- C:\Windows\System\WbdyHqx.exe
  C:\Windows\System\WbdyHqx.exe
  2⤵
  PID:10632
- C:\Windows\System\AYScvrT.exe
  C:\Windows\System\AYScvrT.exe
  2⤵
  PID:10656
- C:\Windows\System\WxUdTRd.exe
  C:\Windows\System\WxUdTRd.exe
  2⤵
  PID:10676
- C:\Windows\System\RsoSRnd.exe
  C:\Windows\System\RsoSRnd.exe
  2⤵
  PID:10696
- C:\Windows\System\LiiqQsa.exe
  C:\Windows\System\LiiqQsa.exe
  2⤵
  PID:10792
- C:\Windows\System\gjKIgiZ.exe
  C:\Windows\System\gjKIgiZ.exe
  2⤵
  PID:10880
- C:\Windows\System\aUmplxd.exe
  C:\Windows\System\aUmplxd.exe
  2⤵
  PID:11048
- C:\Windows\System\INxoMvL.exe
  C:\Windows\System\INxoMvL.exe
  2⤵
  PID:11072
- C:\Windows\System\HLCiknK.exe
  C:\Windows\System\HLCiknK.exe
  2⤵
  PID:11100
- C:\Windows\System\seVQFYZ.exe
  C:\Windows\System\seVQFYZ.exe
  2⤵
  PID:11128
- C:\Windows\System\hqjwbGU.exe
  C:\Windows\System\hqjwbGU.exe
  2⤵
  PID:11152
- C:\Windows\System\pGigIRz.exe
  C:\Windows\System\pGigIRz.exe
  2⤵
  PID:11172
- C:\Windows\System\nnhlZBi.exe
  C:\Windows\System\nnhlZBi.exe
  2⤵
  PID:11188
- C:\Windows\System\xmyidVz.exe
  C:\Windows\System\xmyidVz.exe
  2⤵
  PID:11208
- C:\Windows\System\inhxglS.exe
  C:\Windows\System\inhxglS.exe
  2⤵
  PID:11228
- C:\Windows\System\SlCYTnV.exe
  C:\Windows\System\SlCYTnV.exe
  2⤵
  PID:11248
- C:\Windows\System\WNrlCbY.exe
  C:\Windows\System\WNrlCbY.exe
  2⤵
  PID:9592
- C:\Windows\System\YjgTlhb.exe
  C:\Windows\System\YjgTlhb.exe
  2⤵
  PID:9276
- C:\Windows\System\BMHoDIP.exe
  C:\Windows\System\BMHoDIP.exe
  2⤵
  PID:9260
- C:\Windows\System\UIXwaFq.exe
  C:\Windows\System\UIXwaFq.exe
  2⤵
  PID:10316
- C:\Windows\System\RYvKbeH.exe
  C:\Windows\System\RYvKbeH.exe
  2⤵
  PID:9940
- C:\Windows\System\FdfkbaI.exe
  C:\Windows\System\FdfkbaI.exe
  2⤵
  PID:10368
- C:\Windows\System\cLgMINi.exe
  C:\Windows\System\cLgMINi.exe
  2⤵
  PID:10420
- C:\Windows\System\dIjzcqb.exe
  C:\Windows\System\dIjzcqb.exe
  2⤵
  PID:10364
- C:\Windows\System\FTLMQLn.exe
  C:\Windows\System\FTLMQLn.exe
  2⤵
  PID:10468
- C:\Windows\System\NacAWDR.exe
  C:\Windows\System\NacAWDR.exe
  2⤵
  PID:10488
- C:\Windows\System\nPACcBd.exe
  C:\Windows\System\nPACcBd.exe
  2⤵
  PID:10612
- C:\Windows\System\SjEGQfg.exe
  C:\Windows\System\SjEGQfg.exe
  2⤵
  PID:10736
- C:\Windows\System\pxpvJFy.exe
  C:\Windows\System\pxpvJFy.exe
  2⤵
  PID:10652
- C:\Windows\System\QvZUZYq.exe
  C:\Windows\System\QvZUZYq.exe
  2⤵
  PID:10784
- C:\Windows\System\WmImkOn.exe
  C:\Windows\System\WmImkOn.exe
  2⤵
  PID:10704
- C:\Windows\System\GQQgZSj.exe
  C:\Windows\System\GQQgZSj.exe
  2⤵
  PID:10868
- C:\Windows\System\JetShWF.exe
  C:\Windows\System\JetShWF.exe
  2⤵
  PID:10944
- C:\Windows\System\UyaqkjM.exe
  C:\Windows\System\UyaqkjM.exe
  2⤵
  PID:10996
- C:\Windows\System\gQpPRbO.exe
  C:\Windows\System\gQpPRbO.exe
  2⤵
  PID:11092
- C:\Windows\System\DUrkrvo.exe
  C:\Windows\System\DUrkrvo.exe
  2⤵
  PID:11120
- C:\Windows\System\egtcwMC.exe
  C:\Windows\System\egtcwMC.exe
  2⤵
  PID:11196
- C:\Windows\System\DzvxxIa.exe
  C:\Windows\System\DzvxxIa.exe
  2⤵
  PID:11244
- C:\Windows\System\ZlxnJOj.exe
  C:\Windows\System\ZlxnJOj.exe
  2⤵
  PID:9780
- C:\Windows\System\SdYRcpb.exe
  C:\Windows\System\SdYRcpb.exe
  2⤵
  PID:1932
- C:\Windows\System\ZdkNckq.exe
  C:\Windows\System\ZdkNckq.exe
  2⤵
  PID:10332
- C:\Windows\System\XntyraY.exe
  C:\Windows\System\XntyraY.exe
  2⤵
  PID:8972
- C:\Windows\System\jzVZAqv.exe
  C:\Windows\System\jzVZAqv.exe
  2⤵
  PID:10512
- C:\Windows\System\jxXIaCp.exe
  C:\Windows\System\jxXIaCp.exe
  2⤵
  PID:10764
- C:\Windows\System\OCMabSB.exe
  C:\Windows\System\OCMabSB.exe
  2⤵
  PID:10904
- C:\Windows\System\uJbgJTg.exe
  C:\Windows\System\uJbgJTg.exe
  2⤵
  PID:11136
- C:\Windows\System\lZAmBkn.exe
  C:\Windows\System\lZAmBkn.exe
  2⤵
  PID:9752
- C:\Windows\System\GLNTDtI.exe
  C:\Windows\System\GLNTDtI.exe
  2⤵
  PID:10300
- C:\Windows\System\HgxQApN.exe
  C:\Windows\System\HgxQApN.exe
  2⤵
  PID:3492
- C:\Windows\System\IPWdpWn.exe
  C:\Windows\System\IPWdpWn.exe
  2⤵
  PID:10940
- C:\Windows\System\QCGZkPP.exe
  C:\Windows\System\QCGZkPP.exe
  2⤵
  PID:832
- C:\Windows\System\foIXQUB.exe
  C:\Windows\System\foIXQUB.exe
  2⤵
  PID:11112
- C:\Windows\System\YzGmCNM.exe
  C:\Windows\System\YzGmCNM.exe
  2⤵
  PID:3092
- C:\Windows\System\YUcRGwe.exe
  C:\Windows\System\YUcRGwe.exe
  2⤵
  PID:10448
- C:\Windows\System\SGgJxFn.exe
  C:\Windows\System\SGgJxFn.exe
  2⤵
  PID:11280
- C:\Windows\System\VefnmzR.exe
  C:\Windows\System\VefnmzR.exe
  2⤵
  PID:11300
- C:\Windows\System\TQxnOkI.exe
  C:\Windows\System\TQxnOkI.exe
  2⤵
  PID:11328
- C:\Windows\System\hDmhiQM.exe
  C:\Windows\System\hDmhiQM.exe
  2⤵
  PID:11356
- C:\Windows\System\zoRJaUv.exe
  C:\Windows\System\zoRJaUv.exe
  2⤵
  PID:11388
- C:\Windows\System\gZrlaYd.exe
  C:\Windows\System\gZrlaYd.exe
  2⤵
  PID:11408
- C:\Windows\System\HGbwxSN.exe
  C:\Windows\System\HGbwxSN.exe
  2⤵
  PID:11424
- C:\Windows\System\WVBlGvI.exe
  C:\Windows\System\WVBlGvI.exe
  2⤵
  PID:11448
- C:\Windows\System\qtjCyZe.exe
  C:\Windows\System\qtjCyZe.exe
  2⤵
  PID:11472
- C:\Windows\System\SuaVwea.exe
  C:\Windows\System\SuaVwea.exe
  2⤵
  PID:11520
- C:\Windows\System\WTVXfQB.exe
  C:\Windows\System\WTVXfQB.exe
  2⤵
  PID:11572
- C:\Windows\System\QBchfxB.exe
  C:\Windows\System\QBchfxB.exe
  2⤵
  PID:11588
- C:\Windows\System\ltOyvnq.exe
  C:\Windows\System\ltOyvnq.exe
  2⤵
  PID:11616
- C:\Windows\System\KQOPBsC.exe
  C:\Windows\System\KQOPBsC.exe
  2⤵
  PID:11644
- C:\Windows\System\xGiOyVD.exe
  C:\Windows\System\xGiOyVD.exe
  2⤵
  PID:11668
- C:\Windows\System\qaeijpS.exe
  C:\Windows\System\qaeijpS.exe
  2⤵
  PID:11688
- C:\Windows\System\OCftwhf.exe
  C:\Windows\System\OCftwhf.exe
  2⤵
  PID:11712
- C:\Windows\System\XzwDaQn.exe
  C:\Windows\System\XzwDaQn.exe
  2⤵
  PID:11732
- C:\Windows\System\tUazHZo.exe
  C:\Windows\System\tUazHZo.exe
  2⤵
  PID:11760
- C:\Windows\System\gKDTIHk.exe
  C:\Windows\System\gKDTIHk.exe
  2⤵
  PID:11780
- C:\Windows\System\ZyZWvtS.exe
  C:\Windows\System\ZyZWvtS.exe
  2⤵
  PID:11812
- C:\Windows\System\BIvtKOo.exe
  C:\Windows\System\BIvtKOo.exe
  2⤵
  PID:11828
- C:\Windows\System\PckucmD.exe
  C:\Windows\System\PckucmD.exe
  2⤵
  PID:11844
- C:\Windows\System\WXPxtYG.exe
  C:\Windows\System\WXPxtYG.exe
  2⤵
  PID:11864
- C:\Windows\System\fWoTHws.exe
  C:\Windows\System\fWoTHws.exe
  2⤵
  PID:11924
- C:\Windows\System\FYheATy.exe
  C:\Windows\System\FYheATy.exe
  2⤵
  PID:11948
- C:\Windows\System\oZDYVSG.exe
  C:\Windows\System\oZDYVSG.exe
  2⤵
  PID:11992
- C:\Windows\System\texetlW.exe
  C:\Windows\System\texetlW.exe
  2⤵
  PID:12012
- C:\Windows\System\XjwNsdI.exe
  C:\Windows\System\XjwNsdI.exe
  2⤵
  PID:12032
- C:\Windows\System\hMzNIqQ.exe
  C:\Windows\System\hMzNIqQ.exe
  2⤵
  PID:12052
- C:\Windows\System\UzjBBeT.exe
  C:\Windows\System\UzjBBeT.exe
  2⤵
  PID:12092
- C:\Windows\System\MzpWYQm.exe
  C:\Windows\System\MzpWYQm.exe
  2⤵
  PID:12112
- C:\Windows\System\PhOpYKQ.exe
  C:\Windows\System\PhOpYKQ.exe
  2⤵
  PID:12152
- C:\Windows\System\HCCXLri.exe
  C:\Windows\System\HCCXLri.exe
  2⤵
  PID:12180
- C:\Windows\System\fXJOnRJ.exe
  C:\Windows\System\fXJOnRJ.exe
  2⤵
  PID:12200
- C:\Windows\System\noOboee.exe
  C:\Windows\System\noOboee.exe
  2⤵
  PID:12236
- C:\Windows\System\PVNFjsP.exe
  C:\Windows\System\PVNFjsP.exe
  2⤵
  PID:12260
- C:\Windows\System\dAzLQzh.exe
  C:\Windows\System\dAzLQzh.exe
  2⤵
  PID:11236
- C:\Windows\System\KALvvQB.exe
  C:\Windows\System\KALvvQB.exe
  2⤵
  PID:11292
- C:\Windows\System\CxiwBYs.exe
  C:\Windows\System\CxiwBYs.exe
  2⤵
  PID:11312
- C:\Windows\System\iStZufV.exe
  C:\Windows\System\iStZufV.exe
  2⤵
  PID:11396
- C:\Windows\System\mGHtPVT.exe
  C:\Windows\System\mGHtPVT.exe
  2⤵
  PID:11432
- C:\Windows\System\etCgSUk.exe
  C:\Windows\System\etCgSUk.exe
  2⤵
  PID:11488
- C:\Windows\System\MAICsQG.exe
  C:\Windows\System\MAICsQG.exe
  2⤵
  PID:11568
- C:\Windows\System\QbBBCxF.exe
  C:\Windows\System\QbBBCxF.exe
  2⤵
  PID:11584
- C:\Windows\System\GlwjWyZ.exe
  C:\Windows\System\GlwjWyZ.exe
  2⤵
  PID:11664
- C:\Windows\System\eUPhIFf.exe
  C:\Windows\System\eUPhIFf.exe
  2⤵
  PID:11768
- C:\Windows\System\ZnHKPsT.exe
  C:\Windows\System\ZnHKPsT.exe
  2⤵
  PID:11728
- C:\Windows\System\wNBjsYW.exe
  C:\Windows\System\wNBjsYW.exe
  2⤵
  PID:11884
- C:\Windows\System\kVOsmjb.exe
  C:\Windows\System\kVOsmjb.exe
  2⤵
  PID:11820
- C:\Windows\System\NjflPfH.exe
  C:\Windows\System\NjflPfH.exe
  2⤵
  PID:11944
- C:\Windows\System\BOVDgdq.exe
  C:\Windows\System\BOVDgdq.exe
  2⤵
  PID:12072
- C:\Windows\System\xifHTTB.exe
  C:\Windows\System\xifHTTB.exe
  2⤵
  PID:12176
- C:\Windows\System\jSFOxKI.exe
  C:\Windows\System\jSFOxKI.exe
  2⤵
  PID:4408
- C:\Windows\System\CBvHyVI.exe
  C:\Windows\System\CBvHyVI.exe
  2⤵
  PID:11444
- C:\Windows\System\vAJTPlS.exe
  C:\Windows\System\vAJTPlS.exe
  2⤵
  PID:11696
- C:\Windows\System\cLtJDUM.exe
  C:\Windows\System\cLtJDUM.exe
  2⤵
  PID:11836
- C:\Windows\System\apSevhw.exe
  C:\Windows\System\apSevhw.exe
  2⤵
  PID:11916
- C:\Windows\System\NiyMBPl.exe
  C:\Windows\System\NiyMBPl.exe
  2⤵
  PID:12020
- C:\Windows\System\pPrvRMY.exe
  C:\Windows\System\pPrvRMY.exe
  2⤵
  PID:11704
- C:\Windows\System\bfEmLnW.exe
  C:\Windows\System\bfEmLnW.exe
  2⤵
  PID:5048
- C:\Windows\System\uZMfRST.exe
  C:\Windows\System\uZMfRST.exe
  2⤵
  PID:12232
- C:\Windows\System\JZXnveT.exe
  C:\Windows\System\JZXnveT.exe
  2⤵
  PID:12272
- C:\Windows\System\tOiuLsN.exe
  C:\Windows\System\tOiuLsN.exe
  2⤵
  PID:11752
- C:\Windows\System\UtSSikW.exe
  C:\Windows\System\UtSSikW.exe
  2⤵
  PID:11268
- C:\Windows\System\CNKrRKJ.exe
  C:\Windows\System\CNKrRKJ.exe
  2⤵
  PID:12324
- C:\Windows\System\DsbQRjW.exe
  C:\Windows\System\DsbQRjW.exe
  2⤵
  PID:12348
- C:\Windows\System\EgzSofd.exe
  C:\Windows\System\EgzSofd.exe
  2⤵
  PID:12392
- C:\Windows\System\BuRnDIG.exe
  C:\Windows\System\BuRnDIG.exe
  2⤵
  PID:12408
- C:\Windows\System\MsWzbgg.exe
  C:\Windows\System\MsWzbgg.exe
  2⤵
  PID:12432
- C:\Windows\System\UjZwzvd.exe
  C:\Windows\System\UjZwzvd.exe
  2⤵
  PID:12452
- C:\Windows\System\gdTygSI.exe
  C:\Windows\System\gdTygSI.exe
  2⤵
  PID:12472
- C:\Windows\System\cIhHyqz.exe
  C:\Windows\System\cIhHyqz.exe
  2⤵
  PID:12504
- C:\Windows\System\bHXQgRp.exe
  C:\Windows\System\bHXQgRp.exe
  2⤵
  PID:12524
- C:\Windows\System\gjbqiVR.exe
  C:\Windows\System\gjbqiVR.exe
  2⤵
  PID:12544
- C:\Windows\System\wweoIsd.exe
  C:\Windows\System\wweoIsd.exe
  2⤵
  PID:12568
- C:\Windows\System\lOnNyMH.exe
  C:\Windows\System\lOnNyMH.exe
  2⤵
  PID:12584
- C:\Windows\System\XqSNDcT.exe
  C:\Windows\System\XqSNDcT.exe
  2⤵
  PID:12608
- C:\Windows\System\VpdlwCC.exe
  C:\Windows\System\VpdlwCC.exe
  2⤵
  PID:12628
- C:\Windows\System\GVgltyc.exe
  C:\Windows\System\GVgltyc.exe
  2⤵
  PID:12708
- C:\Windows\System\tPHJVrr.exe
  C:\Windows\System\tPHJVrr.exe
  2⤵
  PID:12744
- C:\Windows\System\hbaypJM.exe
  C:\Windows\System\hbaypJM.exe
  2⤵
  PID:12768
- C:\Windows\System\XqkaKeJ.exe
  C:\Windows\System\XqkaKeJ.exe
  2⤵
  PID:12784
- C:\Windows\System\aAumLSJ.exe
  C:\Windows\System\aAumLSJ.exe
  2⤵
  PID:12812
- C:\Windows\System\ptyrhXg.exe
  C:\Windows\System\ptyrhXg.exe
  2⤵
  PID:12832
- C:\Windows\System\SQNkjyF.exe
  C:\Windows\System\SQNkjyF.exe
  2⤵
  PID:12876
- C:\Windows\System\mpijMDX.exe
  C:\Windows\System\mpijMDX.exe
  2⤵
  PID:12908
- C:\Windows\System\MpaSYBy.exe
  C:\Windows\System\MpaSYBy.exe
  2⤵
  PID:12936
- C:\Windows\System\zjjEMAD.exe
  C:\Windows\System\zjjEMAD.exe
  2⤵
  PID:12956
- C:\Windows\System\iKoWmTJ.exe
  C:\Windows\System\iKoWmTJ.exe
  2⤵
  PID:12996
- C:\Windows\System\rCQgQYw.exe
  C:\Windows\System\rCQgQYw.exe
  2⤵
  PID:13016
- C:\Windows\System\OXydZuI.exe
  C:\Windows\System\OXydZuI.exe
  2⤵
  PID:13036
- C:\Windows\System\HayvBlV.exe
  C:\Windows\System\HayvBlV.exe
  2⤵
  PID:13064
- C:\Windows\System\HkOcNBG.exe
  C:\Windows\System\HkOcNBG.exe
  2⤵
  PID:13096
- C:\Windows\System\fYKAsPx.exe
  C:\Windows\System\fYKAsPx.exe
  2⤵
  PID:13120
- C:\Windows\System\cSmOdIZ.exe
  C:\Windows\System\cSmOdIZ.exe
  2⤵
  PID:13136
- C:\Windows\System\AmnJdrw.exe
  C:\Windows\System\AmnJdrw.exe
  2⤵
  PID:13156
- C:\Windows\System\TWmboEH.exe
  C:\Windows\System\TWmboEH.exe
  2⤵
  PID:13176
- C:\Windows\System\WQatcpU.exe
  C:\Windows\System\WQatcpU.exe
  2⤵
  PID:13208
- C:\Windows\System\qEGgqMq.exe
  C:\Windows\System\qEGgqMq.exe
  2⤵
  PID:12340
- C:\Windows\System\RnlcFAk.exe
  C:\Windows\System\RnlcFAk.exe
  2⤵
  PID:12296
- C:\Windows\System\JylHqZK.exe
  C:\Windows\System\JylHqZK.exe
  2⤵
  PID:11084
- C:\Windows\System\FCvtXWJ.exe
  C:\Windows\System\FCvtXWJ.exe
  2⤵
  PID:6092
- C:\Windows\System\FlNfNHD.exe
  C:\Windows\System\FlNfNHD.exe
  2⤵
  PID:11384
- C:\Windows\System\wxChdiM.exe
  C:\Windows\System\wxChdiM.exe
  2⤵
  PID:12380
- C:\Windows\System\LasSrhM.exe
  C:\Windows\System\LasSrhM.exe
  2⤵
  PID:12440
- C:\Windows\System\llQsRMs.exe
  C:\Windows\System\llQsRMs.exe
  2⤵
  PID:12496
- C:\Windows\System\OCNykig.exe
  C:\Windows\System\OCNykig.exe
  2⤵
  PID:12540
- C:\Windows\System\NoTyOwt.exe
  C:\Windows\System\NoTyOwt.exe
  2⤵
  PID:12596
- C:\Windows\System\CAsUSBP.exe
  C:\Windows\System\CAsUSBP.exe
  2⤵
  PID:12928
- C:\Windows\System\LamGLlT.exe
  C:\Windows\System\LamGLlT.exe
  2⤵
  PID:2884
- C:\Windows\System\gSOUKvt.exe
  C:\Windows\System\gSOUKvt.exe
  2⤵
  PID:13044
- C:\Windows\System\YrSvzzB.exe
  C:\Windows\System\YrSvzzB.exe
  2⤵
  PID:13088
- C:\Windows\System\pFiXUSO.exe
  C:\Windows\System\pFiXUSO.exe
  2⤵
  PID:13172
- C:\Windows\System\OyQuFdj.exe
  C:\Windows\System\OyQuFdj.exe
  2⤵
  PID:13244
- C:\Windows\System\ATxaGTn.exe
  C:\Windows\System\ATxaGTn.exe
  2⤵
  PID:13280
- C:\Windows\System\hcHYiKq.exe
  C:\Windows\System\hcHYiKq.exe
  2⤵
  PID:12344
- C:\Windows\System\byJehGY.exe
  C:\Windows\System\byJehGY.exe
  2⤵
  PID:12404
- C:\Windows\System\sNfpWwd.exe
  C:\Windows\System\sNfpWwd.exe
  2⤵
  PID:12824
- C:\Windows\System\UneoEVA.exe
  C:\Windows\System\UneoEVA.exe
  2⤵
  PID:4500
- C:\Windows\System\AzHnSCI.exe
  C:\Windows\System\AzHnSCI.exe
  2⤵
  PID:13008
- C:\Windows\System\WIKTQfa.exe
  C:\Windows\System\WIKTQfa.exe
  2⤵
  PID:12972
- C:\Windows\System\zERrhvM.exe
  C:\Windows\System\zERrhvM.exe
  2⤵
  PID:4432
- C:\Windows\System\uMOmpLe.exe
  C:\Windows\System\uMOmpLe.exe
  2⤵
  PID:2860
- C:\Windows\System\VQXjggc.exe
  C:\Windows\System\VQXjggc.exe
  2⤵
  PID:3036
- C:\Windows\System\uGaGSPf.exe
  C:\Windows\System\uGaGSPf.exe
  2⤵
  PID:6376
- C:\Windows\System\atIrOhL.exe
  C:\Windows\System\atIrOhL.exe
  2⤵
  PID:13076
- C:\Windows\System\VYtslLG.exe
  C:\Windows\System\VYtslLG.exe
  2⤵
  PID:13060
- C:\Windows\System\mHNkpCK.exe
  C:\Windows\System\mHNkpCK.exe
  2⤵
  PID:7040
- C:\Windows\System\zkZyWMa.exe
  C:\Windows\System\zkZyWMa.exe
  2⤵
  PID:4352
- C:\Windows\System\aIytCtR.exe
  C:\Windows\System\aIytCtR.exe
  2⤵
  PID:4764
- C:\Windows\System\HtdHrdV.exe
  C:\Windows\System\HtdHrdV.exe
  2⤵
  PID:12636
- C:\Windows\System\wNlpHsB.exe
  C:\Windows\System\wNlpHsB.exe
  2⤵
  PID:12304
- C:\Windows\System\MvGPHUp.exe
  C:\Windows\System\MvGPHUp.exe
  2⤵
  PID:2264
- C:\Windows\System\zlSwzpb.exe
  C:\Windows\System\zlSwzpb.exe
  2⤵
  PID:5876
- C:\Windows\System\vmzxCRQ.exe
  C:\Windows\System\vmzxCRQ.exe
  2⤵
  PID:11080
- C:\Windows\System\BFsSbEV.exe
  C:\Windows\System\BFsSbEV.exe
  2⤵
  PID:13104
- C:\Windows\System\cJShuVG.exe
  C:\Windows\System\cJShuVG.exe
  2⤵
  PID:12600
- C:\Windows\System\jbqEkjb.exe
  C:\Windows\System\jbqEkjb.exe
  2⤵
  PID:5928
- C:\Windows\System\zDUWitB.exe
  C:\Windows\System\zDUWitB.exe
  2⤵
  PID:6120
- C:\Windows\System\pkwwoqX.exe
  C:\Windows\System\pkwwoqX.exe
  2⤵
  PID:12424
- C:\Windows\System\fOYLBEn.exe
  C:\Windows\System\fOYLBEn.exe
  2⤵
  PID:12448
- C:\Windows\System\lZkQvSo.exe
  C:\Windows\System\lZkQvSo.exe
  2⤵
  PID:4760
- C:\Windows\System\LsQndYS.exe
  C:\Windows\System\LsQndYS.exe
  2⤵
  PID:12688
- C:\Windows\System\kDndMUf.exe
  C:\Windows\System\kDndMUf.exe
  2⤵
  PID:6352
- C:\Windows\System\FazQIam.exe
  C:\Windows\System\FazQIam.exe
  2⤵
  PID:13152
- C:\Windows\System\iDUiydw.exe
  C:\Windows\System\iDUiydw.exe
  2⤵
  PID:624
- C:\Windows\System\zRLkGZx.exe
  C:\Windows\System\zRLkGZx.exe
  2⤵
  PID:3516
- C:\Windows\System\tiCrRuc.exe
  C:\Windows\System\tiCrRuc.exe
  2⤵
  PID:912
- C:\Windows\System\dJyHuJM.exe
  C:\Windows\System\dJyHuJM.exe
  2⤵
  PID:13268
- C:\Windows\System\euZxdXM.exe
  C:\Windows\System\euZxdXM.exe
  2⤵
  PID:12780
- C:\Windows\System\mlIfkyo.exe
  C:\Windows\System\mlIfkyo.exe
  2⤵
  PID:12736
- C:\Windows\System\PwcCdSm.exe
  C:\Windows\System\PwcCdSm.exe
  2⤵
  PID:12756
- C:\Windows\System\mKwIuax.exe
  C:\Windows\System\mKwIuax.exe
  2⤵
  PID:12516
- C:\Windows\System\PZHOGxJ.exe
  C:\Windows\System\PZHOGxJ.exe
  2⤵
  PID:12556
- C:\Windows\System\nVddMDR.exe
  C:\Windows\System\nVddMDR.exe
  2⤵
  PID:1552
- C:\Windows\System\ACmzccu.exe
  C:\Windows\System\ACmzccu.exe
  2⤵
  PID:13340
- C:\Windows\System\tAPhQRK.exe
  C:\Windows\System\tAPhQRK.exe
  2⤵
  PID:13356
- C:\Windows\System\uXoiJtT.exe
  C:\Windows\System\uXoiJtT.exe
  2⤵
  PID:13372
- C:\Windows\System\QPTpVQL.exe
  C:\Windows\System\QPTpVQL.exe
  2⤵
  PID:13388
- C:\Windows\System\cYMdmqU.exe
  C:\Windows\System\cYMdmqU.exe
  2⤵
  PID:13404
- C:\Windows\System\poJaFKn.exe
  C:\Windows\System\poJaFKn.exe
  2⤵
  PID:13420
- C:\Windows\System\kLJEJGX.exe
  C:\Windows\System\kLJEJGX.exe
  2⤵
  PID:13440
- C:\Windows\System\sqhZMdR.exe
  C:\Windows\System\sqhZMdR.exe
  2⤵
  PID:13480
- C:\Windows\System\NbLdxrl.exe
  C:\Windows\System\NbLdxrl.exe
  2⤵
  PID:13508
- C:\Windows\System\rKJwjes.exe
  C:\Windows\System\rKJwjes.exe
  2⤵
  PID:13556
- C:\Windows\System\WEedHGL.exe
  C:\Windows\System\WEedHGL.exe
  2⤵
  PID:13572
- C:\Windows\System\xskOzFy.exe
  C:\Windows\System\xskOzFy.exe
  2⤵
  PID:13588
- C:\Windows\System\swCkRHT.exe
  C:\Windows\System\swCkRHT.exe
  2⤵
  PID:13632
- C:\Windows\System\dOOMQvJ.exe
  C:\Windows\System\dOOMQvJ.exe
  2⤵
  PID:13788
- C:\Windows\System\ODfbJSj.exe
  C:\Windows\System\ODfbJSj.exe
  2⤵
  PID:13808
- C:\Windows\System\tbFwzYd.exe
  C:\Windows\System\tbFwzYd.exe
  2⤵
  PID:13824
- C:\Windows\System\vxcMojC.exe
  C:\Windows\System\vxcMojC.exe
  2⤵
  PID:13888
- C:\Windows\System\TTsSLPd.exe
  C:\Windows\System\TTsSLPd.exe
  2⤵
  PID:13904
- C:\Windows\System\NwgJoWw.exe
  C:\Windows\System\NwgJoWw.exe
  2⤵
  PID:13924
- C:\Windows\System\IZzncEh.exe
  C:\Windows\System\IZzncEh.exe
  2⤵
  PID:13940
- C:\Windows\System\cPdoZdw.exe
  C:\Windows\System\cPdoZdw.exe
  2⤵
  PID:13956
- C:\Windows\System\bBUHOJi.exe
  C:\Windows\System\bBUHOJi.exe
  2⤵
  PID:13976
- C:\Windows\System\qeKwzKe.exe
  C:\Windows\System\qeKwzKe.exe
  2⤵
  PID:14024
- C:\Windows\System\YEVHPpZ.exe
  C:\Windows\System\YEVHPpZ.exe
  2⤵
  PID:14040
- C:\Windows\System\XtvuSAI.exe
  C:\Windows\System\XtvuSAI.exe
  2⤵
  PID:14056
- C:\Windows\System\UZOuNxC.exe
  C:\Windows\System\UZOuNxC.exe
  2⤵
  PID:14096
- C:\Windows\System\ylcqwtE.exe
  C:\Windows\System\ylcqwtE.exe
  2⤵
  PID:14112
- C:\Windows\System\OjYbTzs.exe
  C:\Windows\System\OjYbTzs.exe
  2⤵
  PID:14144
- C:\Windows\System\NWrOben.exe
  C:\Windows\System\NWrOben.exe
  2⤵
  PID:14260
- C:\Windows\System\hIsdJBx.exe
  C:\Windows\System\hIsdJBx.exe
  2⤵
  PID:14284
- C:\Windows\System\ZWWXrzK.exe
  C:\Windows\System\ZWWXrzK.exe
  2⤵
  PID:14304
- C:\Windows\System\XppWbxz.exe
  C:\Windows\System\XppWbxz.exe
  2⤵
  PID:14320
- C:\Windows\System\MRKOUCB.exe
  C:\Windows\System\MRKOUCB.exe
  2⤵
  PID:2028
- C:\Windows\System\SmwaLxw.exe
  C:\Windows\System\SmwaLxw.exe
  2⤵
  PID:4568
- C:\Windows\System\dtLUDGM.exe
  C:\Windows\System\dtLUDGM.exe
  2⤵
  PID:5976
- C:\Windows\System\DFVNBge.exe
  C:\Windows\System\DFVNBge.exe
  2⤵
  PID:13276
- C:\Windows\System\LQxYrxu.exe
  C:\Windows\System\LQxYrxu.exe
  2⤵
  PID:2096
- C:\Windows\System\mSDUpil.exe
  C:\Windows\System\mSDUpil.exe
  2⤵
  PID:4068
- C:\Windows\System\iXvuWRa.exe
  C:\Windows\System\iXvuWRa.exe
  2⤵
  PID:12728
- C:\Windows\System\nfaWalQ.exe
  C:\Windows\System\nfaWalQ.exe
  2⤵
  PID:12804
- C:\Windows\System\WfQpsfb.exe
  C:\Windows\System\WfQpsfb.exe
  2⤵
  PID:4604
- C:\Windows\System\bCKuisk.exe
  C:\Windows\System\bCKuisk.exe
  2⤵
  PID:2740
- C:\Windows\System\CunYqtt.exe
  C:\Windows\System\CunYqtt.exe
  2⤵
  PID:2140
- C:\Windows\System\lPYRtdm.exe
  C:\Windows\System\lPYRtdm.exe
  2⤵
  PID:12620
- C:\Windows\System\rbMjOxc.exe
  C:\Windows\System\rbMjOxc.exe
  2⤵
  PID:13032
- C:\Windows\System\peoELGJ.exe
  C:\Windows\System\peoELGJ.exe
  2⤵
  PID:3784
- C:\Windows\System\WcjnOGe.exe
  C:\Windows\System\WcjnOGe.exe
  2⤵
  PID:13320
- C:\Windows\System\bHMqExk.exe
  C:\Windows\System\bHMqExk.exe
  2⤵
  PID:1964
- C:\Windows\System\WxneNEW.exe
  C:\Windows\System\WxneNEW.exe
  2⤵
  PID:13352
- C:\Windows\System\tWljCXM.exe
  C:\Windows\System\tWljCXM.exe
  2⤵
  PID:13384
- C:\Windows\System\rpbDNgu.exe
  C:\Windows\System\rpbDNgu.exe
  2⤵
  PID:2756
- C:\Windows\System\RDyiFnM.exe
  C:\Windows\System\RDyiFnM.exe
  2⤵
  PID:2652
- C:\Windows\System\AivuqPr.exe
  C:\Windows\System\AivuqPr.exe
  2⤵
  PID:3956
- C:\Windows\System\WwdsIot.exe
  C:\Windows\System\WwdsIot.exe
  2⤵
  PID:13476
- C:\Windows\System\NwxoVio.exe
  C:\Windows\System\NwxoVio.exe
  2⤵
  PID:13540
- C:\Windows\System\PbvPoGS.exe
  C:\Windows\System\PbvPoGS.exe
  2⤵
  PID:6556
- C:\Windows\System\FYDSCBa.exe
  C:\Windows\System\FYDSCBa.exe
  2⤵
  PID:3156
- C:\Windows\System\kRutIAC.exe
  C:\Windows\System\kRutIAC.exe
  2⤵
  PID:13580
- C:\Windows\System\guQhIZH.exe
  C:\Windows\System\guQhIZH.exe
  2⤵
  PID:13596
- C:\Windows\System\nPQlKTt.exe
  C:\Windows\System\nPQlKTt.exe
  2⤵
  PID:13608
- C:\Windows\System\ORAsyew.exe
  C:\Windows\System\ORAsyew.exe
  2⤵
  PID:13644
- C:\Windows\System\xtDXfML.exe
  C:\Windows\System\xtDXfML.exe
  2⤵
  PID:3656
- C:\Windows\System\bQbLWlU.exe
  C:\Windows\System\bQbLWlU.exe
  2⤵
  PID:3356
- C:\Windows\System\ZqKlvkN.exe
  C:\Windows\System\ZqKlvkN.exe
  2⤵
  PID:13504
- C:\Windows\System\lechiet.exe
  C:\Windows\System\lechiet.exe
  2⤵
  PID:13500
- C:\Windows\System\EhcltLP.exe
  C:\Windows\System\EhcltLP.exe
  2⤵
  PID:4440
- C:\Windows\System\XGdWazB.exe
  C:\Windows\System\XGdWazB.exe
  2⤵
  PID:13740
- C:\Windows\System\kauUkAp.exe
  C:\Windows\System\kauUkAp.exe
  2⤵
  PID:6960
- C:\Windows\System\sSSzXom.exe
  C:\Windows\System\sSSzXom.exe
  2⤵
  PID:5792
- C:\Windows\System\SZKCopn.exe
  C:\Windows\System\SZKCopn.exe
  2⤵
  PID:7108
- C:\Windows\System\DpssSvn.exe
  C:\Windows\System\DpssSvn.exe
  2⤵
  PID:3016
- C:\Windows\System\KSFjqcQ.exe
  C:\Windows\System\KSFjqcQ.exe
  2⤵
  PID:4556
- C:\Windows\System\osGHMAT.exe
  C:\Windows\System\osGHMAT.exe
  2⤵
  PID:6380
- C:\Windows\System\nXwVsPY.exe
  C:\Windows\System\nXwVsPY.exe
  2⤵
  PID:6744
- C:\Windows\System\bnSTELx.exe
  C:\Windows\System\bnSTELx.exe
  2⤵
  PID:6808
- C:\Windows\System\YusMJdx.exe
  C:\Windows\System\YusMJdx.exe
  2⤵
  PID:3924
- C:\Windows\System\ZEyxHqj.exe
  C:\Windows\System\ZEyxHqj.exe
  2⤵
  PID:12900
- C:\Windows\System\EbjTTrD.exe
  C:\Windows\System\EbjTTrD.exe
  2⤵
  PID:2764
- C:\Windows\System\nLGbslQ.exe
  C:\Windows\System\nLGbslQ.exe
  2⤵
  PID:1572
- C:\Windows\System\GqvAfgI.exe
  C:\Windows\System\GqvAfgI.exe
  2⤵
  PID:2484
- C:\Windows\System\ySSRGSY.exe
  C:\Windows\System\ySSRGSY.exe
  2⤵
  PID:2956
- C:\Windows\System\ZVmErSa.exe
  C:\Windows\System\ZVmErSa.exe
  2⤵
  PID:3996
- C:\Windows\System\eOPpRMD.exe
  C:\Windows\System\eOPpRMD.exe
  2⤵
  PID:3460
- C:\Windows\System\bjrOEUy.exe
  C:\Windows\System\bjrOEUy.exe
  2⤵
  PID:2776
- C:\Windows\System\ZCTtiyX.exe
  C:\Windows\System\ZCTtiyX.exe
  2⤵
  PID:536
- C:\Windows\System\PzliJlS.exe
  C:\Windows\System\PzliJlS.exe
  2⤵
  PID:13780
- C:\Windows\System\TuqwNqZ.exe
  C:\Windows\System\TuqwNqZ.exe
  2⤵
  PID:7260
- C:\Windows\System\yrsFcEG.exe
  C:\Windows\System\yrsFcEG.exe
  2⤵
  PID:7292
- C:\Windows\System\oOaVhtA.exe
  C:\Windows\System\oOaVhtA.exe
  2⤵
  PID:13804
- C:\Windows\System\mXKTQey.exe
  C:\Windows\System\mXKTQey.exe
  2⤵
  PID:13840
- C:\Windows\System\YUQWYug.exe
  C:\Windows\System\YUQWYug.exe
  2⤵
  PID:13864
- C:\Windows\System\sNyPQFQ.exe
  C:\Windows\System\sNyPQFQ.exe
  2⤵
  PID:13988
- C:\Windows\System\tvKpnug.exe
  C:\Windows\System\tvKpnug.exe
  2⤵
  PID:5000
- C:\Windows\System\RJhdIad.exe
  C:\Windows\System\RJhdIad.exe
  2⤵
  PID:13972
- C:\Windows\System\UuOojpq.exe
  C:\Windows\System\UuOojpq.exe
  2⤵
  PID:13948
- C:\Windows\System\tQHjTKN.exe
  C:\Windows\System\tQHjTKN.exe
  2⤵
  PID:13896
- C:\Windows\System\ERTcxNg.exe
  C:\Windows\System\ERTcxNg.exe
  2⤵
  PID:7312
- C:\Windows\System\aWLDfAk.exe
  C:\Windows\System\aWLDfAk.exe
  2⤵
  PID:14004
- C:\Windows\System\JcXfYGq.exe
  C:\Windows\System\JcXfYGq.exe
  2⤵
  PID:3068
- C:\Windows\System\GtgrtOF.exe
  C:\Windows\System\GtgrtOF.exe
  2⤵
  PID:708
- C:\Windows\System\DPUWkys.exe
  C:\Windows\System\DPUWkys.exe
  2⤵
  PID:14048
- C:\Windows\System\ezagPWZ.exe
  C:\Windows\System\ezagPWZ.exe
  2⤵
  PID:13764
- C:\Windows\System\SApAqbi.exe
  C:\Windows\System\SApAqbi.exe
  2⤵
  PID:13748
- C:\Windows\System\DPRPchc.exe
  C:\Windows\System\DPRPchc.exe
  2⤵
  PID:3456
- C:\Windows\System\xmEYxrC.exe
  C:\Windows\System\xmEYxrC.exe
  2⤵
  PID:3588
- C:\Windows\System\vltqRPV.exe
  C:\Windows\System\vltqRPV.exe
  2⤵
  PID:14064
- C:\Windows\System\cLsPgdq.exe
  C:\Windows\System\cLsPgdq.exe
  2⤵
  PID:11840
- C:\Windows\System\lgGoaJc.exe
  C:\Windows\System\lgGoaJc.exe
  2⤵
  PID:14080
- C:\Windows\System\tbPmaEk.exe
  C:\Windows\System\tbPmaEk.exe
  2⤵
  PID:7636
- C:\Windows\System\FRSUYmx.exe
  C:\Windows\System\FRSUYmx.exe
  2⤵
  PID:7528
- C:\Windows\System\medeJjg.exe
  C:\Windows\System\medeJjg.exe
  2⤵
  PID:14088
- C:\Windows\System\lUrOKYN.exe
  C:\Windows\System\lUrOKYN.exe
  2⤵
  PID:7776
- C:\Windows\System\QKIlLpr.exe
  C:\Windows\System\QKIlLpr.exe
  2⤵
  PID:7844
- C:\Windows\System\ZvBKgao.exe
  C:\Windows\System\ZvBKgao.exe
  2⤵
  PID:7896
- C:\Windows\System\nHCtpIG.exe
  C:\Windows\System\nHCtpIG.exe
  2⤵
  PID:8008
- C:\Windows\System\HXzlqpe.exe
  C:\Windows\System\HXzlqpe.exe
  2⤵
  PID:8016
- C:\Windows\System\RLNvzCr.exe
  C:\Windows\System\RLNvzCr.exe
  2⤵
  PID:8124
- C:\Windows\System\kjNJmiI.exe
  C:\Windows\System\kjNJmiI.exe
  2⤵
  PID:8140
- C:\Windows\System\DjjpuSK.exe
  C:\Windows\System\DjjpuSK.exe
  2⤵
  PID:7252
- C:\Windows\System\zXYQcyr.exe
  C:\Windows\System\zXYQcyr.exe
  2⤵
  PID:7284
- C:\Windows\System\zLzKzKn.exe
  C:\Windows\System\zLzKzKn.exe
  2⤵
  PID:4704
- C:\Windows\System\WnmWkIz.exe
  C:\Windows\System\WnmWkIz.exe
  2⤵
  PID:7552
- C:\Windows\System\PsABptp.exe
  C:\Windows\System\PsABptp.exe
  2⤵
  PID:7816
- C:\Windows\System\nIILVIM.exe
  C:\Windows\System\nIILVIM.exe
  2⤵
  PID:7932
- C:\Windows\System\wlJYwOQ.exe
  C:\Windows\System\wlJYwOQ.exe
  2⤵
  PID:7944
- C:\Windows\System\yYVgLEx.exe
  C:\Windows\System\yYVgLEx.exe
  2⤵
  PID:7236
- C:\Windows\System\KeufWHR.exe
  C:\Windows\System\KeufWHR.exe
  2⤵
  PID:7432
- C:\Windows\System\rQgzBck.exe
  C:\Windows\System\rQgzBck.exe
  2⤵
  PID:7964
- C:\Windows\System\TSntmuv.exe
  C:\Windows\System\TSntmuv.exe
  2⤵
  PID:7148
- C:\Windows\System\SBwIUWy.exe
  C:\Windows\System\SBwIUWy.exe
  2⤵
  PID:7340
- C:\Windows\System\KhwjbPz.exe
  C:\Windows\System\KhwjbPz.exe
  2⤵
  PID:8240
- C:\Windows\System\bPySRoJ.exe
  C:\Windows\System\bPySRoJ.exe
  2⤵
  PID:8352
- C:\Windows\System\jbBlGXZ.exe
  C:\Windows\System\jbBlGXZ.exe
  2⤵
  PID:8400
- C:\Windows\System\tzoAFSL.exe
  C:\Windows\System\tzoAFSL.exe
  2⤵
  PID:8436
- C:\Windows\System\OtQXJhm.exe
  C:\Windows\System\OtQXJhm.exe
  2⤵
  PID:8496
- C:\Windows\System\tWriQVQ.exe
  C:\Windows\System\tWriQVQ.exe
  2⤵
  PID:14068
- C:\Windows\System\VZHHbUs.exe
  C:\Windows\System\VZHHbUs.exe
  2⤵
  PID:8816
- C:\Windows\System\GMMpbwa.exe
  C:\Windows\System\GMMpbwa.exe
  2⤵
  PID:7704
- C:\Windows\System\NmoXIWQ.exe
  C:\Windows\System\NmoXIWQ.exe
  2⤵
  PID:7692
- C:\Windows\System\WJoWEpn.exe
  C:\Windows\System\WJoWEpn.exe
  2⤵
  PID:13232
- C:\Windows\System\lfXqtpm.exe
  C:\Windows\System\lfXqtpm.exe
  2⤵
  PID:12716
- C:\Windows\System\coCTFbh.exe
  C:\Windows\System\coCTFbh.exe
  2⤵
  PID:828
- C:\Windows\System\zPIWDMe.exe
  C:\Windows\System\zPIWDMe.exe
  2⤵
  PID:13468
- C:\Windows\System\IarpHXX.exe
  C:\Windows\System\IarpHXX.exe
  2⤵
  PID:5360
- C:\Windows\System\ujyHQdN.exe
  C:\Windows\System\ujyHQdN.exe
  2⤵
  PID:8152
- C:\Windows\System\jdxRDWG.exe
  C:\Windows\System\jdxRDWG.exe
  2⤵
  PID:8900
- C:\Windows\System\pwtzcwS.exe
  C:\Windows\System\pwtzcwS.exe
  2⤵
  PID:5364
- C:\Windows\System\coQqaEO.exe
  C:\Windows\System\coQqaEO.exe
  2⤵
  PID:5212
- C:\Windows\System\dBteHXY.exe
  C:\Windows\System\dBteHXY.exe
  2⤵
  PID:14184
- C:\Windows\System\bGwqDTh.exe
  C:\Windows\System\bGwqDTh.exe
  2⤵
  PID:5632
- C:\Windows\System\vtarofn.exe
  C:\Windows\System\vtarofn.exe
  2⤵
  PID:5584
- C:\Windows\System\mDotAkf.exe
  C:\Windows\System\mDotAkf.exe
  2⤵
  PID:5768
- C:\Windows\System\KzCOLiD.exe
  C:\Windows\System\KzCOLiD.exe
  2⤵
  PID:5716
- C:\Windows\System\ICacoYc.exe
  C:\Windows\System\ICacoYc.exe
  2⤵
  PID:5184
- C:\Windows\System\EUBDESJ.exe
  C:\Windows\System\EUBDESJ.exe
  2⤵
  PID:5268
- C:\Windows\System\CZoKdae.exe
  C:\Windows\System\CZoKdae.exe
  2⤵
  PID:5500
- C:\Windows\System\xqQcXyH.exe
  C:\Windows\System\xqQcXyH.exe
  2⤵
  PID:5448
- C:\Windows\System\zXfTJCe.exe
  C:\Windows\System\zXfTJCe.exe
  2⤵
  PID:14196
- C:\Windows\System\bxxAsJQ.exe
  C:\Windows\System\bxxAsJQ.exe
  2⤵
  PID:14200
- C:\Windows\System\AYWCfha.exe
  C:\Windows\System\AYWCfha.exe
  2⤵
  PID:14216
- C:\Windows\System\xBxWhvX.exe
  C:\Windows\System\xBxWhvX.exe
  2⤵
  PID:2240
- C:\Windows\System\GhpIUbm.exe
  C:\Windows\System\GhpIUbm.exe
  2⤵
  PID:8196
- C:\Windows\System\OwZrcwg.exe
  C:\Windows\System\OwZrcwg.exe
  2⤵
  PID:5968
- C:\Windows\System\FEUZakG.exe
  C:\Windows\System\FEUZakG.exe
  2⤵
  PID:14224
- C:\Windows\System\pZTwEfN.exe
  C:\Windows\System\pZTwEfN.exe
  2⤵
  PID:8380
- C:\Windows\System\jNMUMMt.exe
  C:\Windows\System\jNMUMMt.exe
  2⤵
  PID:14172
- C:\Windows\System\GkKZIBj.exe
  C:\Windows\System\GkKZIBj.exe
  2⤵
  PID:8448
- C:\Windows\System\hAyptwY.exe
  C:\Windows\System\hAyptwY.exe
  2⤵
  PID:14296
- C:\Windows\System\SFaYxuh.exe
  C:\Windows\System\SFaYxuh.exe
  2⤵
  PID:14316
- C:\Windows\System\WfcmofB.exe
  C:\Windows\System\WfcmofB.exe
  2⤵
  PID:14208
- C:\Windows\System\HcTAuYC.exe
  C:\Windows\System\HcTAuYC.exe
  2⤵
  PID:3848
- C:\Windows\System\FjIAvCd.exe
  C:\Windows\System\FjIAvCd.exe
  2⤵
  PID:8608
- C:\Windows\System\mVFlvEl.exe
  C:\Windows\System\mVFlvEl.exe
  2⤵
  PID:3852
- C:\Windows\System\hduxHdN.exe
  C:\Windows\System\hduxHdN.exe
  2⤵
  PID:12624
- C:\Windows\System\FiYJeBs.exe
  C:\Windows\System\FiYJeBs.exe
  2⤵
  PID:13196
- C:\Windows\System\vfZFrWG.exe
  C:\Windows\System\vfZFrWG.exe
  2⤵
  PID:1324
- C:\Windows\System\vUXGgxN.exe
  C:\Windows\System\vUXGgxN.exe
  2⤵
  PID:4184
- C:\Windows\System\QXKFbnz.exe
  C:\Windows\System\QXKFbnz.exe
  2⤵
  PID:12672
- C:\Windows\System\YZHOTtR.exe
  C:\Windows\System\YZHOTtR.exe
  2⤵
  PID:8956
- C:\Windows\System\pJTcUvD.exe
  C:\Windows\System\pJTcUvD.exe
  2⤵
  PID:968
- C:\Windows\System\VTnUalh.exe
  C:\Windows\System\VTnUalh.exe
  2⤵
  PID:4356
- C:\Windows\System\AenFomM.exe
  C:\Windows\System\AenFomM.exe
  2⤵
  PID:12480
- C:\Windows\System\dutKzAu.exe
  C:\Windows\System\dutKzAu.exe
  2⤵
  PID:6292
- C:\Windows\System\NPonAcM.exe
  C:\Windows\System\NPonAcM.exe
  2⤵
  PID:1108
- C:\Windows\System\VnEXKBQ.exe
  C:\Windows\System\VnEXKBQ.exe
  2⤵
  PID:4084
- C:\Windows\System\EsCXEof.exe
  C:\Windows\System\EsCXEof.exe
  2⤵
  PID:5132
- C:\Windows\System\DmjwHRY.exe
  C:\Windows\System\DmjwHRY.exe
  2⤵
  PID:13428
- C:\Windows\System\CMMgQvp.exe
  C:\Windows\System\CMMgQvp.exe
  2⤵
  PID:8784
- C:\Windows\System\NvlJsTO.exe
  C:\Windows\System\NvlJsTO.exe
  2⤵
  PID:3084
- C:\Windows\System\cMEnvnz.exe
  C:\Windows\System\cMEnvnz.exe
  2⤵
  PID:5424
- C:\Windows\System\IGOiMos.exe
  C:\Windows\System\IGOiMos.exe
  2⤵
  PID:4884
- C:\Windows\System\XWtTdXT.exe
  C:\Windows\System\XWtTdXT.exe
  2⤵
  PID:13448
- C:\Windows\System\unNzuyu.exe
  C:\Windows\System\unNzuyu.exe
  2⤵
  PID:13472
- C:\Windows\System\zXRzbBj.exe
  C:\Windows\System\zXRzbBj.exe
  2⤵
  PID:5484
- C:\Windows\System\pwFSrrp.exe
  C:\Windows\System\pwFSrrp.exe
  2⤵
  PID:5540
- C:\Windows\System\crCMXAv.exe
  C:\Windows\System\crCMXAv.exe
  2⤵
  PID:12860
- C:\Windows\System\iWsbuyz.exe
  C:\Windows\System\iWsbuyz.exe
  2⤵
  PID:2600
- C:\Windows\System\ttNMyZY.exe
  C:\Windows\System\ttNMyZY.exe
  2⤵
  PID:2972
- C:\Windows\System\XgAapwm.exe
  C:\Windows\System\XgAapwm.exe
  2⤵
  PID:2052
- C:\Windows\System\xovnEFU.exe
  C:\Windows\System\xovnEFU.exe
  2⤵
  PID:13304
- C:\Windows\System\qnOMYum.exe
  C:\Windows\System\qnOMYum.exe
  2⤵
  PID:13616
- C:\Windows\System\hyzFbPX.exe
  C:\Windows\System\hyzFbPX.exe
  2⤵
  PID:9272
- C:\Windows\System\BWldPgK.exe
  C:\Windows\System\BWldPgK.exe
  2⤵
  PID:9332
- C:\Windows\System\PQobMDm.exe
  C:\Windows\System\PQobMDm.exe
  2⤵
  PID:9436
- C:\Windows\System\cEfGxdC.exe
  C:\Windows\System\cEfGxdC.exe
  2⤵
  PID:5908
- C:\Windows\System\FiXJGoE.exe
  C:\Windows\System\FiXJGoE.exe
  2⤵
  PID:5704
- C:\Windows\System\pJPQQkn.exe
  C:\Windows\System\pJPQQkn.exe
  2⤵
  PID:9580
- C:\Windows\System\zCtYtFS.exe
  C:\Windows\System\zCtYtFS.exe
  2⤵
  PID:9588
- C:\Windows\System\MhYHMBX.exe
  C:\Windows\System\MhYHMBX.exe
  2⤵
  PID:13652
- C:\Windows\System\skIdBbE.exe
  C:\Windows\System\skIdBbE.exe
  2⤵
  PID:4088
- C:\Windows\System\tPUKnzu.exe
  C:\Windows\System\tPUKnzu.exe
  2⤵
  PID:9656
- C:\Windows\System\JbhYFQU.exe
  C:\Windows\System\JbhYFQU.exe
  2⤵
  PID:4876
- C:\Windows\System\ghjjWNz.exe
  C:\Windows\System\ghjjWNz.exe
  2⤵
  PID:6044
- C:\Windows\System\aldMdlw.exe
  C:\Windows\System\aldMdlw.exe
  2⤵
  PID:13744
- C:\Windows\System\OWiKgBC.exe
  C:\Windows\System\OWiKgBC.exe
  2⤵
  PID:13736
- C:\Windows\System\aTnSIck.exe
  C:\Windows\System\aTnSIck.exe
  2⤵
  PID:9792
- C:\Windows\System\sRhNQhL.exe
  C:\Windows\System\sRhNQhL.exe
  2⤵
  PID:764
- C:\Windows\System\VZntRnM.exe
  C:\Windows\System\VZntRnM.exe
  2⤵
  PID:7048
- C:\Windows\System\QwxPSVC.exe
  C:\Windows\System\QwxPSVC.exe
  2⤵
  PID:7144
- C:\Windows\System\nQuRrJy.exe
  C:\Windows\System\nQuRrJy.exe
  2⤵
  PID:5084
- C:\Windows\System\EITGtbx.exe
  C:\Windows\System\EITGtbx.exe
  2⤵
  PID:5192
- C:\Windows\System\VVcrOBa.exe
  C:\Windows\System\VVcrOBa.exe
  2⤵
  PID:5400
- C:\Windows\System\QbhPqVg.exe
  C:\Windows\System\QbhPqVg.exe
  2⤵
  PID:9972
- C:\Windows\System\kNoiJzP.exe
  C:\Windows\System\kNoiJzP.exe
  2⤵
  PID:6636
- C:\Windows\System\mDSDpLi.exe
  C:\Windows\System\mDSDpLi.exe
  2⤵
  PID:5372
- C:\Windows\System\tigQOaS.exe
  C:\Windows\System\tigQOaS.exe
  2⤵
  PID:5572
- C:\Windows\System\UUylzwT.exe
  C:\Windows\System\UUylzwT.exe
  2⤵
  PID:4844
- C:\Windows\System\WZwvsXK.exe
  C:\Windows\System\WZwvsXK.exe
  2⤵
  PID:3864
- C:\Windows\System\fWWBUJc.exe
  C:\Windows\System\fWWBUJc.exe
  2⤵
  PID:9380
- C:\Windows\System\uEnPNpa.exe
  C:\Windows\System\uEnPNpa.exe
  2⤵
  PID:14140
- C:\Windows\System\xqUKaMb.exe
  C:\Windows\System\xqUKaMb.exe
  2⤵
  PID:9484
- C:\Windows\System\kpaIVpo.exe
  C:\Windows\System\kpaIVpo.exe
  2⤵
  PID:1104
- C:\Windows\System\VxKSkEl.exe
  C:\Windows\System\VxKSkEl.exe
  2⤵
  PID:2360
- C:\Windows\System\bPXywwC.exe
  C:\Windows\System\bPXywwC.exe
  2⤵
  PID:9748
- C:\Windows\System\HDYPGlD.exe
  C:\Windows\System\HDYPGlD.exe
  2⤵
  PID:13836
- C:\Windows\System\vdCnuYE.exe
  C:\Windows\System\vdCnuYE.exe
  2⤵
  PID:13852
- C:\Windows\System\vZkLNgN.exe
  C:\Windows\System\vZkLNgN.exe
  2⤵
  PID:1120
- C:\Windows\System\TxoYumJ.exe
  C:\Windows\System\TxoYumJ.exe
  2⤵
  PID:1432
- C:\Windows\System\bievPfp.exe
  C:\Windows\System\bievPfp.exe
  2⤵
  PID:6252
- C:\Windows\System\LJgcnTw.exe
  C:\Windows\System\LJgcnTw.exe
  2⤵
  PID:13912
- C:\Windows\System\vfktgXn.exe
  C:\Windows\System\vfktgXn.exe
  2⤵
  PID:14000
- C:\Windows\System\atHDHMk.exe
  C:\Windows\System\atHDHMk.exe
  2⤵
  PID:4344
- C:\Windows\System\PtVElac.exe
  C:\Windows\System\PtVElac.exe
  2⤵
  PID:6336
- C:\Windows\System\tOoPYGF.exe
  C:\Windows\System\tOoPYGF.exe
  2⤵
  PID:14036
- C:\Windows\System\nhNwBBV.exe
  C:\Windows\System\nhNwBBV.exe
  2⤵
  PID:13756
- C:\Windows\System\kNjdFgP.exe
  C:\Windows\System\kNjdFgP.exe
  2⤵
  PID:1892
- C:\Windows\System\hrHmWqd.exe
  C:\Windows\System\hrHmWqd.exe
  2⤵
  PID:1416
- C:\Windows\System\sTSnzBN.exe
  C:\Windows\System\sTSnzBN.exe
  2⤵
  PID:4996
- C:\Windows\System\IzUuVEe.exe
  C:\Windows\System\IzUuVEe.exe
  2⤵
  PID:6460
- C:\Windows\System\dMzkuNE.exe
  C:\Windows\System\dMzkuNE.exe
  2⤵
  PID:6504
- C:\Windows\System\MgQMDjj.exe
  C:\Windows\System\MgQMDjj.exe
  2⤵
  PID:7504
- C:\Windows\System\gPcFZFw.exe
  C:\Windows\System\gPcFZFw.exe
  2⤵
  PID:5180
- C:\Windows\System\hNSdEYz.exe
  C:\Windows\System\hNSdEYz.exe
  2⤵
  PID:7792
- C:\Windows\System\XtKnppF.exe
  C:\Windows\System\XtKnppF.exe
  2⤵
  PID:7916
- C:\Windows\System\ZRamqrx.exe
  C:\Windows\System\ZRamqrx.exe
  2⤵
  PID:7988
- C:\Windows\System\cRXkuZq.exe
  C:\Windows\System\cRXkuZq.exe
  2⤵
  PID:6644
- C:\Windows\System\aNNyZwx.exe
  C:\Windows\System\aNNyZwx.exe
  2⤵
  PID:8176
- C:\Windows\System\LUWFnie.exe
  C:\Windows\System\LUWFnie.exe
  2⤵
  PID:7180
- C:\Windows\System\idgvCBw.exe
  C:\Windows\System\idgvCBw.exe
  2⤵
  PID:7320
- C:\Windows\System\phWKeNr.exe
  C:\Windows\System\phWKeNr.exe
  2⤵
  PID:7428
- C:\Windows\System\fcnoODj.exe
  C:\Windows\System\fcnoODj.exe
  2⤵
  PID:6740
- C:\Windows\System\CUDNBIk.exe
  C:\Windows\System\CUDNBIk.exe
  2⤵
  PID:6768
- C:\Windows\System\PBkEWbV.exe
  C:\Windows\System\PBkEWbV.exe
  2⤵
  PID:7836
- C:\Windows\System\ipOpQfd.exe
  C:\Windows\System\ipOpQfd.exe
  2⤵
  PID:8080
- C:\Windows\System\ZJTqNTn.exe
  C:\Windows\System\ZJTqNTn.exe
  2⤵
  PID:7560
- C:\Windows\System\SEWFgue.exe
  C:\Windows\System\SEWFgue.exe
  2⤵
  PID:7620
- C:\Windows\System\JzXtttp.exe
  C:\Windows\System\JzXtttp.exe
  2⤵
  PID:8168
- C:\Windows\System\PRZrVJQ.exe
  C:\Windows\System\PRZrVJQ.exe
  2⤵
  PID:11088
- C:\Windows\System\vAESRBp.exe
  C:\Windows\System\vAESRBp.exe
  2⤵
  PID:7300
- C:\Windows\System\XpWVvNy.exe
  C:\Windows\System\XpWVvNy.exe
  2⤵
  PID:8336
- C:\Windows\System\bJumqlO.exe
  C:\Windows\System\bJumqlO.exe
  2⤵
  PID:8536
- C:\Windows\System\vDNZvpa.exe
  C:\Windows\System\vDNZvpa.exe
  2⤵
  PID:8720
- C:\Windows\System\rkgRYJd.exe
  C:\Windows\System\rkgRYJd.exe
  2⤵
  PID:10304
- C:\Windows\System\cSDWPAb.exe
  C:\Windows\System\cSDWPAb.exe
  2⤵
  PID:8756
- C:\Windows\System\yjuPklF.exe
  C:\Windows\System\yjuPklF.exe
  2⤵
  PID:14104
- C:\Windows\System\BliTxyv.exe
  C:\Windows\System\BliTxyv.exe
  2⤵
  PID:5128
- C:\Windows\System\CFdDOfA.exe
  C:\Windows\System\CFdDOfA.exe
  2⤵
  PID:8580
- C:\Windows\System\VWYYVtw.exe
  C:\Windows\System\VWYYVtw.exe
  2⤵
  PID:10432
- C:\Windows\System\EuqApjv.exe
  C:\Windows\System\EuqApjv.exe
  2⤵
  PID:3112
- C:\Windows\System\oYkhSKd.exe
  C:\Windows\System\oYkhSKd.exe
  2⤵
  PID:8708
- C:\Windows\System\wceVoea.exe
  C:\Windows\System\wceVoea.exe
  2⤵
  PID:5388
- C:\Windows\System\uGneDiK.exe
  C:\Windows\System\uGneDiK.exe
  2⤵
  PID:14176
- C:\Windows\System\WBbgoKf.exe
  C:\Windows\System\WBbgoKf.exe
  2⤵
  PID:5392
- C:\Windows\System\fSJETMw.exe
  C:\Windows\System\fSJETMw.exe
  2⤵
  PID:5960
- C:\Windows\System\WFCcwFM.exe
  C:\Windows\System\WFCcwFM.exe
  2⤵
  PID:5556
- C:\Windows\System\RAjYfWS.exe
  C:\Windows\System\RAjYfWS.exe
  2⤵
  PID:5304
- C:\Windows\System\RXJiNSj.exe
  C:\Windows\System\RXJiNSj.exe
  2⤵
  PID:5912
- C:\Windows\System\eGAEDUd.exe
  C:\Windows\System\eGAEDUd.exe
  2⤵
  PID:6900
- C:\Windows\System\tNhZzaY.exe
  C:\Windows\System\tNhZzaY.exe
  2⤵
  PID:10548
- C:\Windows\System\aaYMRTk.exe
  C:\Windows\System\aaYMRTk.exe
  2⤵
  PID:10780
- C:\Windows\System\LQocKsN.exe
  C:\Windows\System\LQocKsN.exe
  2⤵
  PID:11004
- C:\Windows\System\rtMlnmf.exe
  C:\Windows\System\rtMlnmf.exe
  2⤵
  PID:11160
- C:\Windows\System\JhtmFvh.exe
  C:\Windows\System\JhtmFvh.exe
  2⤵
  PID:7020
- C:\Windows\System\VbNbwNu.exe
  C:\Windows\System\VbNbwNu.exe
  2⤵
  PID:7036
- C:\Windows\System\eneGOMF.exe
  C:\Windows\System\eneGOMF.exe
  2⤵
  PID:14220
- C:\Windows\System\gjLKUtV.exe
  C:\Windows\System\gjLKUtV.exe
  2⤵
  PID:4452
- C:\Windows\System\YyZBaoV.exe
  C:\Windows\System\YyZBaoV.exe
  2⤵
  PID:5464
- C:\Windows\System\QNjGxxm.exe
  C:\Windows\System\QNjGxxm.exe
  2⤵
  PID:14204
- C:\Windows\System\AOEDGNM.exe
  C:\Windows\System\AOEDGNM.exe
  2⤵
  PID:10572
- C:\Windows\System\RJcJCKs.exe
  C:\Windows\System\RJcJCKs.exe
  2⤵
  PID:11040
- C:\Windows\System\TMzckVb.exe
  C:\Windows\System\TMzckVb.exe
  2⤵
  PID:6036
- C:\Windows\System\CKABAtK.exe
  C:\Windows\System\CKABAtK.exe
  2⤵
  PID:1200
- C:\Windows\System\NHZpieR.exe
  C:\Windows\System\NHZpieR.exe
  2⤵
  PID:10504
- C:\Windows\System\PlFyCuF.exe
  C:\Windows\System\PlFyCuF.exe
  2⤵
  PID:4036
- C:\Windows\System\AawSQIh.exe
  C:\Windows\System\AawSQIh.exe
  2⤵
  PID:12464
- C:\Windows\System\AOYpVxX.exe
  C:\Windows\System\AOYpVxX.exe
  2⤵
  PID:11980
- C:\Windows\System\uFOsDdU.exe
  C:\Windows\System\uFOsDdU.exe
  2⤵
  PID:8764
- C:\Windows\System\UeFJByS.exe
  C:\Windows\System\UeFJByS.exe
  2⤵
  PID:1468
- C:\Windows\System\BOfUaCg.exe
  C:\Windows\System\BOfUaCg.exe
  2⤵
  PID:7164
- C:\Windows\System\uidINuz.exe
  C:\Windows\System\uidINuz.exe
  2⤵
  PID:744
- C:\Windows\System\hShjKtN.exe
  C:\Windows\System\hShjKtN.exe
  2⤵
  PID:4080
- C:\Windows\System\chiJxQa.exe
  C:\Windows\System\chiJxQa.exe
  2⤵
  PID:5284
- C:\Windows\System\pYizXgQ.exe
  C:\Windows\System\pYizXgQ.exe
  2⤵
  PID:6156
- C:\Windows\System\sKfUMqr.exe
  C:\Windows\System\sKfUMqr.exe
  2⤵
  PID:5348
- C:\Windows\System\XXbSujR.exe
  C:\Windows\System\XXbSujR.exe
  2⤵
  PID:1140
- C:\Windows\System\WgMejRS.exe
  C:\Windows\System\WgMejRS.exe
  2⤵
  PID:6216
- C:\Windows\System\ddbUGKd.exe
  C:\Windows\System\ddbUGKd.exe
  2⤵
  PID:11908
- C:\Windows\System\XSmZnac.exe
  C:\Windows\System\XSmZnac.exe
  2⤵
  PID:13528
- C:\Windows\System\BymMqaR.exe
  C:\Windows\System\BymMqaR.exe
  2⤵
  PID:11964
- C:\Windows\System\ywAzdRK.exe
  C:\Windows\System\ywAzdRK.exe
  2⤵
  PID:6324
- C:\Windows\System\ofLPTMc.exe
  C:\Windows\System\ofLPTMc.exe
  2⤵
  PID:12120
- C:\Windows\System\avMzZOk.exe
  C:\Windows\System\avMzZOk.exe
  2⤵
  PID:9476
- C:\Windows\System\YKeJYhK.exe
  C:\Windows\System\YKeJYhK.exe
  2⤵
  PID:9560
- C:\Windows\System\qXKHhfF.exe
  C:\Windows\System\qXKHhfF.exe
  2⤵
  PID:9636
- C:\Windows\System\oIjxoLh.exe
  C:\Windows\System\oIjxoLh.exe
  2⤵
  PID:13056
- C:\Windows\System\EwUAsth.exe
  C:\Windows\System\EwUAsth.exe
  2⤵
  PID:13728
- C:\Windows\System\zZMONri.exe
  C:\Windows\System\zZMONri.exe
  2⤵
  PID:6132
- C:\Windows\System\UwmqXlZ.exe
  C:\Windows\System\UwmqXlZ.exe
  2⤵
  PID:7128
- C:\Windows\System\tMDrQXp.exe
  C:\Windows\System\tMDrQXp.exe
  2⤵
  PID:9900
- C:\Windows\System\rYpMSFL.exe
  C:\Windows\System\rYpMSFL.exe
  2⤵
  PID:5020
- C:\Windows\System\HMjSqwA.exe
  C:\Windows\System\HMjSqwA.exe
  2⤵
  PID:4860
- C:\Windows\System\qRhgoLQ.exe
  C:\Windows\System\qRhgoLQ.exe
  2⤵
  PID:6440
- C:\Windows\System\czpuLaO.exe
  C:\Windows\System\czpuLaO.exe
  2⤵
  PID:2060
- C:\Windows\System\PFDmuUI.exe
  C:\Windows\System\PFDmuUI.exe
  2⤵
  PID:12312
- C:\Windows\System\kchsVyD.exe
  C:\Windows\System\kchsVyD.exe
  2⤵
  PID:3612
- C:\Windows\System\sVYHgbt.exe
  C:\Windows\System\sVYHgbt.exe
  2⤵
  PID:2348
- C:\Windows\System\yDPsrPb.exe
  C:\Windows\System\yDPsrPb.exe
  2⤵
  PID:3244
- C:\Windows\System\DOjpjql.exe
  C:\Windows\System\DOjpjql.exe
  2⤵
  PID:12384
- C:\Windows\System\wLWSdRF.exe
  C:\Windows\System\wLWSdRF.exe
  2⤵
  PID:12640
- C:\Windows\System\XGLtyjR.exe
  C:\Windows\System\XGLtyjR.exe
  2⤵
  PID:12616
- C:\Windows\System\IrnvwmI.exe
  C:\Windows\System\IrnvwmI.exe
  2⤵
  PID:12664
- C:\Windows\System\ROetxPM.exe
  C:\Windows\System\ROetxPM.exe
  2⤵
  PID:13916
- C:\Windows\System\dpumwyf.exe
  C:\Windows\System\dpumwyf.exe
  2⤵
  PID:1272
- C:\Windows\System\uFLSAvW.exe
  C:\Windows\System\uFLSAvW.exe
  2⤵
  PID:6068
- C:\Windows\System\CnlKgaO.exe
  C:\Windows\System\CnlKgaO.exe
  2⤵
  PID:4292
- C:\Windows\System\JBvuihn.exe
  C:\Windows\System\JBvuihn.exe
  2⤵
  PID:9356
- C:\Windows\System\xHzKxKz.exe
  C:\Windows\System\xHzKxKz.exe
  2⤵
  PID:13968
- C:\Windows\System\WvTufIl.exe
  C:\Windows\System\WvTufIl.exe
  2⤵
  PID:7264
- C:\Windows\System\LYFOgLe.exe
  C:\Windows\System\LYFOgLe.exe
  2⤵
  PID:1760
- C:\Windows\System\VHovylv.exe
  C:\Windows\System\VHovylv.exe
  2⤵
  PID:6264
- C:\Windows\System\lGddSnv.exe
  C:\Windows\System\lGddSnv.exe
  2⤵
  PID:4628
- C:\Windows\System\MoaIrDe.exe
  C:\Windows\System\MoaIrDe.exe
  2⤵
  PID:12864
- C:\Windows\System\JDGoRAs.exe
  C:\Windows\System\JDGoRAs.exe
  2⤵
  PID:13752
- C:\Windows\System\nxvoVkx.exe
  C:\Windows\System\nxvoVkx.exe
  2⤵
  PID:14092
- C:\Windows\System\smNBbaA.exe
  C:\Windows\System\smNBbaA.exe
  2⤵
  PID:4228
- C:\Windows\System\SrQWMia.exe
  C:\Windows\System\SrQWMia.exe
  2⤵
  PID:3144
- C:\Windows\System\VDAzQrY.exe
  C:\Windows\System\VDAzQrY.exe
  2⤵
  PID:13080
- C:\Windows\System\yHxVuLb.exe
  C:\Windows\System\yHxVuLb.exe
  2⤵
  PID:6532
- C:\Windows\System\veJmDYB.exe
  C:\Windows\System\veJmDYB.exe
  2⤵
  PID:7856
- C:\Windows\System\wOzxLLp.exe
  C:\Windows\System\wOzxLLp.exe
  2⤵
  PID:7996
- C:\Windows\System\UDtmrrV.exe
  C:\Windows\System\UDtmrrV.exe
  2⤵
  PID:5240
- C:\Windows\System\MDGxEXA.exe
  C:\Windows\System\MDGxEXA.exe
  2⤵
  PID:6712
- C:\Windows\System\COJhoXJ.exe
  C:\Windows\System\COJhoXJ.exe
  2⤵
  PID:12428
- C:\Windows\System\CwfnLNr.exe
  C:\Windows\System\CwfnLNr.exe
  2⤵
  PID:6792
- C:\Windows\System\KGuahiD.exe
  C:\Windows\System\KGuahiD.exe
  2⤵
  PID:1216
- C:\Windows\System\yoHTFoa.exe
  C:\Windows\System\yoHTFoa.exe
  2⤵
  PID:12720
- C:\Windows\System\ygUrhhH.exe
  C:\Windows\System\ygUrhhH.exe
  2⤵
  PID:7124
- C:\Windows\System\BRRZNkL.exe
  C:\Windows\System\BRRZNkL.exe
  2⤵
  PID:7640
- C:\Windows\System\yBFIWrH.exe
  C:\Windows\System\yBFIWrH.exe
  2⤵
  PID:4260
- C:\Windows\System\hxqXjPf.exe
  C:\Windows\System\hxqXjPf.exe
  2⤵
  PID:8464
- C:\Windows\System\PxJhfKU.exe
  C:\Windows\System\PxJhfKU.exe
  2⤵
  PID:6524
- C:\Windows\System\DYXjmOl.exe
  C:\Windows\System\DYXjmOl.exe
  2⤵
  PID:6872
- C:\Windows\System\qRdLUrk.exe
  C:\Windows\System\qRdLUrk.exe
  2⤵
  PID:14032
- C:\Windows\System\RjmogCL.exe
  C:\Windows\System\RjmogCL.exe
  2⤵
  PID:1332
- C:\Windows\System\IATirQU.exe
  C:\Windows\System\IATirQU.exe
  2⤵
  PID:7240
- C:\Windows\System\lKAkaeI.exe
  C:\Windows\System\lKAkaeI.exe
  2⤵
  PID:7256
- C:\Windows\System\OpiqQMa.exe
  C:\Windows\System\OpiqQMa.exe
  2⤵
  PID:10336
- C:\Windows\System\DPwEkYx.exe
  C:\Windows\System\DPwEkYx.exe
  2⤵
  PID:6940
- C:\Windows\System\inshEqs.exe
  C:\Windows\System\inshEqs.exe
  2⤵
  PID:14180
- C:\Windows\System\DrNuSpZ.exe
  C:\Windows\System\DrNuSpZ.exe
  2⤵
  PID:8952
- C:\Windows\System\IbsIoBq.exe
  C:\Windows\System\IbsIoBq.exe
  2⤵
  PID:5880
- C:\Windows\System\IAoQgRC.exe
  C:\Windows\System\IAoQgRC.exe
  2⤵
  PID:7492
- C:\Windows\System\FDajLlS.exe
  C:\Windows\System\FDajLlS.exe
  2⤵
  PID:12336
- C:\Windows\System\lUbfznq.exe
  C:\Windows\System\lUbfznq.exe
  2⤵
  PID:10500
- C:\Windows\System\yyXZkXn.exe
  C:\Windows\System\yyXZkXn.exe
  2⤵
  PID:11180
- C:\Windows\System\hFFJkIH.exe
  C:\Windows\System\hFFJkIH.exe
  2⤵
  PID:7032
- C:\Windows\System\HsJlNNh.exe
  C:\Windows\System\HsJlNNh.exe
  2⤵
  PID:6008
- C:\Windows\System\RuuwzNK.exe
  C:\Windows\System\RuuwzNK.exe
  2⤵
  PID:14276
- C:\Windows\System\oXONrRF.exe
  C:\Windows\System\oXONrRF.exe
  2⤵
  PID:1164
- C:\Windows\System\TITZqAa.exe
  C:\Windows\System\TITZqAa.exe
  2⤵
  PID:9156
- C:\Windows\System\dYooALN.exe
  C:\Windows\System\dYooALN.exe
  2⤵
  PID:6064
- C:\Windows\System\IHlgNEN.exe
  C:\Windows\System\IHlgNEN.exe
  2⤵
  PID:14292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1gesu3p.iq2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFumJfx.exe

Filesize
1.4MB

MD5
4f3a9e5bf1a11a563c05e146b043f6dc

SHA1
32458c179188fdb61147a88bde0925262f6eacc9

SHA256
81e705e305acdc8429563632970608a078c5b73da1941f7f6dba3cdb0a7a4239

SHA512
5b9332f4560194a9f83b7bccd098f5b5a76f059a16b06831b08068c59a0e8f71f4b4a14397c9749d8a6a71677d8cae3285e1f6d0bfba3312eab25e6931975ef2

Download Submit
C:\Windows\System\AhbqMgn.exe

Filesize
1.4MB

MD5
7a782a452a193d890f08a00d0f51d9cb

SHA1
e6d3368989e965ad4e8ad5d01d1a9377984532c7

SHA256
0427bf2205b065fa7ad056217ea85080c4f48d89e30721cf3205393abd361a37

SHA512
90b300e3f37b8dc4e605a01abb37fdbd4b9183bb78fab19be7589cdf75dd570d0cdb3632e29f155be81f131e55b73f0a45be9bd3a49a48bd28d985c3c2771596

Download Submit
C:\Windows\System\CrjvfAk.exe

Filesize
1.4MB

MD5
55fe098b2d588d5da9ea95469dbe78f6

SHA1
358e7448b31468c2b42bd98088ace92bc68d70ec

SHA256
ea7d846c888426e3a45a54f43a927dbdcf092b4051296d8c3117d7acc764ed93

SHA512
edb086b52acd9110786f0e37fee2c925f4baaabdca319a864fc015e82684f043f0515070cc12021532335026cde162b6f0bcddd7715fb8ca57d91feafb2c7b1c

Download Submit
C:\Windows\System\CzlRBHr.exe

Filesize
1.4MB

MD5
82f9e0e1e0177b276bed99a38c13d0af

SHA1
fc505c2b12ab1383b170e6012c788c23c690fa18

SHA256
e78a988df44f5429e2625be4aeae79b701e5855575f54c093332de8ac9d1b0c9

SHA512
995d2fe1f4afee959e4ab52407438b68c51063b0d932e822749311446c3cf9c7e2357a33a6d4c07efe5bc9a43ed587fc49b4e5e3c1b5480d4582ddac7bef0fa2

Download Submit
C:\Windows\System\DxKTzVs.exe

Filesize
1.4MB

MD5
00a6d9af358ca06ed4eb77579736a3e1

SHA1
b2fa2904ff5494d1eb896155da629ea82560020a

SHA256
3ea5719a3c2c63574f302688cb3e815a27efe01cc157f26607e3bb31cb27f3a9

SHA512
3642c7e0106ce85fd2368c41d13acfc1b17aca18a3f4123f4d02c3783957464f096a4cefc673f9831d160b91461f5c9fbe77dd2c9c8b23c1e84e722244c23621

Download Submit
C:\Windows\System\ECaFSJF.exe

Filesize
1.4MB

MD5
9a7c2f2200f258c931b9f383de4f70ad

SHA1
798a3c0b7a86165391bda30501ad14bf6c2136a7

SHA256
afd71cdb3b7446b3249024cfad26802787b3ef2aafc60a5d378920bc1c3034d6

SHA512
d32d7eb6d61b1f66d20e32764c93e8dea5db21afa1a8a655a74797fa81d733496f84026e58574ef6717df4ed1d1ab40238e4eba407896eca74007a411ccdb4e1

Download Submit
C:\Windows\System\IWOnmEL.exe

Filesize
1.4MB

MD5
e49e3a66daa035b54617f3d46e093caf

SHA1
bfcd7666a55530ee7643f2e4e7b6bcddd67820e4

SHA256
c27ea4379605be0975a9d8bdf5d21216cff01ae7398e75941164a1a1dd48a0fa

SHA512
eed2e75575ce75a1c0ded9c2768028ff2eac8f91eb509c75431182e40b511159b7fe9880f646a0bce1d94bd26c27011dfe5d86de7b734b1bf3b0094d7f19c433

Download Submit
C:\Windows\System\KibZPeh.exe

Filesize
1.4MB

MD5
d11b34008bd4575cc5312231897a7bf2

SHA1
d1f04ad3399e7ff4d34437ef9a3de9b2fff0c7e0

SHA256
98108e8525e490fecef4a0cc4c923aa8e0b7bcc55dddf3071f06297c406cb34a

SHA512
aad7c3bab9120ee53237e02fabd0c4f61f52a950a8dfb7581099a0b5c60ca1dbc933d081eda7f920f2eb54f8088d79442ab80c2e987560c97ffa4b672b152970

Download Submit
C:\Windows\System\KuBjjAr.exe

Filesize
1.4MB

MD5
65aed8c30353c329615aeeb8a9099511

SHA1
fd57800d3a77fd687dbcd943123ed2a8f4e94d46

SHA256
ff41f7df2deffb346cfee6cb7b4ec7596e7ec67321ffc4939805786d9ee45e83

SHA512
4faa0f5b3dc9ef4bac51b83ec318cddf57b92bda9bd28cc49b07069dd6ca3a21765b9be4b554ec2c90a3056dee059c84c277ef7d494b2050d90182b631e7dcff

Download Submit
C:\Windows\System\LrMlEsv.exe

Filesize
1.4MB

MD5
17059958254c4287d5a83c03698a1ca8

SHA1
d73cdad61f8adeb7228754216c7d00ffa2ca85b1

SHA256
865454cc2f50be0471327280b5aaf653de80ce60304f1c5725f4f312e6cda0b5

SHA512
519fc5ca79377422a1d466663790c6773acf8408651b44ccdc06bb0e952740f68722ffe9272452fa9560220fc52a86fce387a5f7740d46f9cc77fe10fe3d8e65

Download Submit
C:\Windows\System\MZtyDlC.exe

Filesize
1.4MB

MD5
753810995e227a3faf03250ccc7f7af0

SHA1
45899ac24517dd28caa3c2eea956a76408982cb9

SHA256
0f68c0e3167a187aa8b9dc9c8c4c7258fc270445246375c95b2969a20a7a2ebd

SHA512
bd07c66014edc3326bed9addcace4020b0d23109c04f00bf927a973594ee2a3b61c6ac1ac3b5f080ebd352abba5f31871fb1bedea7d81cd59937bc6f492d317e

Download Submit
C:\Windows\System\NLwbHmK.exe

Filesize
1.4MB

MD5
cfc16e64654ff227e5e84f565d86faee

SHA1
fc705925bcc4d48beb01477aaff206ae53456ce1

SHA256
13bac7daf913bb37111c17c8ac4d696aaca717cff5b296e2f303c2472574609a

SHA512
b028678d25841f06239f5ed498d6b7540fcd5663a5884e415d7984ce388613850a15a8b591f365c199986f8122cbec0f64608a74867f20ba79d9d2a770f4ec9b

Download Submit
C:\Windows\System\NqQyCwx.exe

Filesize
1.4MB

MD5
cc4872e54837a56dd290ba81813d604d

SHA1
74de41a7c488a165ff87f41315e1cfc0bee8398f

SHA256
289e34d504896cc56990344498f13168300394475199515d4496a6471cd4a015

SHA512
5941caa0abb5b59ce0ff362c0666bf287ce0d41213a818f983c69128f52277dc09abb1c903a845cf18dfb38f7e8579fa2f3f69b59dd9a177d4a49cedd54b7a28

Download Submit
C:\Windows\System\OJBAfMP.exe

Filesize
1.4MB

MD5
64910fe3af719ef8a232ac4b00205a53

SHA1
4395e7c502ab706386897b1c0813eb410788f2fa

SHA256
46cb30f043ad250f3564d9cc3478c4ea3ed82bd18ac0905805d540a70cde7b28

SHA512
e4b1cf0cad876871d00ae3e3e4021bfe87104ddb9c11d3a55f7794c1572efc299e9bf1755e762f548baae41a48516eb81af19a93a545b6520750b98f1d9c5c9e

Download Submit
C:\Windows\System\PrOHRsO.exe

Filesize
1.4MB

MD5
b7307b2c55c8f5ab9bfc09a9a5cf390d

SHA1
36391aeefe4c61cc656ed24f1d33a2d60009b907

SHA256
8f018b01e14bd79e466cb934b2dc4743f69de6a8acf6b536014055aed98daae8

SHA512
1072307ea34d6fe7827f71ce3b363eb3e68ed12e638acff77aa79f38bbb6fed3a78e0aa48412530fe576895af38e43ffb515e480797877e858c7f38639d17e79

Download Submit
C:\Windows\System\RNodEBO.exe

Filesize
1.4MB

MD5
b4e408bfcf8827a13006818089192ef9

SHA1
d8b3efa47230b960ddb0bae66632615d75821866

SHA256
44e9bf7ed12350b73719fa5e9a66c6cf71b151bcce2415b35f1bfa74abd488b9

SHA512
4723215ed5b62319e344d460e4e6f6f721290d4dbd811ad0995fd90aecd2fcd2ff5c4b13851fc4da85641bf5a4a60f19014e8a0525712edc638811db4d36f541

Download Submit
C:\Windows\System\SCghqdp.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\System\UCvZntN.exe

Filesize
1.4MB

MD5
657db67e28bdd7c6f202666af2931943

SHA1
1e1444cc17c0132dd08c0e9827e1fcd4c24c89f2

SHA256
6eec0e4951367855f56930d27549c2a91a88882e5d26decdbcafc59b2fb31ef8

SHA512
be36a190ba0e738aff2f62837daa7647e5ebe8db68b82c36875220d4949d5947207f375119be4eb1e520215fcb16baa873046fe7ea361bb5f41d3f76581e004a

Download Submit
C:\Windows\System\UEfjXUq.exe

Filesize
1.4MB

MD5
15e1ee937831b5cb2676ad522dc4520f

SHA1
87cf047c3a76bce27db16dd05b2e056c93065c47

SHA256
8110be2faa445c79f8a579640b78cf6069a78d787cf55c51a8ab252b72c75576

SHA512
ede3570f797092b2128dc979a7a41f5ebffac646be27010d9403a4ae8299d10afb8ce480427475bc2de45b1557c2704cdc7b9bcb890fc868e8fb1d3f9c78ad4b

Download Submit
C:\Windows\System\UZLInEj.exe

Filesize
1.4MB

MD5
749f4541a895320fb3ebd2dcb72dd123

SHA1
8c3bb4dd6b5d3c6c7fb91d09e20d4ec06fe9a753

SHA256
ab0c8e08c6ebe9b4c17fac0c8b304eca2b1624ab39163786326d307292e44a22

SHA512
df55b742ad12cada59969a9814e6dc235902660f456bf4af4169a8449811713fa1562d80feab38e1a79851e651620ca6d7839a1d5686ec0360ac0e0247216c49

Download Submit
C:\Windows\System\WAKPlPJ.exe

Filesize
1.4MB

MD5
936ba58387e21cf6305efa37a59497dc

SHA1
532e920723b4d3d4de9d626c56d3e59e4485cd4c

SHA256
cb5abddf8622b282fcd3957a587cf042608590689fd6175873750604656d1ace

SHA512
45988c153107d8d2012d013d448a3906185346c6632b9fdf31ec7a2c2ce626310bebebe01bdb6231a5a08f39ba409baeaed2681041fe2233ddcfdb7e370fc1ba

Download Submit
C:\Windows\System\dXdWtjS.exe

Filesize
1.4MB

MD5
d58078fbbab5d890e034e85163682d42

SHA1
a4c7fd219365faedac6da14828715edff1743393

SHA256
21135b73dd2cbb6f9b8c3330da37dd7364b1b8d74938d9374cf16c7a42757bf5

SHA512
a5d8dc539467f0739c55e6be95aad551df38eaf7721ca836ab89357f64ac1ffbcc0ee1c83d708ba3b68f4db7d5b9543fab91e617a8d586a4ebd5902318dd9647

Download Submit
C:\Windows\System\hCyJopv.exe

Filesize
1.4MB

MD5
3e88a20ba5b8d82e9c288032505830d1

SHA1
9ab959ee42641b6916c3a5805c040686b4cb5383

SHA256
12037049320552c5a227515dbe3aa53974d5941ac2169d50ba2084f233721d9e

SHA512
86afd50761eeb0c324a0cd8fb3e15cc22f0c82bd0f8a4671c3c1dee4ac93da4cdd6702ca23ab8d1566ed2f0071cc214ba0efa7c5c7a899b918d5c04d61fabf76

Download Submit
C:\Windows\System\hFYwvHR.exe

Filesize
1.4MB

MD5
fe357c14c12558d274f25a0ed29d63b7

SHA1
ac9addbb3a24fd8c01167f2fef9bf4d293f9f98f

SHA256
186bfdbb64739116da2d9cc4c8aee980e0481e99e02f0e8980a3abc80bfca443

SHA512
18228c51f1f7522ef8c868ec3045c400fbf5b09502008e1790077d1525cf6813927688c364b79d4f4848b145de03e7bd989e57b75ff5d6b4f85bf3160479443e

Download Submit
C:\Windows\System\jGYcOPO.exe

Filesize
1.4MB

MD5
610a282d6f10f4abb2013ba66cdedf47

SHA1
c692902ef1d034e6304a5c498105717c410b0a43

SHA256
b985ef5d0d432f70a822d145b036669621e74683d655d249ca0f95bbf8687988

SHA512
804b2ade81db7dc3a1f9ccdf7bd4492278ec393de774231374a7ec33826c31a37c7313d1024084510698bc7b626e12e5b9153b0aa6456078ed211acee036cf58

Download Submit
C:\Windows\System\kbsVjGF.exe

Filesize
18B

MD5
6411c3d97015ad018439164e6cc72d57

SHA1
a21fdfcfecfb11934b692bfe95c70467d3d79fae

SHA256
bff39d8252fc9a7568d21ba3b00ac1fb0f4e4b5566d4a69801a9b20f67c18d89

SHA512
db699d138e29f5f70986de9b05154024050049a3f4a51601ad2f9ec1f5445e06bdde3278b61fdd691f10d6feefcf18182217170ef30271dc66ae405cdd5df2d1

Download Submit
C:\Windows\System\lKzqeyo.exe

Filesize
1.4MB

MD5
57d5e51a5c07c91206962ae35b61f940

SHA1
4d31fe61d228b5fb9edb513cd7f8bed2ca927a45

SHA256
436b7fb4336aab112511071233d8626f17263de2ee8b9d6aa212cef57618e6d7

SHA512
8e541a9f895dd1f6f3f11365f0f61fb2f311eca46b374f475572e5a152bdb9d1b55aef25d21d71c713230d8a8c4f30b322c515e13a5c5353563e6e09a4b1f9f1

Download Submit
C:\Windows\System\lzhWBsB.exe

Filesize
1.4MB

MD5
1e300109c5b72207d08ba37e9d2ef3a3

SHA1
8970e1ce91b9292216e4258560d9625234b3846c

SHA256
09644091141816f7b662e92cf29a5ada14fed4aad35c1c34b13d8dca9aa7c959

SHA512
6fa7243cd66b8dda92bb68f858b50c003c80b585a5f1d7715b50128be373607b0c3f0301c402dea41656b678acbac5ef97aa19168cd35fe9a8ad8b473189f68b

Download Submit
C:\Windows\System\rQjeegX.exe

Filesize
1.4MB

MD5
b5ce3bf4a05ab2c1b2e1a1ae41ed7cd7

SHA1
92596c1dffa5db13af302b9fdf5a333e221914bd

SHA256
05be52be0a08f516f816c63317b32c6a1e51bf425efbc7d7865753dd43e45e7a

SHA512
a43aba3a7e2c74654825f808faf98582fcf5dededaa4ff88d95f37581e528c3c2b119538fc0b7195378b9c0d60298f3a1fd7862e0385f49540e16af06fdaef02

Download Submit
C:\Windows\System\tBpXwyT.exe

Filesize
1.4MB

MD5
1786142c81e6f46e87b8159068d2cd92

SHA1
38d06d4a7cdadd7b81a299cde66fdae94041467a

SHA256
9a4e6f874c249245e89afda887b34fb25014de7625ed497d9c723abcbf403f77

SHA512
3862511ac213cd5deca9499c37a27832481b528e8c4c4b4808cf587c83e253379e6d7dcd7f41e9fab298139219c9100e22db7c1d02708573523becda4c2856e6

Download Submit
C:\Windows\System\tkdXNcY.exe

Filesize
1.4MB

MD5
8129185533e3bca7680ec9b13e2996fb

SHA1
8157d4cc6d16ef5e88bb952f6088e661abf90ae7

SHA256
1f18c75bd7b7d683a0291bd1fd98d5dca6432f5848e1a6569ee50bbdc7c4e804

SHA512
2f4a6e1043c7d9cb42e0d39dab454746ff78faba34324292cfa7a512ebe9c2cbfbe7ef356480ec2f0f7263005d0ede374c899766949db6ed85cd2d3809540d1d

Download Submit
C:\Windows\System\toukMMP.exe

Filesize
1.4MB

MD5
7843afc05ef9519fa8165baad29640dc

SHA1
2e3233ee66fcb453e534cdf695213a39874d40ba

SHA256
1363038f02e022b51e12bc2333f158371d02249515acc67fe95cbc21411b6ff6

SHA512
807b6089b8dd34cdf23aff5d84dc8b8da8923f66c246524adb151df20f330b83ac7b8a78048aa9736a681228f1a05d4abf384ed713b498e8457c98012d94ce17

Download Submit
C:\Windows\System\xjiHJfJ.exe

Filesize
1.4MB

MD5
f1d4ec8242b50a63eac78895a1ada5e5

SHA1
259380df11a022751ee74620f8ec135d19602783

SHA256
96c0e6b8e163d684e46d59dabe6ec4c94bc93e0238ae66bf93bde0c0e5cfd71a

SHA512
e88f5cf55a4aa22cc38e94265fd53a0fa63858ad82c83a9a4f1a6fc2397f3e5c39b9b668649085d1023210cffd28ab51e7125813d353056d959d1231a001a607

Download Submit
C:\Windows\System\ysuKDmV.exe

Filesize
1.4MB

MD5
8ac31a8649d098bd84f701c243b58b10

SHA1
36e5ca91045874963ad10593b2e2cfcc5a33a649

SHA256
4c9b5d5b19f9cf3ae3d3941ec10a3036da8539fab22b77ca7acd44ae4ba4ef5a

SHA512
990a500f948e5522932370c2e511bc70edffb7cf308980186f450d33ea7388fd908478600fdcd1fc5a15860809408349ac7cd36141aaca65c3e9bb284987015a

Download Submit
C:\Windows\System\zYdACiz.exe

Filesize
1.4MB

MD5
ccbe0ef1a7e117267909c4d807481ae6

SHA1
e3f62aa0113f2365adbc2832c6fa871619fb0a00

SHA256
621035e29981f17f6d12bfe1ade680c96b7223d60a9dab085815c62f68fcdc8a

SHA512
552c5df64f3228d30b88cac33abc9f4d185100939a7480ed392138ca0364d13783b79cc83b558b5848cc7dff6173eb6ff91c45592d7c297e475e1ce26a4c9355

Download Submit
memory/444-3610-0x00007FF75A980000-0x00007FF75AD72000-memory.dmp

Filesize
3.9MB

Download
memory/444-115-0x00007FF75A980000-0x00007FF75AD72000-memory.dmp

Filesize
3.9MB

Download
memory/796-3656-0x00007FF73A650000-0x00007FF73AA42000-memory.dmp

Filesize
3.9MB

Download
memory/796-120-0x00007FF73A650000-0x00007FF73AA42000-memory.dmp

Filesize
3.9MB

Download
memory/956-3622-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp

Filesize
3.9MB

Download
memory/956-117-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1008-630-0x00007FF722390000-0x00007FF722782000-memory.dmp

Filesize
3.9MB

Download
memory/1008-3820-0x00007FF722390000-0x00007FF722782000-memory.dmp

Filesize
3.9MB

Download
memory/1032-112-0x00007FF7AB160000-0x00007FF7AB552000-memory.dmp

Filesize
3.9MB

Download
memory/1032-3594-0x00007FF7AB160000-0x00007FF7AB552000-memory.dmp

Filesize
3.9MB

Download
memory/1344-111-0x00007FF74AD90000-0x00007FF74B182000-memory.dmp

Filesize
3.9MB

Download
memory/1860-3681-0x00007FF63A180000-0x00007FF63A572000-memory.dmp

Filesize
3.9MB

Download
memory/1860-122-0x00007FF63A180000-0x00007FF63A572000-memory.dmp

Filesize
3.9MB

Download
memory/1944-3591-0x00007FF628E40000-0x00007FF629232000-memory.dmp

Filesize
3.9MB

Download
memory/1944-78-0x00007FF628E40000-0x00007FF629232000-memory.dmp

Filesize
3.9MB

Download
memory/2208-3727-0x00007FF77F000000-0x00007FF77F3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-128-0x00007FF77F000000-0x00007FF77F3F2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-3822-0x00007FF74CC50000-0x00007FF74D042000-memory.dmp

Filesize
3.9MB

Download
memory/2244-631-0x00007FF74CC50000-0x00007FF74D042000-memory.dmp

Filesize
3.9MB

Download
memory/2424-3625-0x00007FF6F7550000-0x00007FF6F7942000-memory.dmp

Filesize
3.9MB

Download
memory/2424-126-0x00007FF6F7550000-0x00007FF6F7942000-memory.dmp

Filesize
3.9MB

Download
memory/2524-110-0x00007FF61D750000-0x00007FF61DB42000-memory.dmp

Filesize
3.9MB

Download
memory/2604-3858-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Filesize
10.8MB

Download
memory/2604-289-0x000002101D620000-0x000002101DDC6000-memory.dmp

Filesize
7.6MB

Download
memory/2604-3644-0x00007FFE5BD23000-0x00007FFE5BD25000-memory.dmp

Filesize
8KB

Download
memory/2604-46-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Filesize
10.8MB

Download
memory/2604-11-0x00007FFE5BD23000-0x00007FFE5BD25000-memory.dmp

Filesize
8KB

Download
memory/2604-106-0x000002101CAD0000-0x000002101CAF2000-memory.dmp

Filesize
136KB

Download
memory/2604-3281-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Filesize
10.8MB

Download
memory/2604-89-0x00007FFE5BD20000-0x00007FFE5C7E1000-memory.dmp

Filesize
10.8MB

Download
memory/2660-124-0x00007FF65AD50000-0x00007FF65B142000-memory.dmp

Filesize
3.9MB

Download
memory/2660-3723-0x00007FF65AD50000-0x00007FF65B142000-memory.dmp

Filesize
3.9MB

Download
memory/2692-3662-0x00007FF60BBE0000-0x00007FF60BFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-121-0x00007FF60BBE0000-0x00007FF60BFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-632-0x00007FF682260000-0x00007FF682652000-memory.dmp

Filesize
3.9MB

Download
memory/2936-3824-0x00007FF682260000-0x00007FF682652000-memory.dmp

Filesize
3.9MB

Download
memory/3268-633-0x00007FF7DE550000-0x00007FF7DE942000-memory.dmp

Filesize
3.9MB

Download
memory/3268-3828-0x00007FF7DE550000-0x00007FF7DE942000-memory.dmp

Filesize
3.9MB

Download
memory/3592-125-0x00007FF71BC80000-0x00007FF71C072000-memory.dmp

Filesize
3.9MB

Download
memory/3600-3707-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-4212-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3600-123-0x00007FF750BF0000-0x00007FF750FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4204-3832-0x00007FF62D2A0000-0x00007FF62D692000-memory.dmp

Filesize
3.9MB

Download
memory/4204-634-0x00007FF62D2A0000-0x00007FF62D692000-memory.dmp

Filesize
3.9MB

Download
memory/4300-0-0x00007FF6BE6D0000-0x00007FF6BEAC2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-1-0x0000020396AF0000-0x0000020396B00000-memory.dmp

Filesize
64KB

Download
memory/4524-63-0x00007FF782910000-0x00007FF782D02000-memory.dmp

Filesize
3.9MB

Download
memory/4524-3604-0x00007FF782910000-0x00007FF782D02000-memory.dmp

Filesize
3.9MB

Download
memory/4592-3606-0x00007FF6EFE00000-0x00007FF6F01F2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-116-0x00007FF6EFE00000-0x00007FF6F01F2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-119-0x00007FF71A1B0000-0x00007FF71A5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-3620-0x00007FF71A1B0000-0x00007FF71A5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4980-3658-0x00007FF754FA0000-0x00007FF755392000-memory.dmp

Filesize
3.9MB

Download
memory/4980-127-0x00007FF754FA0000-0x00007FF755392000-memory.dmp

Filesize
3.9MB

Download
memory/5116-3624-0x00007FF647930000-0x00007FF647D22000-memory.dmp

Filesize
3.9MB

Download
memory/5116-118-0x00007FF647930000-0x00007FF647D22000-memory.dmp

Filesize
3.9MB

Download