xmrig | 11986189bf9794b143d409c535ea55540987d6835629f8f8a3096a31b860f078

Analysis

max time kernel
108s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
Size 1.9MB
Sample240522-zbrndsff75
SHA256 11986189bf9794b143d409c535ea55540987d6835629f8f8a3096a31b860f078
MD5 34f4da85e7363c1254b7cf20e5c243d0
SHA1 0f71d8d60613a5e1889f2f91d351faee4230ce22
SHA512 5980ac259745974b8b98397c2783e5ae3cf9cca4ed26809229f8722055f4f5051aee155b43426f01a7c1ffb05748cdf369a572f7a40d2d37a1ff9415cfee20de
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuol:NABO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/2140-9-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp	xmrig
behavioral2/memory/4988-36-0x00007FF68E0C0000-0x00007FF68E4B2000-memory.dmp	xmrig
behavioral2/memory/4004-38-0x00007FF712110000-0x00007FF712502000-memory.dmp	xmrig
behavioral2/memory/4084-40-0x00007FF672F00000-0x00007FF6732F2000-memory.dmp	xmrig
behavioral2/memory/3840-46-0x00007FF774B90000-0x00007FF774F82000-memory.dmp	xmrig
behavioral2/memory/4948-52-0x00007FF6A1F50000-0x00007FF6A2342000-memory.dmp	xmrig
behavioral2/memory/4444-64-0x00007FF6D46C0000-0x00007FF6D4AB2000-memory.dmp	xmrig
behavioral2/memory/1480-77-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	xmrig
behavioral2/memory/2284-72-0x00007FF792790000-0x00007FF792B82000-memory.dmp	xmrig
behavioral2/memory/2140-89-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp	xmrig
behavioral2/memory/4296-79-0x00007FF682030000-0x00007FF682422000-memory.dmp	xmrig
behavioral2/memory/1480-96-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	xmrig
behavioral2/memory/4232-107-0x00007FF6AB070000-0x00007FF6AB462000-memory.dmp	xmrig
behavioral2/memory/4720-119-0x00007FF793560000-0x00007FF793952000-memory.dmp	xmrig
behavioral2/memory/4696-120-0x00007FF739B00000-0x00007FF739EF2000-memory.dmp	xmrig
behavioral2/memory/3400-122-0x00007FF7F0820000-0x00007FF7F0C12000-memory.dmp	xmrig
behavioral2/memory/4256-106-0x00007FF6AB050000-0x00007FF6AB442000-memory.dmp	xmrig
behavioral2/memory/4412-123-0x00007FF7DC080000-0x00007FF7DC472000-memory.dmp	xmrig
behavioral2/memory/3912-130-0x00007FF64CAB0000-0x00007FF64CEA2000-memory.dmp	xmrig
behavioral2/memory/2528-138-0x00007FF786520000-0x00007FF786912000-memory.dmp	xmrig
behavioral2/memory/3288-146-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp	xmrig
behavioral2/memory/1844-148-0x00007FF7E60C0000-0x00007FF7E64B2000-memory.dmp	xmrig
behavioral2/memory/3444-194-0x00007FF73F870000-0x00007FF73FC62000-memory.dmp	xmrig
behavioral2/memory/4168-203-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	xmrig
behavioral2/memory/3620-206-0x00007FF704D70000-0x00007FF705162000-memory.dmp	xmrig
behavioral2/memory/4404-201-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp	xmrig
behavioral2/memory/1480-250-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	xmrig
behavioral2/memory/2140-970-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp	xmrig
behavioral2/memory/4084-973-0x00007FF672F00000-0x00007FF6732F2000-memory.dmp	xmrig
behavioral2/memory/4988-972-0x00007FF68E0C0000-0x00007FF68E4B2000-memory.dmp	xmrig
behavioral2/memory/4004-977-0x00007FF712110000-0x00007FF712502000-memory.dmp	xmrig
behavioral2/memory/3840-1001-0x00007FF774B90000-0x00007FF774F82000-memory.dmp	xmrig
behavioral2/memory/4948-1003-0x00007FF6A1F50000-0x00007FF6A2342000-memory.dmp	xmrig
behavioral2/memory/3288-1018-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp	xmrig
behavioral2/memory/4232-1155-0x00007FF6AB070000-0x00007FF6AB462000-memory.dmp	xmrig
behavioral2/memory/4256-1200-0x00007FF6AB050000-0x00007FF6AB442000-memory.dmp	xmrig
behavioral2/memory/4412-1311-0x00007FF7DC080000-0x00007FF7DC472000-memory.dmp	xmrig
behavioral2/memory/4696-1319-0x00007FF739B00000-0x00007FF739EF2000-memory.dmp	xmrig
behavioral2/memory/4404-1580-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp	xmrig
behavioral2/memory/3620-1603-0x00007FF704D70000-0x00007FF705162000-memory.dmp	xmrig
behavioral2/memory/4168-1560-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	xmrig
behavioral2/memory/3444-1488-0x00007FF73F870000-0x00007FF73FC62000-memory.dmp	xmrig
behavioral2/memory/1844-1463-0x00007FF7E60C0000-0x00007FF7E64B2000-memory.dmp	xmrig
behavioral2/memory/5108-1462-0x00007FF7630D0000-0x00007FF7634C2000-memory.dmp	xmrig
behavioral2/memory/2528-1411-0x00007FF786520000-0x00007FF786912000-memory.dmp	xmrig
behavioral2/memory/3912-1349-0x00007FF64CAB0000-0x00007FF64CEA2000-memory.dmp	xmrig
behavioral2/memory/3400-1338-0x00007FF7F0820000-0x00007FF7F0C12000-memory.dmp	xmrig
behavioral2/memory/4720-1267-0x00007FF793560000-0x00007FF793952000-memory.dmp	xmrig
behavioral2/memory/4296-1172-0x00007FF682030000-0x00007FF682422000-memory.dmp	xmrig
behavioral2/memory/2284-1099-0x00007FF792790000-0x00007FF792B82000-memory.dmp	xmrig
behavioral2/memory/4444-1093-0x00007FF6D46C0000-0x00007FF6D4AB2000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
11	536	powershell.exe
14	536	powershell.exe
42	536	powershell.exe
43	536	powershell.exe
51	536	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
536	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2140	CHimUUv.exe
4084	uJONAaP.exe
4988	aSqxrOn.exe
4004	MIyxtkw.exe
3840	wJmEcDZ.exe
4948	esfpNWD.exe
3288	STtDOod.exe
4444	EMrDZDr.exe
2284	JBMRaCm.exe
4296	jjKmYYT.exe
4256	xukScsF.exe
4232	fcarhrI.exe
4720	HkVhdzA.exe
4696	wVAfzsM.exe
3400	RsLbqat.exe
4412	wpHbjcg.exe
3912	vxqqRHG.exe
2528	AghOSwm.exe
5108	XTTIQcz.exe
1844	WIaeKZc.exe
3444	nGUpFIS.exe
4404	erytwwg.exe
4168	BDJjYdP.exe
3620	MDxyyCv.exe
4972	lvKiyHR.exe
4992	YxYqbJb.exe
2876	HYDVewf.exe
1380	vYNioZy.exe
4756	NOsnlSC.exe
800	AtAuxhi.exe
4076	UEpuNBN.exe
4744	VJgrMFy.exe
2784	WDckPUk.exe
2272	eReeGll.exe
3136	rhVbujq.exe
2368	YtbYMLZ.exe
4332	IAcQhSj.exe
1960	IpGSXcl.exe
3060	fZFusJB.exe
3368	UZplfim.exe
4892	tXHRIpO.exe
4912	POdXmqn.exe
1288	ZvRxMWy.exe
3308	wrTdeof.exe
4828	VPCEUVR.exe
1276	XJdWmRO.exe
4904	rTCqzEx.exe
1704	bhBfbMK.exe
4588	uwaJjfv.exe
1968	bJIkDmG.exe
2356	VIFTaMJ.exe
3244	BtNDvmc.exe
4008	UlOIGjY.exe
3792	aRDjxzo.exe
2248	GiNXhPU.exe
2744	UdtFurQ.exe
2392	rPsqwVw.exe
1104	cjWSwrG.exe
1492	vzLDFnz.exe
4628	LUQgKpY.exe
4748	fKnuKKW.exe
4604	jpBufXR.exe
3536	EiSuKPQ.exe
5160	OxRowTY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1480-0-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	upx
behavioral2/files/0x0009000000023285-7.dat	upx
behavioral2/memory/2140-9-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp	upx
behavioral2/files/0x0008000000023288-16.dat	upx
behavioral2/files/0x000700000002328e-17.dat	upx
behavioral2/files/0x000800000002328a-32.dat	upx
behavioral2/memory/4988-36-0x00007FF68E0C0000-0x00007FF68E4B2000-memory.dmp	upx
behavioral2/memory/4004-38-0x00007FF712110000-0x00007FF712502000-memory.dmp	upx
behavioral2/memory/4084-40-0x00007FF672F00000-0x00007FF6732F2000-memory.dmp	upx
behavioral2/files/0x000900000002328c-42.dat	upx
behavioral2/memory/3840-46-0x00007FF774B90000-0x00007FF774F82000-memory.dmp	upx
behavioral2/files/0x000900000002328d-50.dat	upx
behavioral2/memory/4948-52-0x00007FF6A1F50000-0x00007FF6A2342000-memory.dmp	upx
behavioral2/files/0x000700000002328f-54.dat	upx
behavioral2/memory/3288-57-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp	upx
behavioral2/files/0x0007000000023291-62.dat	upx
behavioral2/memory/4444-64-0x00007FF6D46C0000-0x00007FF6D4AB2000-memory.dmp	upx
behavioral2/files/0x0007000000023292-67.dat	upx
behavioral2/files/0x0007000000023293-74.dat	upx
behavioral2/memory/1480-77-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	upx
behavioral2/memory/2284-72-0x00007FF792790000-0x00007FF792B82000-memory.dmp	upx
behavioral2/files/0x0007000000023294-81.dat	upx
behavioral2/files/0x0007000000023295-87.dat	upx
behavioral2/memory/2140-89-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp	upx
behavioral2/files/0x0007000000023296-93.dat	upx
behavioral2/memory/4296-79-0x00007FF682030000-0x00007FF682422000-memory.dmp	upx
behavioral2/memory/1480-96-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	upx
behavioral2/files/0x0007000000023297-103.dat	upx
behavioral2/memory/4232-107-0x00007FF6AB070000-0x00007FF6AB462000-memory.dmp	upx
behavioral2/files/0x0007000000023298-111.dat	upx
behavioral2/files/0x0007000000023299-117.dat	upx
behavioral2/memory/4720-119-0x00007FF793560000-0x00007FF793952000-memory.dmp	upx
behavioral2/memory/4696-120-0x00007FF739B00000-0x00007FF739EF2000-memory.dmp	upx
behavioral2/memory/3400-122-0x00007FF7F0820000-0x00007FF7F0C12000-memory.dmp	upx
behavioral2/memory/4256-106-0x00007FF6AB050000-0x00007FF6AB442000-memory.dmp	upx
behavioral2/memory/4412-123-0x00007FF7DC080000-0x00007FF7DC472000-memory.dmp	upx
behavioral2/files/0x000700000002329a-126.dat	upx
behavioral2/memory/3912-130-0x00007FF64CAB0000-0x00007FF64CEA2000-memory.dmp	upx
behavioral2/files/0x000700000002329b-131.dat	upx
behavioral2/files/0x000700000002329c-137.dat	upx
behavioral2/memory/2528-138-0x00007FF786520000-0x00007FF786912000-memory.dmp	upx
behavioral2/memory/5108-140-0x00007FF7630D0000-0x00007FF7634C2000-memory.dmp	upx
behavioral2/files/0x000700000002329d-145.dat	upx
behavioral2/memory/3288-146-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp	upx
behavioral2/memory/1844-148-0x00007FF7E60C0000-0x00007FF7E64B2000-memory.dmp	upx
behavioral2/files/0x000700000002329e-151.dat	upx
behavioral2/files/0x000700000002329f-155.dat	upx
behavioral2/files/0x00070000000232a0-159.dat	upx
behavioral2/files/0x00070000000232a1-164.dat	upx
behavioral2/files/0x00070000000232a2-169.dat	upx
behavioral2/files/0x00070000000232a3-176.dat	upx
behavioral2/files/0x00070000000232a4-180.dat	upx
behavioral2/files/0x00070000000232a5-183.dat	upx
behavioral2/files/0x00070000000232a6-195.dat	upx
behavioral2/memory/3444-194-0x00007FF73F870000-0x00007FF73FC62000-memory.dmp	upx
behavioral2/memory/4168-203-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp	upx
behavioral2/memory/3620-206-0x00007FF704D70000-0x00007FF705162000-memory.dmp	upx
behavioral2/files/0x00070000000232a7-205.dat	upx
behavioral2/memory/4404-201-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp	upx
behavioral2/files/0x00070000000232a8-212.dat	upx
behavioral2/files/0x00070000000232a9-215.dat	upx
behavioral2/files/0x00070000000232aa-221.dat	upx
behavioral2/memory/1480-250-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp	upx
behavioral2/memory/2140-970-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eBzHWUQ.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\lVJhegi.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\ruRnxNI.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\xNEWFMF.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\guiZBRn.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\WjuWZkQ.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\HsphTOT.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\SOnUHOy.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\KGhSWdm.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\gcmfPfo.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\dyuDRsO.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\SjvewhN.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\rhVbujq.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\tJUOzcz.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\cEFcJHE.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\XmVVEVH.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\FELvbzx.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\ynYSwxw.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\YLDHvCC.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\LxRKpFC.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\aSqxrOn.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\jnVjaTv.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\TkZxiRI.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\XmoIyoV.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\BzYmNrQ.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\jhfokNd.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\NvYkkhx.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\lSiDvJt.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZqmnfwR.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\GHRfDXb.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\TGaFOnP.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\dApuDst.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\vBmnXnU.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\iDmdbGM.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\HLiBJDY.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\VEcEjqg.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\MXsolda.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\tLQJvQd.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\gwgGtaA.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\TumZIuL.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\cKRKVHG.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\vMgcGJV.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\rRjugpv.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\hRkXNtx.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\cjWSwrG.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\biBRuAe.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\FOvwXnJ.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\xRDqwAp.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\eGifGBS.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\GfpxLwQ.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\XTTIQcz.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZBWJNry.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\rbarisp.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\vOXgjWF.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\jjiuqVr.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\OnJtzdQ.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\YqBskel.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\tbKaTjC.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\eqbwGob.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\FGtvVFh.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\xaOxjqU.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\xqExTur.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\EBnlKAi.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
File created	C:\Windows\System\nsgujnA.exe	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	powershell.exe
536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeLockMemoryPrivilege	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 536	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	92
PID 1480 wrote to memory of 536	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	92
PID 1480 wrote to memory of 2140	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	93
PID 1480 wrote to memory of 2140	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	93
PID 1480 wrote to memory of 4084	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	94
PID 1480 wrote to memory of 4084	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	94
PID 1480 wrote to memory of 4988	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	95
PID 1480 wrote to memory of 4988	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	95
PID 1480 wrote to memory of 4004	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	96
PID 1480 wrote to memory of 4004	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	96
PID 1480 wrote to memory of 3840	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	97
PID 1480 wrote to memory of 3840	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	97
PID 1480 wrote to memory of 4948	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	98
PID 1480 wrote to memory of 4948	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	98
PID 1480 wrote to memory of 3288	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	99
PID 1480 wrote to memory of 3288	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	99
PID 1480 wrote to memory of 4444	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	100
PID 1480 wrote to memory of 4444	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	100
PID 1480 wrote to memory of 2284	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	101
PID 1480 wrote to memory of 2284	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	101
PID 1480 wrote to memory of 4296	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	102
PID 1480 wrote to memory of 4296	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	102
PID 1480 wrote to memory of 4256	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	103
PID 1480 wrote to memory of 4256	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	103
PID 1480 wrote to memory of 4232	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	104
PID 1480 wrote to memory of 4232	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	104
PID 1480 wrote to memory of 4720	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	105
PID 1480 wrote to memory of 4720	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	105
PID 1480 wrote to memory of 4696	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	106
PID 1480 wrote to memory of 4696	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	106
PID 1480 wrote to memory of 3400	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	107
PID 1480 wrote to memory of 3400	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	107
PID 1480 wrote to memory of 4412	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	108
PID 1480 wrote to memory of 4412	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	108
PID 1480 wrote to memory of 3912	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	109
PID 1480 wrote to memory of 3912	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	109
PID 1480 wrote to memory of 2528	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	110
PID 1480 wrote to memory of 2528	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	110
PID 1480 wrote to memory of 5108	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	111
PID 1480 wrote to memory of 5108	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	111
PID 1480 wrote to memory of 1844	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	112
PID 1480 wrote to memory of 1844	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	112
PID 1480 wrote to memory of 3444	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	113
PID 1480 wrote to memory of 3444	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	113
PID 1480 wrote to memory of 4404	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	114
PID 1480 wrote to memory of 4404	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	114
PID 1480 wrote to memory of 4168	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	115
PID 1480 wrote to memory of 4168	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	115
PID 1480 wrote to memory of 3620	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	116
PID 1480 wrote to memory of 3620	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	116
PID 1480 wrote to memory of 4972	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	117
PID 1480 wrote to memory of 4972	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	117
PID 1480 wrote to memory of 4992	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	118
PID 1480 wrote to memory of 4992	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	118
PID 1480 wrote to memory of 2876	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	119
PID 1480 wrote to memory of 2876	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	119
PID 1480 wrote to memory of 1380	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	120
PID 1480 wrote to memory of 1380	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	120
PID 1480 wrote to memory of 4756	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	121
PID 1480 wrote to memory of 4756	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	121
PID 1480 wrote to memory of 800	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	122
PID 1480 wrote to memory of 800	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	122
PID 1480 wrote to memory of 4076	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	123
PID 1480 wrote to memory of 4076	1480	34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe	123

C:\Users\Admin\AppData\Local\Temp\34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\34f4da85e7363c1254b7cf20e5c243d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System\CHimUUv.exe
  C:\Windows\System\CHimUUv.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\uJONAaP.exe
  C:\Windows\System\uJONAaP.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\aSqxrOn.exe
  C:\Windows\System\aSqxrOn.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\MIyxtkw.exe
  C:\Windows\System\MIyxtkw.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\wJmEcDZ.exe
  C:\Windows\System\wJmEcDZ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\esfpNWD.exe
  C:\Windows\System\esfpNWD.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\STtDOod.exe
  C:\Windows\System\STtDOod.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\EMrDZDr.exe
  C:\Windows\System\EMrDZDr.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\JBMRaCm.exe
  C:\Windows\System\JBMRaCm.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\jjKmYYT.exe
  C:\Windows\System\jjKmYYT.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\xukScsF.exe
  C:\Windows\System\xukScsF.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\fcarhrI.exe
  C:\Windows\System\fcarhrI.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\HkVhdzA.exe
  C:\Windows\System\HkVhdzA.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\wVAfzsM.exe
  C:\Windows\System\wVAfzsM.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\RsLbqat.exe
  C:\Windows\System\RsLbqat.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\wpHbjcg.exe
  C:\Windows\System\wpHbjcg.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\vxqqRHG.exe
  C:\Windows\System\vxqqRHG.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\AghOSwm.exe
  C:\Windows\System\AghOSwm.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\XTTIQcz.exe
  C:\Windows\System\XTTIQcz.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\WIaeKZc.exe
  C:\Windows\System\WIaeKZc.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\nGUpFIS.exe
  C:\Windows\System\nGUpFIS.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\erytwwg.exe
  C:\Windows\System\erytwwg.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\BDJjYdP.exe
  C:\Windows\System\BDJjYdP.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\MDxyyCv.exe
  C:\Windows\System\MDxyyCv.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\lvKiyHR.exe
  C:\Windows\System\lvKiyHR.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\YxYqbJb.exe
  C:\Windows\System\YxYqbJb.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\HYDVewf.exe
  C:\Windows\System\HYDVewf.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\vYNioZy.exe
  C:\Windows\System\vYNioZy.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\NOsnlSC.exe
  C:\Windows\System\NOsnlSC.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\AtAuxhi.exe
  C:\Windows\System\AtAuxhi.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\UEpuNBN.exe
  C:\Windows\System\UEpuNBN.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\VJgrMFy.exe
  C:\Windows\System\VJgrMFy.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\WDckPUk.exe
  C:\Windows\System\WDckPUk.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\eReeGll.exe
  C:\Windows\System\eReeGll.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\rhVbujq.exe
  C:\Windows\System\rhVbujq.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\YtbYMLZ.exe
  C:\Windows\System\YtbYMLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\IAcQhSj.exe
  C:\Windows\System\IAcQhSj.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\IpGSXcl.exe
  C:\Windows\System\IpGSXcl.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\fZFusJB.exe
  C:\Windows\System\fZFusJB.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\UZplfim.exe
  C:\Windows\System\UZplfim.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\tXHRIpO.exe
  C:\Windows\System\tXHRIpO.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\POdXmqn.exe
  C:\Windows\System\POdXmqn.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\ZvRxMWy.exe
  C:\Windows\System\ZvRxMWy.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\wrTdeof.exe
  C:\Windows\System\wrTdeof.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\VPCEUVR.exe
  C:\Windows\System\VPCEUVR.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\XJdWmRO.exe
  C:\Windows\System\XJdWmRO.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\rTCqzEx.exe
  C:\Windows\System\rTCqzEx.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\bhBfbMK.exe
  C:\Windows\System\bhBfbMK.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\uwaJjfv.exe
  C:\Windows\System\uwaJjfv.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\bJIkDmG.exe
  C:\Windows\System\bJIkDmG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\VIFTaMJ.exe
  C:\Windows\System\VIFTaMJ.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\BtNDvmc.exe
  C:\Windows\System\BtNDvmc.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\UlOIGjY.exe
  C:\Windows\System\UlOIGjY.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\aRDjxzo.exe
  C:\Windows\System\aRDjxzo.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\GiNXhPU.exe
  C:\Windows\System\GiNXhPU.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\UdtFurQ.exe
  C:\Windows\System\UdtFurQ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\rPsqwVw.exe
  C:\Windows\System\rPsqwVw.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\cjWSwrG.exe
  C:\Windows\System\cjWSwrG.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\vzLDFnz.exe
  C:\Windows\System\vzLDFnz.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\LUQgKpY.exe
  C:\Windows\System\LUQgKpY.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\fKnuKKW.exe
  C:\Windows\System\fKnuKKW.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\jpBufXR.exe
  C:\Windows\System\jpBufXR.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\EiSuKPQ.exe
  C:\Windows\System\EiSuKPQ.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\OxRowTY.exe
  C:\Windows\System\OxRowTY.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\DygdVKA.exe
  C:\Windows\System\DygdVKA.exe
  2⤵
  PID:5188
- C:\Windows\System\OQIOeCs.exe
  C:\Windows\System\OQIOeCs.exe
  2⤵
  PID:5292
- C:\Windows\System\GuJnPFS.exe
  C:\Windows\System\GuJnPFS.exe
  2⤵
  PID:5316
- C:\Windows\System\VisXskU.exe
  C:\Windows\System\VisXskU.exe
  2⤵
  PID:5348
- C:\Windows\System\AYGcnDj.exe
  C:\Windows\System\AYGcnDj.exe
  2⤵
  PID:5384
- C:\Windows\System\qfHKJQN.exe
  C:\Windows\System\qfHKJQN.exe
  2⤵
  PID:5412
- C:\Windows\System\miJvefC.exe
  C:\Windows\System\miJvefC.exe
  2⤵
  PID:5444
- C:\Windows\System\LnWvlbk.exe
  C:\Windows\System\LnWvlbk.exe
  2⤵
  PID:5464
- C:\Windows\System\uSQGsOR.exe
  C:\Windows\System\uSQGsOR.exe
  2⤵
  PID:5504
- C:\Windows\System\lluQGJS.exe
  C:\Windows\System\lluQGJS.exe
  2⤵
  PID:5524
- C:\Windows\System\EJDptsU.exe
  C:\Windows\System\EJDptsU.exe
  2⤵
  PID:5572
- C:\Windows\System\JbHKkrn.exe
  C:\Windows\System\JbHKkrn.exe
  2⤵
  PID:5604
- C:\Windows\System\sYglYrE.exe
  C:\Windows\System\sYglYrE.exe
  2⤵
  PID:5632
- C:\Windows\System\XmVVEVH.exe
  C:\Windows\System\XmVVEVH.exe
  2⤵
  PID:5660
- C:\Windows\System\TLwvGXC.exe
  C:\Windows\System\TLwvGXC.exe
  2⤵
  PID:5680
- C:\Windows\System\IxNLOir.exe
  C:\Windows\System\IxNLOir.exe
  2⤵
  PID:5716
- C:\Windows\System\KVWmUEb.exe
  C:\Windows\System\KVWmUEb.exe
  2⤵
  PID:5744
- C:\Windows\System\qyObjui.exe
  C:\Windows\System\qyObjui.exe
  2⤵
  PID:5772
- C:\Windows\System\XozrgPT.exe
  C:\Windows\System\XozrgPT.exe
  2⤵
  PID:5832
- C:\Windows\System\ejcmGaV.exe
  C:\Windows\System\ejcmGaV.exe
  2⤵
  PID:5884
- C:\Windows\System\LeufRJi.exe
  C:\Windows\System\LeufRJi.exe
  2⤵
  PID:5948
- C:\Windows\System\gzUOGGs.exe
  C:\Windows\System\gzUOGGs.exe
  2⤵
  PID:5964
- C:\Windows\System\wUpQjov.exe
  C:\Windows\System\wUpQjov.exe
  2⤵
  PID:5988
- C:\Windows\System\shAewAD.exe
  C:\Windows\System\shAewAD.exe
  2⤵
  PID:6008
- C:\Windows\System\VuuZbsd.exe
  C:\Windows\System\VuuZbsd.exe
  2⤵
  PID:6028
- C:\Windows\System\sXdshtO.exe
  C:\Windows\System\sXdshtO.exe
  2⤵
  PID:6088
- C:\Windows\System\NaWFWHS.exe
  C:\Windows\System\NaWFWHS.exe
  2⤵
  PID:6104
- C:\Windows\System\HYuTZIq.exe
  C:\Windows\System\HYuTZIq.exe
  2⤵
  PID:6128
- C:\Windows\System\oRKyuzC.exe
  C:\Windows\System\oRKyuzC.exe
  2⤵
  PID:4300
- C:\Windows\System\UbIdViJ.exe
  C:\Windows\System\UbIdViJ.exe
  2⤵
  PID:748
- C:\Windows\System\jMkCXEB.exe
  C:\Windows\System\jMkCXEB.exe
  2⤵
  PID:5208
- C:\Windows\System\aXTxUAn.exe
  C:\Windows\System\aXTxUAn.exe
  2⤵
  PID:5324
- C:\Windows\System\ptBvRyy.exe
  C:\Windows\System\ptBvRyy.exe
  2⤵
  PID:5332
- C:\Windows\System\MMMgDDC.exe
  C:\Windows\System\MMMgDDC.exe
  2⤵
  PID:5396
- C:\Windows\System\pVUSBUh.exe
  C:\Windows\System\pVUSBUh.exe
  2⤵
  PID:5440
- C:\Windows\System\lyHqNkd.exe
  C:\Windows\System\lyHqNkd.exe
  2⤵
  PID:5500
- C:\Windows\System\XsaqsRH.exe
  C:\Windows\System\XsaqsRH.exe
  2⤵
  PID:5516
- C:\Windows\System\AwBiMqb.exe
  C:\Windows\System\AwBiMqb.exe
  2⤵
  PID:5540
- C:\Windows\System\tieOQac.exe
  C:\Windows\System\tieOQac.exe
  2⤵
  PID:5676
- C:\Windows\System\AcouOPP.exe
  C:\Windows\System\AcouOPP.exe
  2⤵
  PID:5752
- C:\Windows\System\FJXcOvQ.exe
  C:\Windows\System\FJXcOvQ.exe
  2⤵
  PID:5820
- C:\Windows\System\NmbYxuJ.exe
  C:\Windows\System\NmbYxuJ.exe
  2⤵
  PID:5828
- C:\Windows\System\jjiuqVr.exe
  C:\Windows\System\jjiuqVr.exe
  2⤵
  PID:5876
- C:\Windows\System\YixiwmZ.exe
  C:\Windows\System\YixiwmZ.exe
  2⤵
  PID:5600
- C:\Windows\System\wfRYBJW.exe
  C:\Windows\System\wfRYBJW.exe
  2⤵
  PID:5980
- C:\Windows\System\cznhDcv.exe
  C:\Windows\System\cznhDcv.exe
  2⤵
  PID:6020
- C:\Windows\System\ZdVxQJO.exe
  C:\Windows\System\ZdVxQJO.exe
  2⤵
  PID:4460
- C:\Windows\System\qEQNLlE.exe
  C:\Windows\System\qEQNLlE.exe
  2⤵
  PID:6096
- C:\Windows\System\djRJPcH.exe
  C:\Windows\System\djRJPcH.exe
  2⤵
  PID:6136
- C:\Windows\System\XCdJOdL.exe
  C:\Windows\System\XCdJOdL.exe
  2⤵
  PID:5512
- C:\Windows\System\DkRvdJG.exe
  C:\Windows\System\DkRvdJG.exe
  2⤵
  PID:5668
- C:\Windows\System\FELvbzx.exe
  C:\Windows\System\FELvbzx.exe
  2⤵
  PID:2476
- C:\Windows\System\ofulqPL.exe
  C:\Windows\System\ofulqPL.exe
  2⤵
  PID:5892
- C:\Windows\System\bjILRdE.exe
  C:\Windows\System\bjILRdE.exe
  2⤵
  PID:5848
- C:\Windows\System\zsSGfcm.exe
  C:\Windows\System\zsSGfcm.exe
  2⤵
  PID:6004
- C:\Windows\System\BnMRSSJ.exe
  C:\Windows\System\BnMRSSJ.exe
  2⤵
  PID:6084
- C:\Windows\System\pLEPBEm.exe
  C:\Windows\System\pLEPBEm.exe
  2⤵
  PID:6120
- C:\Windows\System\UDkoWJU.exe
  C:\Windows\System\UDkoWJU.exe
  2⤵
  PID:5284
- C:\Windows\System\kQYRSMp.exe
  C:\Windows\System\kQYRSMp.exe
  2⤵
  PID:2204
- C:\Windows\System\hJiHiTm.exe
  C:\Windows\System\hJiHiTm.exe
  2⤵
  PID:2872
- C:\Windows\System\MxdChsW.exe
  C:\Windows\System\MxdChsW.exe
  2⤵
  PID:6052
- C:\Windows\System\BTyfied.exe
  C:\Windows\System\BTyfied.exe
  2⤵
  PID:5864
- C:\Windows\System\PFraZLI.exe
  C:\Windows\System\PFraZLI.exe
  2⤵
  PID:6176
- C:\Windows\System\mJakwNM.exe
  C:\Windows\System\mJakwNM.exe
  2⤵
  PID:6196
- C:\Windows\System\azHkpUu.exe
  C:\Windows\System\azHkpUu.exe
  2⤵
  PID:6216
- C:\Windows\System\RiCIZQT.exe
  C:\Windows\System\RiCIZQT.exe
  2⤵
  PID:6236
- C:\Windows\System\lqtLAEG.exe
  C:\Windows\System\lqtLAEG.exe
  2⤵
  PID:6264
- C:\Windows\System\iBwUmxv.exe
  C:\Windows\System\iBwUmxv.exe
  2⤵
  PID:6288
- C:\Windows\System\iiqBmyJ.exe
  C:\Windows\System\iiqBmyJ.exe
  2⤵
  PID:6316
- C:\Windows\System\yUgFQnK.exe
  C:\Windows\System\yUgFQnK.exe
  2⤵
  PID:6336
- C:\Windows\System\jYHBtiS.exe
  C:\Windows\System\jYHBtiS.exe
  2⤵
  PID:6360
- C:\Windows\System\guiZBRn.exe
  C:\Windows\System\guiZBRn.exe
  2⤵
  PID:6408
- C:\Windows\System\AtBnNfl.exe
  C:\Windows\System\AtBnNfl.exe
  2⤵
  PID:6440
- C:\Windows\System\uamntQD.exe
  C:\Windows\System\uamntQD.exe
  2⤵
  PID:6468
- C:\Windows\System\GDylLeg.exe
  C:\Windows\System\GDylLeg.exe
  2⤵
  PID:6488
- C:\Windows\System\rwaBFmD.exe
  C:\Windows\System\rwaBFmD.exe
  2⤵
  PID:6508
- C:\Windows\System\AgbaHUC.exe
  C:\Windows\System\AgbaHUC.exe
  2⤵
  PID:6556
- C:\Windows\System\WgDCvOt.exe
  C:\Windows\System\WgDCvOt.exe
  2⤵
  PID:6576
- C:\Windows\System\ZBWJNry.exe
  C:\Windows\System\ZBWJNry.exe
  2⤵
  PID:6592
- C:\Windows\System\jhujFOA.exe
  C:\Windows\System\jhujFOA.exe
  2⤵
  PID:6632
- C:\Windows\System\mOgNtIv.exe
  C:\Windows\System\mOgNtIv.exe
  2⤵
  PID:6656
- C:\Windows\System\CXXoIyI.exe
  C:\Windows\System\CXXoIyI.exe
  2⤵
  PID:6676
- C:\Windows\System\dBXPNFF.exe
  C:\Windows\System\dBXPNFF.exe
  2⤵
  PID:6692
- C:\Windows\System\ipYCoQZ.exe
  C:\Windows\System\ipYCoQZ.exe
  2⤵
  PID:6728
- C:\Windows\System\WbgSNEz.exe
  C:\Windows\System\WbgSNEz.exe
  2⤵
  PID:6784
- C:\Windows\System\lZECSMc.exe
  C:\Windows\System\lZECSMc.exe
  2⤵
  PID:6804
- C:\Windows\System\HLiBJDY.exe
  C:\Windows\System\HLiBJDY.exe
  2⤵
  PID:6840
- C:\Windows\System\rbarisp.exe
  C:\Windows\System\rbarisp.exe
  2⤵
  PID:6868
- C:\Windows\System\piWjfpc.exe
  C:\Windows\System\piWjfpc.exe
  2⤵
  PID:6892
- C:\Windows\System\IBMoXyk.exe
  C:\Windows\System\IBMoXyk.exe
  2⤵
  PID:6912
- C:\Windows\System\WRZFoHX.exe
  C:\Windows\System\WRZFoHX.exe
  2⤵
  PID:6972
- C:\Windows\System\IvsMlUx.exe
  C:\Windows\System\IvsMlUx.exe
  2⤵
  PID:6996
- C:\Windows\System\CsLqsyr.exe
  C:\Windows\System\CsLqsyr.exe
  2⤵
  PID:7024
- C:\Windows\System\GHRfDXb.exe
  C:\Windows\System\GHRfDXb.exe
  2⤵
  PID:7048
- C:\Windows\System\XCYVbMl.exe
  C:\Windows\System\XCYVbMl.exe
  2⤵
  PID:7076
- C:\Windows\System\BhyUpJy.exe
  C:\Windows\System\BhyUpJy.exe
  2⤵
  PID:7092
- C:\Windows\System\PBjpKXX.exe
  C:\Windows\System\PBjpKXX.exe
  2⤵
  PID:7152
- C:\Windows\System\omuqVGq.exe
  C:\Windows\System\omuqVGq.exe
  2⤵
  PID:2032
- C:\Windows\System\xFPWITG.exe
  C:\Windows\System\xFPWITG.exe
  2⤵
  PID:6152
- C:\Windows\System\jYeiZwA.exe
  C:\Windows\System\jYeiZwA.exe
  2⤵
  PID:6188
- C:\Windows\System\JQAmYTN.exe
  C:\Windows\System\JQAmYTN.exe
  2⤵
  PID:6232
- C:\Windows\System\hQdJwpY.exe
  C:\Windows\System\hQdJwpY.exe
  2⤵
  PID:6308
- C:\Windows\System\BgBXOkS.exe
  C:\Windows\System\BgBXOkS.exe
  2⤵
  PID:6388
- C:\Windows\System\PQvYUCH.exe
  C:\Windows\System\PQvYUCH.exe
  2⤵
  PID:6532
- C:\Windows\System\ltFKDjR.exe
  C:\Windows\System\ltFKDjR.exe
  2⤵
  PID:6528
- C:\Windows\System\ISNucIB.exe
  C:\Windows\System\ISNucIB.exe
  2⤵
  PID:3688
- C:\Windows\System\BQmVpLi.exe
  C:\Windows\System\BQmVpLi.exe
  2⤵
  PID:6624
- C:\Windows\System\ZsAapDm.exe
  C:\Windows\System\ZsAapDm.exe
  2⤵
  PID:6684
- C:\Windows\System\qvjCHgF.exe
  C:\Windows\System\qvjCHgF.exe
  2⤵
  PID:6668
- C:\Windows\System\JmGjdDX.exe
  C:\Windows\System\JmGjdDX.exe
  2⤵
  PID:6756
- C:\Windows\System\rOuLUym.exe
  C:\Windows\System\rOuLUym.exe
  2⤵
  PID:6828
- C:\Windows\System\YGvQLFz.exe
  C:\Windows\System\YGvQLFz.exe
  2⤵
  PID:6880
- C:\Windows\System\hAWTupL.exe
  C:\Windows\System\hAWTupL.exe
  2⤵
  PID:7004
- C:\Windows\System\NIRjBBi.exe
  C:\Windows\System\NIRjBBi.exe
  2⤵
  PID:7040
- C:\Windows\System\KpBYoHs.exe
  C:\Windows\System\KpBYoHs.exe
  2⤵
  PID:7068
- C:\Windows\System\SxlPzBp.exe
  C:\Windows\System\SxlPzBp.exe
  2⤵
  PID:7120
- C:\Windows\System\iVdvLJX.exe
  C:\Windows\System\iVdvLJX.exe
  2⤵
  PID:6168
- C:\Windows\System\egvLzvU.exe
  C:\Windows\System\egvLzvU.exe
  2⤵
  PID:6448
- C:\Windows\System\UMkMolE.exe
  C:\Windows\System\UMkMolE.exe
  2⤵
  PID:6604
- C:\Windows\System\CeCHvbb.exe
  C:\Windows\System\CeCHvbb.exe
  2⤵
  PID:6796
- C:\Windows\System\ThFnQvX.exe
  C:\Windows\System\ThFnQvX.exe
  2⤵
  PID:6876
- C:\Windows\System\zzeyEiR.exe
  C:\Windows\System\zzeyEiR.exe
  2⤵
  PID:7032
- C:\Windows\System\YNQEoEM.exe
  C:\Windows\System\YNQEoEM.exe
  2⤵
  PID:6280
- C:\Windows\System\zNtpWoD.exe
  C:\Windows\System\zNtpWoD.exe
  2⤵
  PID:6664
- C:\Windows\System\PICbhEw.exe
  C:\Windows\System\PICbhEw.exe
  2⤵
  PID:6332
- C:\Windows\System\lAdnntC.exe
  C:\Windows\System\lAdnntC.exe
  2⤵
  PID:2292
- C:\Windows\System\TGaFOnP.exe
  C:\Windows\System\TGaFOnP.exe
  2⤵
  PID:5172
- C:\Windows\System\EBnlKAi.exe
  C:\Windows\System\EBnlKAi.exe
  2⤵
  PID:6848
- C:\Windows\System\tKwdXFm.exe
  C:\Windows\System\tKwdXFm.exe
  2⤵
  PID:7184
- C:\Windows\System\ndXjZUb.exe
  C:\Windows\System\ndXjZUb.exe
  2⤵
  PID:7208
- C:\Windows\System\eunjVAQ.exe
  C:\Windows\System\eunjVAQ.exe
  2⤵
  PID:7224
- C:\Windows\System\UuZIPef.exe
  C:\Windows\System\UuZIPef.exe
  2⤵
  PID:7252
- C:\Windows\System\XMmYWDq.exe
  C:\Windows\System\XMmYWDq.exe
  2⤵
  PID:7268
- C:\Windows\System\gQrYGCn.exe
  C:\Windows\System\gQrYGCn.exe
  2⤵
  PID:7288
- C:\Windows\System\lrzfrKu.exe
  C:\Windows\System\lrzfrKu.exe
  2⤵
  PID:7304
- C:\Windows\System\UuhwSSX.exe
  C:\Windows\System\UuhwSSX.exe
  2⤵
  PID:7324
- C:\Windows\System\LCgaJdI.exe
  C:\Windows\System\LCgaJdI.exe
  2⤵
  PID:7344
- C:\Windows\System\dIaodNO.exe
  C:\Windows\System\dIaodNO.exe
  2⤵
  PID:7368
- C:\Windows\System\fGgyaaq.exe
  C:\Windows\System\fGgyaaq.exe
  2⤵
  PID:7388
- C:\Windows\System\GfnvRSa.exe
  C:\Windows\System\GfnvRSa.exe
  2⤵
  PID:7408
- C:\Windows\System\jEJYEUS.exe
  C:\Windows\System\jEJYEUS.exe
  2⤵
  PID:7436
- C:\Windows\System\RxzFFTr.exe
  C:\Windows\System\RxzFFTr.exe
  2⤵
  PID:7668
- C:\Windows\System\AFxPicG.exe
  C:\Windows\System\AFxPicG.exe
  2⤵
  PID:7700
- C:\Windows\System\clOFyxK.exe
  C:\Windows\System\clOFyxK.exe
  2⤵
  PID:7716
- C:\Windows\System\CiLvZJT.exe
  C:\Windows\System\CiLvZJT.exe
  2⤵
  PID:7736
- C:\Windows\System\eBzHWUQ.exe
  C:\Windows\System\eBzHWUQ.exe
  2⤵
  PID:7752
- C:\Windows\System\uizNXEw.exe
  C:\Windows\System\uizNXEw.exe
  2⤵
  PID:7768
- C:\Windows\System\TNqdguZ.exe
  C:\Windows\System\TNqdguZ.exe
  2⤵
  PID:7784
- C:\Windows\System\zLZbudS.exe
  C:\Windows\System\zLZbudS.exe
  2⤵
  PID:7800
- C:\Windows\System\EhFOOSw.exe
  C:\Windows\System\EhFOOSw.exe
  2⤵
  PID:7820
- C:\Windows\System\HRhchDH.exe
  C:\Windows\System\HRhchDH.exe
  2⤵
  PID:7836
- C:\Windows\System\tCQNNiw.exe
  C:\Windows\System\tCQNNiw.exe
  2⤵
  PID:7852
- C:\Windows\System\hhFRVTb.exe
  C:\Windows\System\hhFRVTb.exe
  2⤵
  PID:7872
- C:\Windows\System\hbINRJT.exe
  C:\Windows\System\hbINRJT.exe
  2⤵
  PID:7892
- C:\Windows\System\hvfzied.exe
  C:\Windows\System\hvfzied.exe
  2⤵
  PID:7908
- C:\Windows\System\NbczMLM.exe
  C:\Windows\System\NbczMLM.exe
  2⤵
  PID:7924
- C:\Windows\System\nPBHqEe.exe
  C:\Windows\System\nPBHqEe.exe
  2⤵
  PID:7944
- C:\Windows\System\bBddUQx.exe
  C:\Windows\System\bBddUQx.exe
  2⤵
  PID:7968
- C:\Windows\System\rOyMykA.exe
  C:\Windows\System\rOyMykA.exe
  2⤵
  PID:7988
- C:\Windows\System\fngIqcD.exe
  C:\Windows\System\fngIqcD.exe
  2⤵
  PID:8064
- C:\Windows\System\HnvCBZI.exe
  C:\Windows\System\HnvCBZI.exe
  2⤵
  PID:8088
- C:\Windows\System\rlzOffL.exe
  C:\Windows\System\rlzOffL.exe
  2⤵
  PID:8112
- C:\Windows\System\UNhCvxF.exe
  C:\Windows\System\UNhCvxF.exe
  2⤵
  PID:8132
- C:\Windows\System\tVpuDlj.exe
  C:\Windows\System\tVpuDlj.exe
  2⤵
  PID:8168
- C:\Windows\System\VFBXguw.exe
  C:\Windows\System\VFBXguw.exe
  2⤵
  PID:8188
- C:\Windows\System\HXeLXEE.exe
  C:\Windows\System\HXeLXEE.exe
  2⤵
  PID:7180
- C:\Windows\System\sxaqbFg.exe
  C:\Windows\System\sxaqbFg.exe
  2⤵
  PID:7172
- C:\Windows\System\osyYgcg.exe
  C:\Windows\System\osyYgcg.exe
  2⤵
  PID:5156
- C:\Windows\System\yHhDyiS.exe
  C:\Windows\System\yHhDyiS.exe
  2⤵
  PID:5132
- C:\Windows\System\PqeVscy.exe
  C:\Windows\System\PqeVscy.exe
  2⤵
  PID:7232
- C:\Windows\System\AZDRIav.exe
  C:\Windows\System\AZDRIav.exe
  2⤵
  PID:7332
- C:\Windows\System\ekemwFa.exe
  C:\Windows\System\ekemwFa.exe
  2⤵
  PID:7384
- C:\Windows\System\mzpQJht.exe
  C:\Windows\System\mzpQJht.exe
  2⤵
  PID:7296
- C:\Windows\System\XwiozSv.exe
  C:\Windows\System\XwiozSv.exe
  2⤵
  PID:7316
- C:\Windows\System\vdMpmLa.exe
  C:\Windows\System\vdMpmLa.exe
  2⤵
  PID:7336
- C:\Windows\System\VIFVLus.exe
  C:\Windows\System\VIFVLus.exe
  2⤵
  PID:7544
- C:\Windows\System\xqExTur.exe
  C:\Windows\System\xqExTur.exe
  2⤵
  PID:7608
- C:\Windows\System\BaZuSMu.exe
  C:\Windows\System\BaZuSMu.exe
  2⤵
  PID:7632
- C:\Windows\System\VmtSwoI.exe
  C:\Windows\System\VmtSwoI.exe
  2⤵
  PID:7456
- C:\Windows\System\noSBpHd.exe
  C:\Windows\System\noSBpHd.exe
  2⤵
  PID:7652
- C:\Windows\System\bMQiwKh.exe
  C:\Windows\System\bMQiwKh.exe
  2⤵
  PID:7744
- C:\Windows\System\kPPOjdo.exe
  C:\Windows\System\kPPOjdo.exe
  2⤵
  PID:8012
- C:\Windows\System\yKsdcXW.exe
  C:\Windows\System\yKsdcXW.exe
  2⤵
  PID:7960
- C:\Windows\System\BYXeBKY.exe
  C:\Windows\System\BYXeBKY.exe
  2⤵
  PID:8144
- C:\Windows\System\KwgGebI.exe
  C:\Windows\System\KwgGebI.exe
  2⤵
  PID:8052
- C:\Windows\System\QPTJTIe.exe
  C:\Windows\System\QPTJTIe.exe
  2⤵
  PID:5128
- C:\Windows\System\LVcAiGZ.exe
  C:\Windows\System\LVcAiGZ.exe
  2⤵
  PID:7708
- C:\Windows\System\HiOKsKH.exe
  C:\Windows\System\HiOKsKH.exe
  2⤵
  PID:7280
- C:\Windows\System\NrzFqeI.exe
  C:\Windows\System\NrzFqeI.exe
  2⤵
  PID:7512
- C:\Windows\System\dApuDst.exe
  C:\Windows\System\dApuDst.exe
  2⤵
  PID:5996
- C:\Windows\System\rarPSHe.exe
  C:\Windows\System\rarPSHe.exe
  2⤵
  PID:7452
- C:\Windows\System\hmjgHfZ.exe
  C:\Windows\System\hmjgHfZ.exe
  2⤵
  PID:7832
- C:\Windows\System\xcbiIfD.exe
  C:\Windows\System\xcbiIfD.exe
  2⤵
  PID:8200
- C:\Windows\System\TURURXx.exe
  C:\Windows\System\TURURXx.exe
  2⤵
  PID:8220
- C:\Windows\System\GWOcXmY.exe
  C:\Windows\System\GWOcXmY.exe
  2⤵
  PID:8240
- C:\Windows\System\HiEjHHl.exe
  C:\Windows\System\HiEjHHl.exe
  2⤵
  PID:8700
- C:\Windows\System\qLNrWqo.exe
  C:\Windows\System\qLNrWqo.exe
  2⤵
  PID:8748
- C:\Windows\System\SZrGGlH.exe
  C:\Windows\System\SZrGGlH.exe
  2⤵
  PID:8772
- C:\Windows\System\XpELfOu.exe
  C:\Windows\System\XpELfOu.exe
  2⤵
  PID:8788
- C:\Windows\System\jhfokNd.exe
  C:\Windows\System\jhfokNd.exe
  2⤵
  PID:8808
- C:\Windows\System\GFlJEGL.exe
  C:\Windows\System\GFlJEGL.exe
  2⤵
  PID:8824
- C:\Windows\System\XSVSNIO.exe
  C:\Windows\System\XSVSNIO.exe
  2⤵
  PID:8840
- C:\Windows\System\mJCdFtJ.exe
  C:\Windows\System\mJCdFtJ.exe
  2⤵
  PID:8864
- C:\Windows\System\dwFIQJg.exe
  C:\Windows\System\dwFIQJg.exe
  2⤵
  PID:8884
- C:\Windows\System\ZgHjcST.exe
  C:\Windows\System\ZgHjcST.exe
  2⤵
  PID:8904
- C:\Windows\System\mTkcmlN.exe
  C:\Windows\System\mTkcmlN.exe
  2⤵
  PID:8928
- C:\Windows\System\ruSoCpy.exe
  C:\Windows\System\ruSoCpy.exe
  2⤵
  PID:8948
- C:\Windows\System\TiyAzah.exe
  C:\Windows\System\TiyAzah.exe
  2⤵
  PID:8968
- C:\Windows\System\HsphTOT.exe
  C:\Windows\System\HsphTOT.exe
  2⤵
  PID:8984
- C:\Windows\System\nnLKQMx.exe
  C:\Windows\System\nnLKQMx.exe
  2⤵
  PID:9004
- C:\Windows\System\ubCgNKB.exe
  C:\Windows\System\ubCgNKB.exe
  2⤵
  PID:9032
- C:\Windows\System\tnhbfIh.exe
  C:\Windows\System\tnhbfIh.exe
  2⤵
  PID:9052
- C:\Windows\System\nsKgwgr.exe
  C:\Windows\System\nsKgwgr.exe
  2⤵
  PID:9080
- C:\Windows\System\PPUgvgE.exe
  C:\Windows\System\PPUgvgE.exe
  2⤵
  PID:9140
- C:\Windows\System\HkGzkKT.exe
  C:\Windows\System\HkGzkKT.exe
  2⤵
  PID:9156
- C:\Windows\System\BxJYRuK.exe
  C:\Windows\System\BxJYRuK.exe
  2⤵
  PID:9176
- C:\Windows\System\biBRuAe.exe
  C:\Windows\System\biBRuAe.exe
  2⤵
  PID:9200
- C:\Windows\System\SFPDlrP.exe
  C:\Windows\System\SFPDlrP.exe
  2⤵
  PID:7792
- C:\Windows\System\fuFpIbZ.exe
  C:\Windows\System\fuFpIbZ.exe
  2⤵
  PID:5152
- C:\Windows\System\KKaedLO.exe
  C:\Windows\System\KKaedLO.exe
  2⤵
  PID:7424
- C:\Windows\System\OyRWFvO.exe
  C:\Windows\System\OyRWFvO.exe
  2⤵
  PID:7728
- C:\Windows\System\qxOiDqb.exe
  C:\Windows\System\qxOiDqb.exe
  2⤵
  PID:7260
- C:\Windows\System\LMOCzAu.exe
  C:\Windows\System\LMOCzAu.exe
  2⤵
  PID:8080
- C:\Windows\System\LyLJlJN.exe
  C:\Windows\System\LyLJlJN.exe
  2⤵
  PID:8020
- C:\Windows\System\nsgujnA.exe
  C:\Windows\System\nsgujnA.exe
  2⤵
  PID:8232
- C:\Windows\System\AYoPVTN.exe
  C:\Windows\System\AYoPVTN.exe
  2⤵
  PID:7244
- C:\Windows\System\mtQFEwF.exe
  C:\Windows\System\mtQFEwF.exe
  2⤵
  PID:7776
- C:\Windows\System\kTThsma.exe
  C:\Windows\System\kTThsma.exe
  2⤵
  PID:8316
- C:\Windows\System\PFSNNEd.exe
  C:\Windows\System\PFSNNEd.exe
  2⤵
  PID:8396
- C:\Windows\System\hYqkxzx.exe
  C:\Windows\System\hYqkxzx.exe
  2⤵
  PID:8404
- C:\Windows\System\hkEADTh.exe
  C:\Windows\System\hkEADTh.exe
  2⤵
  PID:8500
- C:\Windows\System\cLsggcC.exe
  C:\Windows\System\cLsggcC.exe
  2⤵
  PID:8536
- C:\Windows\System\TcPPvNf.exe
  C:\Windows\System\TcPPvNf.exe
  2⤵
  PID:7844
- C:\Windows\System\YafWIOh.exe
  C:\Windows\System\YafWIOh.exe
  2⤵
  PID:8524
- C:\Windows\System\vSeCnXF.exe
  C:\Windows\System\vSeCnXF.exe
  2⤵
  PID:8576
- C:\Windows\System\cupQWfv.exe
  C:\Windows\System\cupQWfv.exe
  2⤵
  PID:8620
- C:\Windows\System\wgDMBkD.exe
  C:\Windows\System\wgDMBkD.exe
  2⤵
  PID:8632
- C:\Windows\System\SjhdDee.exe
  C:\Windows\System\SjhdDee.exe
  2⤵
  PID:8596
- C:\Windows\System\yuoVEgC.exe
  C:\Windows\System\yuoVEgC.exe
  2⤵
  PID:8652
- C:\Windows\System\wPrSsia.exe
  C:\Windows\System\wPrSsia.exe
  2⤵
  PID:8672
- C:\Windows\System\rbUCzPS.exe
  C:\Windows\System\rbUCzPS.exe
  2⤵
  PID:8684
- C:\Windows\System\wkxDiuA.exe
  C:\Windows\System\wkxDiuA.exe
  2⤵
  PID:8708
- C:\Windows\System\aooONrG.exe
  C:\Windows\System\aooONrG.exe
  2⤵
  PID:2912
- C:\Windows\System\hRkXNtx.exe
  C:\Windows\System\hRkXNtx.exe
  2⤵
  PID:8820
- C:\Windows\System\CWDGyAs.exe
  C:\Windows\System\CWDGyAs.exe
  2⤵
  PID:8780
- C:\Windows\System\MxtQGfX.exe
  C:\Windows\System\MxtQGfX.exe
  2⤵
  PID:1812
- C:\Windows\System\liaheln.exe
  C:\Windows\System\liaheln.exe
  2⤵
  PID:8872
- C:\Windows\System\ynEhzvK.exe
  C:\Windows\System\ynEhzvK.exe
  2⤵
  PID:9048
- C:\Windows\System\WWlQSCw.exe
  C:\Windows\System\WWlQSCw.exe
  2⤵
  PID:8992
- C:\Windows\System\wXICfhC.exe
  C:\Windows\System\wXICfhC.exe
  2⤵
  PID:8900
- C:\Windows\System\gOAelio.exe
  C:\Windows\System\gOAelio.exe
  2⤵
  PID:9064
- C:\Windows\System\vmsWYjI.exe
  C:\Windows\System\vmsWYjI.exe
  2⤵
  PID:9172
- C:\Windows\System\FOvwXnJ.exe
  C:\Windows\System\FOvwXnJ.exe
  2⤵
  PID:9020
- C:\Windows\System\SZHkSMN.exe
  C:\Windows\System\SZHkSMN.exe
  2⤵
  PID:8216
- C:\Windows\System\YfxclPl.exe
  C:\Windows\System\YfxclPl.exe
  2⤵
  PID:9208
- C:\Windows\System\FKDgSvG.exe
  C:\Windows\System\FKDgSvG.exe
  2⤵
  PID:8372
- C:\Windows\System\JrTNPtz.exe
  C:\Windows\System\JrTNPtz.exe
  2⤵
  PID:8552
- C:\Windows\System\WTRRiYA.exe
  C:\Windows\System\WTRRiYA.exe
  2⤵
  PID:8196
- C:\Windows\System\ByAPeuJ.exe
  C:\Windows\System\ByAPeuJ.exe
  2⤵
  PID:4324
- C:\Windows\System\eowuhgA.exe
  C:\Windows\System\eowuhgA.exe
  2⤵
  PID:9228
- C:\Windows\System\olLfoSQ.exe
  C:\Windows\System\olLfoSQ.exe
  2⤵
  PID:9244
- C:\Windows\System\cxGnwUM.exe
  C:\Windows\System\cxGnwUM.exe
  2⤵
  PID:9260
- C:\Windows\System\WBLjeRN.exe
  C:\Windows\System\WBLjeRN.exe
  2⤵
  PID:9276
- C:\Windows\System\IFpJWdg.exe
  C:\Windows\System\IFpJWdg.exe
  2⤵
  PID:9300
- C:\Windows\System\JvrvJLx.exe
  C:\Windows\System\JvrvJLx.exe
  2⤵
  PID:9320
- C:\Windows\System\nxENSRI.exe
  C:\Windows\System\nxENSRI.exe
  2⤵
  PID:9340
- C:\Windows\System\okQchtW.exe
  C:\Windows\System\okQchtW.exe
  2⤵
  PID:9360
- C:\Windows\System\JPtwNVS.exe
  C:\Windows\System\JPtwNVS.exe
  2⤵
  PID:9384
- C:\Windows\System\xBcXqyR.exe
  C:\Windows\System\xBcXqyR.exe
  2⤵
  PID:9404
- C:\Windows\System\vUoWFOu.exe
  C:\Windows\System\vUoWFOu.exe
  2⤵
  PID:9424
- C:\Windows\System\IutYsSS.exe
  C:\Windows\System\IutYsSS.exe
  2⤵
  PID:9448
- C:\Windows\System\KWqckAD.exe
  C:\Windows\System\KWqckAD.exe
  2⤵
  PID:9468
- C:\Windows\System\ZwbFtwe.exe
  C:\Windows\System\ZwbFtwe.exe
  2⤵
  PID:9484
- C:\Windows\System\QJjzASs.exe
  C:\Windows\System\QJjzASs.exe
  2⤵
  PID:9508
- C:\Windows\System\JwtsgSQ.exe
  C:\Windows\System\JwtsgSQ.exe
  2⤵
  PID:9528
- C:\Windows\System\YoOdVGU.exe
  C:\Windows\System\YoOdVGU.exe
  2⤵
  PID:9548
- C:\Windows\System\OUXPqyR.exe
  C:\Windows\System\OUXPqyR.exe
  2⤵
  PID:9568
- C:\Windows\System\DUdGYmf.exe
  C:\Windows\System\DUdGYmf.exe
  2⤵
  PID:9592
- C:\Windows\System\QBwsuCm.exe
  C:\Windows\System\QBwsuCm.exe
  2⤵
  PID:9612
- C:\Windows\System\MbmlWIQ.exe
  C:\Windows\System\MbmlWIQ.exe
  2⤵
  PID:9632
- C:\Windows\System\ERChmpA.exe
  C:\Windows\System\ERChmpA.exe
  2⤵
  PID:9656
- C:\Windows\System\xDGipDG.exe
  C:\Windows\System\xDGipDG.exe
  2⤵
  PID:9676
- C:\Windows\System\zJKtDSu.exe
  C:\Windows\System\zJKtDSu.exe
  2⤵
  PID:9692
- C:\Windows\System\EClolHk.exe
  C:\Windows\System\EClolHk.exe
  2⤵
  PID:9716
- C:\Windows\System\DCtudFM.exe
  C:\Windows\System\DCtudFM.exe
  2⤵
  PID:9736
- C:\Windows\System\BzYmNrQ.exe
  C:\Windows\System\BzYmNrQ.exe
  2⤵
  PID:9756
- C:\Windows\System\xRDqwAp.exe
  C:\Windows\System\xRDqwAp.exe
  2⤵
  PID:9912
- C:\Windows\System\OMkXnIo.exe
  C:\Windows\System\OMkXnIo.exe
  2⤵
  PID:9928
- C:\Windows\System\MKHVwmo.exe
  C:\Windows\System\MKHVwmo.exe
  2⤵
  PID:9948
- C:\Windows\System\oXMlgBu.exe
  C:\Windows\System\oXMlgBu.exe
  2⤵
  PID:9976
- C:\Windows\System\WVJgxFP.exe
  C:\Windows\System\WVJgxFP.exe
  2⤵
  PID:9992
- C:\Windows\System\gcmfPfo.exe
  C:\Windows\System\gcmfPfo.exe
  2⤵
  PID:10012
- C:\Windows\System\VWmEOEs.exe
  C:\Windows\System\VWmEOEs.exe
  2⤵
  PID:10040
- C:\Windows\System\wuDVBvc.exe
  C:\Windows\System\wuDVBvc.exe
  2⤵
  PID:10060
- C:\Windows\System\KJrNRRW.exe
  C:\Windows\System\KJrNRRW.exe
  2⤵
  PID:10080
- C:\Windows\System\uLOSgRu.exe
  C:\Windows\System\uLOSgRu.exe
  2⤵
  PID:10104
- C:\Windows\System\hiiTAMj.exe
  C:\Windows\System\hiiTAMj.exe
  2⤵
  PID:10136
- C:\Windows\System\gesbZuO.exe
  C:\Windows\System\gesbZuO.exe
  2⤵
  PID:10152
- C:\Windows\System\oTSYgbV.exe
  C:\Windows\System\oTSYgbV.exe
  2⤵
  PID:10176
- C:\Windows\System\mftmbMj.exe
  C:\Windows\System\mftmbMj.exe
  2⤵
  PID:10204
- C:\Windows\System\mMoRtVW.exe
  C:\Windows\System\mMoRtVW.exe
  2⤵
  PID:10224
- C:\Windows\System\htBtapR.exe
  C:\Windows\System\htBtapR.exe
  2⤵
  PID:4448
- C:\Windows\System\XEqBXdR.exe
  C:\Windows\System\XEqBXdR.exe
  2⤵
  PID:9184
- C:\Windows\System\lVJhegi.exe
  C:\Windows\System\lVJhegi.exe
  2⤵
  PID:9600
- C:\Windows\System\VeyGNEx.exe
  C:\Windows\System\VeyGNEx.exe
  2⤵
  PID:9640
- C:\Windows\System\eKcEkxI.exe
  C:\Windows\System\eKcEkxI.exe
  2⤵
  PID:9708
- C:\Windows\System\CdOyikS.exe
  C:\Windows\System\CdOyikS.exe
  2⤵
  PID:9944
- C:\Windows\System\gonEALQ.exe
  C:\Windows\System\gonEALQ.exe
  2⤵
  PID:10020
- C:\Windows\System\spmvBJJ.exe
  C:\Windows\System\spmvBJJ.exe
  2⤵
  PID:10096
- C:\Windows\System\EYYGoZu.exe
  C:\Windows\System\EYYGoZu.exe
  2⤵
  PID:10196
- C:\Windows\System\whtAzfM.exe
  C:\Windows\System\whtAzfM.exe
  2⤵
  PID:8656
- C:\Windows\System\zuJyRCF.exe
  C:\Windows\System\zuJyRCF.exe
  2⤵
  PID:1324
- C:\Windows\System\GSkxZxQ.exe
  C:\Windows\System\GSkxZxQ.exe
  2⤵
  PID:1232
- C:\Windows\System\GoFcfEL.exe
  C:\Windows\System\GoFcfEL.exe
  2⤵
  PID:3168
- C:\Windows\System\MDQooIE.exe
  C:\Windows\System\MDQooIE.exe
  2⤵
  PID:10188
- C:\Windows\System\fMcyQVb.exe
  C:\Windows\System\fMcyQVb.exe
  2⤵
  PID:10024
- C:\Windows\System\MiTwxFk.exe
  C:\Windows\System\MiTwxFk.exe
  2⤵
  PID:9920
- C:\Windows\System\PkOCQXs.exe
  C:\Windows\System\PkOCQXs.exe
  2⤵
  PID:940
- C:\Windows\System\yGaErDL.exe
  C:\Windows\System\yGaErDL.exe
  2⤵
  PID:2000
- C:\Windows\System\LbPAttg.exe
  C:\Windows\System\LbPAttg.exe
  2⤵
  PID:8572
- C:\Windows\System\qdRMeAf.exe
  C:\Windows\System\qdRMeAf.exe
  2⤵
  PID:8756
- C:\Windows\System\gapQwDR.exe
  C:\Windows\System\gapQwDR.exe
  2⤵
  PID:9464
- C:\Windows\System\ruRnxNI.exe
  C:\Windows\System\ruRnxNI.exe
  2⤵
  PID:9148
- C:\Windows\System\CQKTaxa.exe
  C:\Windows\System\CQKTaxa.exe
  2⤵
  PID:4824
- C:\Windows\System\loqRhdd.exe
  C:\Windows\System\loqRhdd.exe
  2⤵
  PID:10056
- C:\Windows\System\jnVjaTv.exe
  C:\Windows\System\jnVjaTv.exe
  2⤵
  PID:9840
- C:\Windows\System\ynYSwxw.exe
  C:\Windows\System\ynYSwxw.exe
  2⤵
  PID:9608
- C:\Windows\System\EBfDhsJ.exe
  C:\Windows\System\EBfDhsJ.exe
  2⤵
  PID:9752
- C:\Windows\System\aSbAcBj.exe
  C:\Windows\System\aSbAcBj.exe
  2⤵
  PID:2440
- C:\Windows\System\uvfpndX.exe
  C:\Windows\System\uvfpndX.exe
  2⤵
  PID:1904
- C:\Windows\System\wPNxuMZ.exe
  C:\Windows\System\wPNxuMZ.exe
  2⤵
  PID:4964
- C:\Windows\System\ehKjtVA.exe
  C:\Windows\System\ehKjtVA.exe
  2⤵
  PID:10264
- C:\Windows\System\PtVlEYy.exe
  C:\Windows\System\PtVlEYy.exe
  2⤵
  PID:10280
- C:\Windows\System\UXsnrsz.exe
  C:\Windows\System\UXsnrsz.exe
  2⤵
  PID:10300
- C:\Windows\System\cgmjZDl.exe
  C:\Windows\System\cgmjZDl.exe
  2⤵
  PID:10328
- C:\Windows\System\TnOZDJm.exe
  C:\Windows\System\TnOZDJm.exe
  2⤵
  PID:10344
- C:\Windows\System\jmoxsxM.exe
  C:\Windows\System\jmoxsxM.exe
  2⤵
  PID:10368
- C:\Windows\System\XPKtfCU.exe
  C:\Windows\System\XPKtfCU.exe
  2⤵
  PID:10388
- C:\Windows\System\SiXhfwY.exe
  C:\Windows\System\SiXhfwY.exe
  2⤵
  PID:10404
- C:\Windows\System\LiUdmMf.exe
  C:\Windows\System\LiUdmMf.exe
  2⤵
  PID:10424
- C:\Windows\System\zBbfBpV.exe
  C:\Windows\System\zBbfBpV.exe
  2⤵
  PID:10448
- C:\Windows\System\raDDrwd.exe
  C:\Windows\System\raDDrwd.exe
  2⤵
  PID:10472
- C:\Windows\System\mxABKiZ.exe
  C:\Windows\System\mxABKiZ.exe
  2⤵
  PID:10492
- C:\Windows\System\CGTWvpp.exe
  C:\Windows\System\CGTWvpp.exe
  2⤵
  PID:10508
- C:\Windows\System\jSOkwvi.exe
  C:\Windows\System\jSOkwvi.exe
  2⤵
  PID:10524
- C:\Windows\System\HRAnhpS.exe
  C:\Windows\System\HRAnhpS.exe
  2⤵
  PID:10540
- C:\Windows\System\iIMuzLO.exe
  C:\Windows\System\iIMuzLO.exe
  2⤵
  PID:10560
- C:\Windows\System\XxKJcDC.exe
  C:\Windows\System\XxKJcDC.exe
  2⤵
  PID:10576
- C:\Windows\System\YZhqdwc.exe
  C:\Windows\System\YZhqdwc.exe
  2⤵
  PID:10596
- C:\Windows\System\JssVKtF.exe
  C:\Windows\System\JssVKtF.exe
  2⤵
  PID:10612
- C:\Windows\System\nfemqYb.exe
  C:\Windows\System\nfemqYb.exe
  2⤵
  PID:10628
- C:\Windows\System\cXOfryK.exe
  C:\Windows\System\cXOfryK.exe
  2⤵
  PID:10644
- C:\Windows\System\hzIjcYg.exe
  C:\Windows\System\hzIjcYg.exe
  2⤵
  PID:10732
- C:\Windows\System\XCQoUBn.exe
  C:\Windows\System\XCQoUBn.exe
  2⤵
  PID:10752
- C:\Windows\System\waPUqdX.exe
  C:\Windows\System\waPUqdX.exe
  2⤵
  PID:10908
- C:\Windows\System\oTLgZcS.exe
  C:\Windows\System\oTLgZcS.exe
  2⤵
  PID:10944
- C:\Windows\System\wzmMluo.exe
  C:\Windows\System\wzmMluo.exe
  2⤵
  PID:10964
- C:\Windows\System\rTlsUmA.exe
  C:\Windows\System\rTlsUmA.exe
  2⤵
  PID:10980
- C:\Windows\System\IwdGubj.exe
  C:\Windows\System\IwdGubj.exe
  2⤵
  PID:10996
- C:\Windows\System\kfEFNdE.exe
  C:\Windows\System\kfEFNdE.exe
  2⤵
  PID:11016
- C:\Windows\System\EveNvkf.exe
  C:\Windows\System\EveNvkf.exe
  2⤵
  PID:11040
- C:\Windows\System\GbUezFI.exe
  C:\Windows\System\GbUezFI.exe
  2⤵
  PID:11060
- C:\Windows\System\sgtPNwL.exe
  C:\Windows\System\sgtPNwL.exe
  2⤵
  PID:11088
- C:\Windows\System\llgzKqq.exe
  C:\Windows\System\llgzKqq.exe
  2⤵
  PID:11104
- C:\Windows\System\yhVDJwo.exe
  C:\Windows\System\yhVDJwo.exe
  2⤵
  PID:11124
- C:\Windows\System\BxmTXxI.exe
  C:\Windows\System\BxmTXxI.exe
  2⤵
  PID:11148
- C:\Windows\System\YmZHmiM.exe
  C:\Windows\System\YmZHmiM.exe
  2⤵
  PID:11172
- C:\Windows\System\uQiwpQo.exe
  C:\Windows\System\uQiwpQo.exe
  2⤵
  PID:11200
- C:\Windows\System\DbpBSNg.exe
  C:\Windows\System\DbpBSNg.exe
  2⤵
  PID:11216
- C:\Windows\System\PMnqemV.exe
  C:\Windows\System\PMnqemV.exe
  2⤵
  PID:11248
- C:\Windows\System\EaBMEnv.exe
  C:\Windows\System\EaBMEnv.exe
  2⤵
  PID:5088
- C:\Windows\System\fCEoylH.exe
  C:\Windows\System\fCEoylH.exe
  2⤵
  PID:7604
- C:\Windows\System\kMkCsTX.exe
  C:\Windows\System\kMkCsTX.exe
  2⤵
  PID:4252
- C:\Windows\System\dCRaAvI.exe
  C:\Windows\System\dCRaAvI.exe
  2⤵
  PID:9776
- C:\Windows\System\IxZzXJl.exe
  C:\Windows\System\IxZzXJl.exe
  2⤵
  PID:10148
- C:\Windows\System\hJyctAL.exe
  C:\Windows\System\hJyctAL.exe
  2⤵
  PID:9820
- C:\Windows\System\rscpHpI.exe
  C:\Windows\System\rscpHpI.exe
  2⤵
  PID:9748
- C:\Windows\System\HYxvkRq.exe
  C:\Windows\System\HYxvkRq.exe
  2⤵
  PID:10276
- C:\Windows\System\mRrPcAa.exe
  C:\Windows\System\mRrPcAa.exe
  2⤵
  PID:8800
- C:\Windows\System\AIqchHb.exe
  C:\Windows\System\AIqchHb.exe
  2⤵
  PID:10384
- C:\Windows\System\OxjZMCt.exe
  C:\Windows\System\OxjZMCt.exe
  2⤵
  PID:10436
- C:\Windows\System\JWLirbq.exe
  C:\Windows\System\JWLirbq.exe
  2⤵
  PID:5012
- C:\Windows\System\oUPYDPY.exe
  C:\Windows\System\oUPYDPY.exe
  2⤵
  PID:740
- C:\Windows\System\oYuKRGI.exe
  C:\Windows\System\oYuKRGI.exe
  2⤵
  PID:8508
- C:\Windows\System\UcomGSi.exe
  C:\Windows\System\UcomGSi.exe
  2⤵
  PID:448
- C:\Windows\System\AxFsezk.exe
  C:\Windows\System\AxFsezk.exe
  2⤵
  PID:9292
- C:\Windows\System\vLeABuc.exe
  C:\Windows\System\vLeABuc.exe
  2⤵
  PID:10408
- C:\Windows\System\OWBEByk.exe
  C:\Windows\System\OWBEByk.exe
  2⤵
  PID:4836
- C:\Windows\System\ULYgAfk.exe
  C:\Windows\System\ULYgAfk.exe
  2⤵
  PID:5224
- C:\Windows\System\bTDaGbf.exe
  C:\Windows\System\bTDaGbf.exe
  2⤵
  PID:11024
- C:\Windows\System\GPewUJy.exe
  C:\Windows\System\GPewUJy.exe
  2⤵
  PID:10484
- C:\Windows\System\mJYfRRc.exe
  C:\Windows\System\mJYfRRc.exe
  2⤵
  PID:5404
- C:\Windows\System\XYUYLGF.exe
  C:\Windows\System\XYUYLGF.exe
  2⤵
  PID:10656
- C:\Windows\System\oJFadmF.exe
  C:\Windows\System\oJFadmF.exe
  2⤵
  PID:11260
- C:\Windows\System\HCiufFm.exe
  C:\Windows\System\HCiufFm.exe
  2⤵
  PID:10900
- C:\Windows\System\TYRFrJN.exe
  C:\Windows\System\TYRFrJN.exe
  2⤵
  PID:5704
- C:\Windows\System\BaqXLMc.exe
  C:\Windows\System\BaqXLMc.exe
  2⤵
  PID:5736
- C:\Windows\System\KwvUEtI.exe
  C:\Windows\System\KwvUEtI.exe
  2⤵
  PID:908
- C:\Windows\System\usItFZf.exe
  C:\Windows\System\usItFZf.exe
  2⤵
  PID:10356
- C:\Windows\System\igxrJoG.exe
  C:\Windows\System\igxrJoG.exe
  2⤵
  PID:3784
- C:\Windows\System\hutbPqz.exe
  C:\Windows\System\hutbPqz.exe
  2⤵
  PID:3920
- C:\Windows\System\VVRgspK.exe
  C:\Windows\System\VVRgspK.exe
  2⤵
  PID:10636
- C:\Windows\System\dPuvjoG.exe
  C:\Windows\System\dPuvjoG.exe
  2⤵
  PID:11008
- C:\Windows\System\KvUAVKq.exe
  C:\Windows\System\KvUAVKq.exe
  2⤵
  PID:10500
- C:\Windows\System\DODkpre.exe
  C:\Windows\System\DODkpre.exe
  2⤵
  PID:10680
- C:\Windows\System\IjTLBiX.exe
  C:\Windows\System\IjTLBiX.exe
  2⤵
  PID:6064
- C:\Windows\System\MuBxJaT.exe
  C:\Windows\System\MuBxJaT.exe
  2⤵
  PID:3056
- C:\Windows\System\qlflMDr.exe
  C:\Windows\System\qlflMDr.exe
  2⤵
  PID:1964
- C:\Windows\System\WJGFpUX.exe
  C:\Windows\System\WJGFpUX.exe
  2⤵
  PID:10952
- C:\Windows\System\fIWECVP.exe
  C:\Windows\System\fIWECVP.exe
  2⤵
  PID:4968
- C:\Windows\System\kUoMkGq.exe
  C:\Windows\System\kUoMkGq.exe
  2⤵
  PID:5628
- C:\Windows\System\XuINxfb.exe
  C:\Windows\System\XuINxfb.exe
  2⤵
  PID:456
- C:\Windows\System\bRxgWed.exe
  C:\Windows\System\bRxgWed.exe
  2⤵
  PID:10048
- C:\Windows\System\RKWztmp.exe
  C:\Windows\System\RKWztmp.exe
  2⤵
  PID:6076
- C:\Windows\System\ZMmlUcA.exe
  C:\Windows\System\ZMmlUcA.exe
  2⤵
  PID:5696
- C:\Windows\System\AWzXjZh.exe
  C:\Windows\System\AWzXjZh.exe
  2⤵
  PID:3140
- C:\Windows\System\zVmhmen.exe
  C:\Windows\System\zVmhmen.exe
  2⤵
  PID:5616
- C:\Windows\System\JRsxJfj.exe
  C:\Windows\System\JRsxJfj.exe
  2⤵
  PID:9016
- C:\Windows\System\eSMNtbU.exe
  C:\Windows\System\eSMNtbU.exe
  2⤵
  PID:11244
- C:\Windows\System\FMRMaCP.exe
  C:\Windows\System\FMRMaCP.exe
  2⤵
  PID:10416
- C:\Windows\System\TUCRnLy.exe
  C:\Windows\System\TUCRnLy.exe
  2⤵
  PID:11288
- C:\Windows\System\jSKvpxT.exe
  C:\Windows\System\jSKvpxT.exe
  2⤵
  PID:11312
- C:\Windows\System\SRsORlL.exe
  C:\Windows\System\SRsORlL.exe
  2⤵
  PID:11328
- C:\Windows\System\zzNdLTj.exe
  C:\Windows\System\zzNdLTj.exe
  2⤵
  PID:11432
- C:\Windows\System\HNhzgwC.exe
  C:\Windows\System\HNhzgwC.exe
  2⤵
  PID:11460
- C:\Windows\System\DDQGhRc.exe
  C:\Windows\System\DDQGhRc.exe
  2⤵
  PID:11480
- C:\Windows\System\mJQTSoa.exe
  C:\Windows\System\mJQTSoa.exe
  2⤵
  PID:11540
- C:\Windows\System\ZesvQlt.exe
  C:\Windows\System\ZesvQlt.exe
  2⤵
  PID:11556
- C:\Windows\System\sxtyydW.exe
  C:\Windows\System\sxtyydW.exe
  2⤵
  PID:11572
- C:\Windows\System\FTSVXJe.exe
  C:\Windows\System\FTSVXJe.exe
  2⤵
  PID:11588
- C:\Windows\System\WFyZTDv.exe
  C:\Windows\System\WFyZTDv.exe
  2⤵
  PID:11608
- C:\Windows\System\knHdcaP.exe
  C:\Windows\System\knHdcaP.exe
  2⤵
  PID:11624
- C:\Windows\System\eLGXWne.exe
  C:\Windows\System\eLGXWne.exe
  2⤵
  PID:11644
- C:\Windows\System\CSOisuo.exe
  C:\Windows\System\CSOisuo.exe
  2⤵
  PID:11688
- C:\Windows\System\RETeyAp.exe
  C:\Windows\System\RETeyAp.exe
  2⤵
  PID:11724
- C:\Windows\System\PpXDaEd.exe
  C:\Windows\System\PpXDaEd.exe
  2⤵
  PID:11740
- C:\Windows\System\QTppokk.exe
  C:\Windows\System\QTppokk.exe
  2⤵
  PID:11760
- C:\Windows\System\yJsRPye.exe
  C:\Windows\System\yJsRPye.exe
  2⤵
  PID:11792
- C:\Windows\System\tUQklXt.exe
  C:\Windows\System\tUQklXt.exe
  2⤵
  PID:11808
- C:\Windows\System\zYWjlHx.exe
  C:\Windows\System\zYWjlHx.exe
  2⤵
  PID:11828
- C:\Windows\System\olJQfBo.exe
  C:\Windows\System\olJQfBo.exe
  2⤵
  PID:11852
- C:\Windows\System\jFVDVkm.exe
  C:\Windows\System\jFVDVkm.exe
  2⤵
  PID:11872
- C:\Windows\System\bmJodOe.exe
  C:\Windows\System\bmJodOe.exe
  2⤵
  PID:11896
- C:\Windows\System\KGhSWdm.exe
  C:\Windows\System\KGhSWdm.exe
  2⤵
  PID:11916
- C:\Windows\System\StPbfoP.exe
  C:\Windows\System\StPbfoP.exe
  2⤵
  PID:11932
- C:\Windows\System\MhiKSHl.exe
  C:\Windows\System\MhiKSHl.exe
  2⤵
  PID:11948
- C:\Windows\System\HciTCnu.exe
  C:\Windows\System\HciTCnu.exe
  2⤵
  PID:12028
- C:\Windows\System\HZlCNMC.exe
  C:\Windows\System\HZlCNMC.exe
  2⤵
  PID:12144
- C:\Windows\System\eGifGBS.exe
  C:\Windows\System\eGifGBS.exe
  2⤵
  PID:12228
- C:\Windows\System\qQlYhrk.exe
  C:\Windows\System\qQlYhrk.exe
  2⤵
  PID:12248
- C:\Windows\System\ZDjyGZC.exe
  C:\Windows\System\ZDjyGZC.exe
  2⤵
  PID:12272
- C:\Windows\System\LCLQLXN.exe
  C:\Windows\System\LCLQLXN.exe
  2⤵
  PID:2416
- C:\Windows\System\imFjjyJ.exe
  C:\Windows\System\imFjjyJ.exe
  2⤵
  PID:2840
- C:\Windows\System\chaItWK.exe
  C:\Windows\System\chaItWK.exe
  2⤵
  PID:9368
- C:\Windows\System\CRCWqZk.exe
  C:\Windows\System\CRCWqZk.exe
  2⤵
  PID:4920
- C:\Windows\System\HBVLJEk.exe
  C:\Windows\System\HBVLJEk.exe
  2⤵
  PID:6056
- C:\Windows\System\kkXPIEO.exe
  C:\Windows\System\kkXPIEO.exe
  2⤵
  PID:9500
- C:\Windows\System\gkaokWX.exe
  C:\Windows\System\gkaokWX.exe
  2⤵
  PID:11500
- C:\Windows\System\RhChFDE.exe
  C:\Windows\System\RhChFDE.exe
  2⤵
  PID:11344
- C:\Windows\System\xGKTgha.exe
  C:\Windows\System\xGKTgha.exe
  2⤵
  PID:11444
- C:\Windows\System\FTafKbj.exe
  C:\Windows\System\FTafKbj.exe
  2⤵
  PID:11656
- C:\Windows\System\NvfnXLA.exe
  C:\Windows\System\NvfnXLA.exe
  2⤵
  PID:11468
- C:\Windows\System\YLDHvCC.exe
  C:\Windows\System\YLDHvCC.exe
  2⤵
  PID:11440
- C:\Windows\System\UdEipBs.exe
  C:\Windows\System\UdEipBs.exe
  2⤵
  PID:6980
- C:\Windows\System\xMxRAoh.exe
  C:\Windows\System\xMxRAoh.exe
  2⤵
  PID:7036
- C:\Windows\System\VInEVZS.exe
  C:\Windows\System\VInEVZS.exe
  2⤵
  PID:11784
- C:\Windows\System\IlzOovp.exe
  C:\Windows\System\IlzOovp.exe
  2⤵
  PID:6184
- C:\Windows\System\HdWbSRY.exe
  C:\Windows\System\HdWbSRY.exe
  2⤵
  PID:11960
- C:\Windows\System\CrGqRzZ.exe
  C:\Windows\System\CrGqRzZ.exe
  2⤵
  PID:11564
- C:\Windows\System\KpoaZhl.exe
  C:\Windows\System\KpoaZhl.exe
  2⤵
  PID:11800
- C:\Windows\System\nepwqOt.exe
  C:\Windows\System\nepwqOt.exe
  2⤵
  PID:11884
- C:\Windows\System\JZfVXQG.exe
  C:\Windows\System\JZfVXQG.exe
  2⤵
  PID:11388
- C:\Windows\System\eLZaFyt.exe
  C:\Windows\System\eLZaFyt.exe
  2⤵
  PID:12024
- C:\Windows\System\uCYHEHS.exe
  C:\Windows\System\uCYHEHS.exe
  2⤵
  PID:6564
- C:\Windows\System\YzBLZct.exe
  C:\Windows\System\YzBLZct.exe
  2⤵
  PID:10468
- C:\Windows\System\DGwQlrY.exe
  C:\Windows\System\DGwQlrY.exe
  2⤵
  PID:12092
- C:\Windows\System\AFMrYKk.exe
  C:\Windows\System\AFMrYKk.exe
  2⤵
  PID:1072
- C:\Windows\System\CbmcbUB.exe
  C:\Windows\System\CbmcbUB.exe
  2⤵
  PID:3160
- C:\Windows\System\NvYkkhx.exe
  C:\Windows\System\NvYkkhx.exe
  2⤵
  PID:12284
- C:\Windows\System\DdvRLLl.exe
  C:\Windows\System\DdvRLLl.exe
  2⤵
  PID:3692
- C:\Windows\System\xKCBKty.exe
  C:\Windows\System\xKCBKty.exe
  2⤵
  PID:12204
- C:\Windows\System\xJgSyPA.exe
  C:\Windows\System\xJgSyPA.exe
  2⤵
  PID:3844
- C:\Windows\System\aLUYUzv.exe
  C:\Windows\System\aLUYUzv.exe
  2⤵
  PID:11600
- C:\Windows\System\qfdstHE.exe
  C:\Windows\System\qfdstHE.exe
  2⤵
  PID:11672
- C:\Windows\System\MdZLLBt.exe
  C:\Windows\System\MdZLLBt.exe
  2⤵
  PID:11336
- C:\Windows\System\IMslZxu.exe
  C:\Windows\System\IMslZxu.exe
  2⤵
  PID:11324
- C:\Windows\System\GkYAvvn.exe
  C:\Windows\System\GkYAvvn.exe
  2⤵
  PID:11452
- C:\Windows\System\WjWmCnd.exe
  C:\Windows\System\WjWmCnd.exe
  2⤵
  PID:3720
- C:\Windows\System\DyNkJzZ.exe
  C:\Windows\System\DyNkJzZ.exe
  2⤵
  PID:11968
- C:\Windows\System\LgUmAMW.exe
  C:\Windows\System\LgUmAMW.exe
  2⤵
  PID:10664
- C:\Windows\System\TumZIuL.exe
  C:\Windows\System\TumZIuL.exe
  2⤵
  PID:3940
- C:\Windows\System\Rgxaobg.exe
  C:\Windows\System\Rgxaobg.exe
  2⤵
  PID:11956
- C:\Windows\System\KaVuYQP.exe
  C:\Windows\System\KaVuYQP.exe
  2⤵
  PID:12292
- C:\Windows\System\WjuWZkQ.exe
  C:\Windows\System\WjuWZkQ.exe
  2⤵
  PID:12440
- C:\Windows\System\AaMKvBl.exe
  C:\Windows\System\AaMKvBl.exe
  2⤵
  PID:12472
- C:\Windows\System\CSvfAOY.exe
  C:\Windows\System\CSvfAOY.exe
  2⤵
  PID:12500
- C:\Windows\System\yAAdMUY.exe
  C:\Windows\System\yAAdMUY.exe
  2⤵
  PID:12524
- C:\Windows\System\HNcbUfl.exe
  C:\Windows\System\HNcbUfl.exe
  2⤵
  PID:12556
- C:\Windows\System\dtgGxwG.exe
  C:\Windows\System\dtgGxwG.exe
  2⤵
  PID:12572
- C:\Windows\System\MjAJJKr.exe
  C:\Windows\System\MjAJJKr.exe
  2⤵
  PID:12600
- C:\Windows\System\dGLmITC.exe
  C:\Windows\System\dGLmITC.exe
  2⤵
  PID:12624
- C:\Windows\System\YrUolMg.exe
  C:\Windows\System\YrUolMg.exe
  2⤵
  PID:12640
- C:\Windows\System\OFcFJpF.exe
  C:\Windows\System\OFcFJpF.exe
  2⤵
  PID:12668
- C:\Windows\System\LfmElNy.exe
  C:\Windows\System\LfmElNy.exe
  2⤵
  PID:12688
- C:\Windows\System\WvNrGBf.exe
  C:\Windows\System\WvNrGBf.exe
  2⤵
  PID:12704
- C:\Windows\System\FJMsvFk.exe
  C:\Windows\System\FJMsvFk.exe
  2⤵
  PID:12724
- C:\Windows\System\bnfaCzL.exe
  C:\Windows\System\bnfaCzL.exe
  2⤵
  PID:12828
- C:\Windows\System\dqOzlQZ.exe
  C:\Windows\System\dqOzlQZ.exe
  2⤵
  PID:12848
- C:\Windows\System\lNqHnNW.exe
  C:\Windows\System\lNqHnNW.exe
  2⤵
  PID:12872
- C:\Windows\System\fDGBPnD.exe
  C:\Windows\System\fDGBPnD.exe
  2⤵
  PID:12888
- C:\Windows\System\aqXUjor.exe
  C:\Windows\System\aqXUjor.exe
  2⤵
  PID:12912
- C:\Windows\System\uaTeutm.exe
  C:\Windows\System\uaTeutm.exe
  2⤵
  PID:12936
- C:\Windows\System\laoboLs.exe
  C:\Windows\System\laoboLs.exe
  2⤵
  PID:12952
- C:\Windows\System\AccicEq.exe
  C:\Windows\System\AccicEq.exe
  2⤵
  PID:13068
- C:\Windows\System\bMwZvBa.exe
  C:\Windows\System\bMwZvBa.exe
  2⤵
  PID:13092
- C:\Windows\System\VsabIxe.exe
  C:\Windows\System\VsabIxe.exe
  2⤵
  PID:13108
- C:\Windows\System\KlysLjD.exe
  C:\Windows\System\KlysLjD.exe
  2⤵
  PID:13136
- C:\Windows\System\RGvCWmo.exe
  C:\Windows\System\RGvCWmo.exe
  2⤵
  PID:13164
- C:\Windows\System\sGfWIeu.exe
  C:\Windows\System\sGfWIeu.exe
  2⤵
  PID:13192
- C:\Windows\System\LuaxORm.exe
  C:\Windows\System\LuaxORm.exe
  2⤵
  PID:13212
- C:\Windows\System\edERrSr.exe
  C:\Windows\System\edERrSr.exe
  2⤵
  PID:13236
- C:\Windows\System\LjkgffI.exe
  C:\Windows\System\LjkgffI.exe
  2⤵
  PID:13264
- C:\Windows\System\xhDRswX.exe
  C:\Windows\System\xhDRswX.exe
  2⤵
  PID:13284
- C:\Windows\System\kygrApD.exe
  C:\Windows\System\kygrApD.exe
  2⤵
  PID:13308
- C:\Windows\System\ffCkiLA.exe
  C:\Windows\System\ffCkiLA.exe
  2⤵
  PID:11976
- C:\Windows\System\dkcahxQ.exe
  C:\Windows\System\dkcahxQ.exe
  2⤵
  PID:4140
- C:\Windows\System\zLVrgvc.exe
  C:\Windows\System\zLVrgvc.exe
  2⤵
  PID:4108
- C:\Windows\System\hGuLxsQ.exe
  C:\Windows\System\hGuLxsQ.exe
  2⤵
  PID:12512
- C:\Windows\System\dNmGjFO.exe
  C:\Windows\System\dNmGjFO.exe
  2⤵
  PID:12716
- C:\Windows\System\MeVGyMQ.exe
  C:\Windows\System\MeVGyMQ.exe
  2⤵
  PID:12364
- C:\Windows\System\FWdfBDy.exe
  C:\Windows\System\FWdfBDy.exe
  2⤵
  PID:12792
- C:\Windows\System\zihVLHm.exe
  C:\Windows\System\zihVLHm.exe
  2⤵
  PID:12608
- C:\Windows\System\jUyhihW.exe
  C:\Windows\System\jUyhihW.exe
  2⤵
  PID:12408
- C:\Windows\System\AifYEEz.exe
  C:\Windows\System\AifYEEz.exe
  2⤵
  PID:12464
- C:\Windows\System\qoZSCLf.exe
  C:\Windows\System\qoZSCLf.exe
  2⤵
  PID:12836
- C:\Windows\System\OEallaU.exe
  C:\Windows\System\OEallaU.exe
  2⤵
  PID:12648
- C:\Windows\System\CmdunUl.exe
  C:\Windows\System\CmdunUl.exe
  2⤵
  PID:12680
- C:\Windows\System\EJNmCHj.exe
  C:\Windows\System\EJNmCHj.exe
  2⤵
  PID:13172
- C:\Windows\System\UONryjh.exe
  C:\Windows\System\UONryjh.exe
  2⤵
  PID:13176
- C:\Windows\System\EfiaDnl.exe
  C:\Windows\System\EfiaDnl.exe
  2⤵
  PID:13248
- C:\Windows\System\Ehfrmwx.exe
  C:\Windows\System\Ehfrmwx.exe
  2⤵
  PID:13304
- C:\Windows\System\vOXgjWF.exe
  C:\Windows\System\vOXgjWF.exe
  2⤵
  PID:11300
- C:\Windows\System\ckABOFO.exe
  C:\Windows\System\ckABOFO.exe
  2⤵
  PID:2412
- C:\Windows\System\gcggBWD.exe
  C:\Windows\System\gcggBWD.exe
  2⤵
  PID:7692
- C:\Windows\System\AxEhyPU.exe
  C:\Windows\System\AxEhyPU.exe
  2⤵
  PID:4488
- C:\Windows\System\vkqNEpT.exe
  C:\Windows\System\vkqNEpT.exe
  2⤵
  PID:11552
- C:\Windows\System\sLVoLxs.exe
  C:\Windows\System\sLVoLxs.exe
  2⤵
  PID:10668
- C:\Windows\System\YsbyvBl.exe
  C:\Windows\System\YsbyvBl.exe
  2⤵
  PID:12588
- C:\Windows\System\wisbLlu.exe
  C:\Windows\System\wisbLlu.exe
  2⤵
  PID:12996
- C:\Windows\System\eDnuwFA.exe
  C:\Windows\System\eDnuwFA.exe
  2⤵
  PID:12732
- C:\Windows\System\xuuyoha.exe
  C:\Windows\System\xuuyoha.exe
  2⤵
  PID:12676
- C:\Windows\System\jIqkJuT.exe
  C:\Windows\System\jIqkJuT.exe
  2⤵
  PID:12896
- C:\Windows\System\vBmnXnU.exe
  C:\Windows\System\vBmnXnU.exe
  2⤵
  PID:12736
- C:\Windows\System\hVrowAd.exe
  C:\Windows\System\hVrowAd.exe
  2⤵
  PID:5520
- C:\Windows\System\bgsnLGR.exe
  C:\Windows\System\bgsnLGR.exe
  2⤵
  PID:13280
- C:\Windows\System\KBkQLZL.exe
  C:\Windows\System\KBkQLZL.exe
  2⤵
  PID:10100
- C:\Windows\System\hXlUWSR.exe
  C:\Windows\System\hXlUWSR.exe
  2⤵
  PID:2224
- C:\Windows\System\IyRijYu.exe
  C:\Windows\System\IyRijYu.exe
  2⤵
  PID:5168
- C:\Windows\System\PCJupea.exe
  C:\Windows\System\PCJupea.exe
  2⤵
  PID:5460
- C:\Windows\System\OVXKIkb.exe
  C:\Windows\System\OVXKIkb.exe
  2⤵
  PID:12544
- C:\Windows\System\CvQdJyx.exe
  C:\Windows\System\CvQdJyx.exe
  2⤵
  PID:12496
- C:\Windows\System\QTqdUHD.exe
  C:\Windows\System\QTqdUHD.exe
  2⤵
  PID:5560
- C:\Windows\System\zrtfZNb.exe
  C:\Windows\System\zrtfZNb.exe
  2⤵
  PID:5732
- C:\Windows\System\lDWiPxd.exe
  C:\Windows\System\lDWiPxd.exe
  2⤵
  PID:5916
- C:\Windows\System\GhjYOgd.exe
  C:\Windows\System\GhjYOgd.exe
  2⤵
  PID:11712
- C:\Windows\System\SHKeNnt.exe
  C:\Windows\System\SHKeNnt.exe
  2⤵
  PID:5824
- C:\Windows\System\cEFcJHE.exe
  C:\Windows\System\cEFcJHE.exe
  2⤵
  PID:13316
- C:\Windows\System\OnJtzdQ.exe
  C:\Windows\System\OnJtzdQ.exe
  2⤵
  PID:13332
- C:\Windows\System\FwmhnhB.exe
  C:\Windows\System\FwmhnhB.exe
  2⤵
  PID:13348
- C:\Windows\System\iCzqegY.exe
  C:\Windows\System\iCzqegY.exe
  2⤵
  PID:13448
- C:\Windows\System\NtFAcFq.exe
  C:\Windows\System\NtFAcFq.exe
  2⤵
  PID:13464
- C:\Windows\System\EcIPDuP.exe
  C:\Windows\System\EcIPDuP.exe
  2⤵
  PID:13488
- C:\Windows\System\HhowYUk.exe
  C:\Windows\System\HhowYUk.exe
  2⤵
  PID:13504
- C:\Windows\System\LPAanzM.exe
  C:\Windows\System\LPAanzM.exe
  2⤵
  PID:13524
- C:\Windows\System\jGatXsE.exe
  C:\Windows\System\jGatXsE.exe
  2⤵
  PID:13548
- C:\Windows\System\GjRbzIP.exe
  C:\Windows\System\GjRbzIP.exe
  2⤵
  PID:13568
- C:\Windows\System\UslLAWH.exe
  C:\Windows\System\UslLAWH.exe
  2⤵
  PID:13584
- C:\Windows\System\YrneAnS.exe
  C:\Windows\System\YrneAnS.exe
  2⤵
  PID:13604
- C:\Windows\System\KpwpVtz.exe
  C:\Windows\System\KpwpVtz.exe
  2⤵
  PID:13628
- C:\Windows\System\UomtvDy.exe
  C:\Windows\System\UomtvDy.exe
  2⤵
  PID:13664
- C:\Windows\System\psnuTzn.exe
  C:\Windows\System\psnuTzn.exe
  2⤵
  PID:13684
- C:\Windows\System\vEVqmxG.exe
  C:\Windows\System\vEVqmxG.exe
  2⤵
  PID:13708
- C:\Windows\System\CMeWwyA.exe
  C:\Windows\System\CMeWwyA.exe
  2⤵
  PID:13728
- C:\Windows\System\lSiDvJt.exe
  C:\Windows\System\lSiDvJt.exe
  2⤵
  PID:13752
- C:\Windows\System\lmCPJgg.exe
  C:\Windows\System\lmCPJgg.exe
  2⤵
  PID:13768
- C:\Windows\System\JGdIDPW.exe
  C:\Windows\System\JGdIDPW.exe
  2⤵
  PID:13784
- C:\Windows\System\oYuOPvh.exe
  C:\Windows\System\oYuOPvh.exe
  2⤵
  PID:13800
- C:\Windows\System\fPAbCOf.exe
  C:\Windows\System\fPAbCOf.exe
  2⤵
  PID:13816
- C:\Windows\System\YEOKTOD.exe
  C:\Windows\System\YEOKTOD.exe
  2⤵
  PID:13832
- C:\Windows\System\tsAHGjL.exe
  C:\Windows\System\tsAHGjL.exe
  2⤵
  PID:13848
- C:\Windows\System\mywbQpp.exe
  C:\Windows\System\mywbQpp.exe
  2⤵
  PID:14288
- C:\Windows\System\hjMMGKK.exe
  C:\Windows\System\hjMMGKK.exe
  2⤵
  PID:14304
- C:\Windows\System\ZPpahDs.exe
  C:\Windows\System\ZPpahDs.exe
  2⤵
  PID:14320
- C:\Windows\System\yNzQoty.exe
  C:\Windows\System\yNzQoty.exe
  2⤵
  PID:384
- C:\Windows\System\UYyEDCl.exe
  C:\Windows\System\UYyEDCl.exe
  2⤵
  PID:12072
- C:\Windows\System\FFGySqr.exe
  C:\Windows\System\FFGySqr.exe
  2⤵
  PID:3696
- C:\Windows\System\zRMyftY.exe
  C:\Windows\System\zRMyftY.exe
  2⤵
  PID:11708
- C:\Windows\System\fNkFFeU.exe
  C:\Windows\System\fNkFFeU.exe
  2⤵
  PID:5960
- C:\Windows\System\DwwXdfA.exe
  C:\Windows\System\DwwXdfA.exe
  2⤵
  PID:6040
- C:\Windows\System\iTGDBTC.exe
  C:\Windows\System\iTGDBTC.exe
  2⤵
  PID:5424
- C:\Windows\System\rAzmYSO.exe
  C:\Windows\System\rAzmYSO.exe
  2⤵
  PID:12052
- C:\Windows\System\kkmHulS.exe
  C:\Windows\System\kkmHulS.exe
  2⤵
  PID:4592
- C:\Windows\System\RKZRBpz.exe
  C:\Windows\System\RKZRBpz.exe
  2⤵
  PID:5304
- C:\Windows\System\VGdIsYZ.exe
  C:\Windows\System\VGdIsYZ.exe
  2⤵
  PID:4668
- C:\Windows\System\PZlAtYv.exe
  C:\Windows\System\PZlAtYv.exe
  2⤵
  PID:11424
- C:\Windows\System\arpoPsg.exe
  C:\Windows\System\arpoPsg.exe
  2⤵
  PID:13576
- C:\Windows\System\tDhlgqD.exe
  C:\Windows\System\tDhlgqD.exe
  2⤵
  PID:4556
- C:\Windows\System\snvoWYv.exe
  C:\Windows\System\snvoWYv.exe
  2⤵
  PID:9284
- C:\Windows\System\MavoXqX.exe
  C:\Windows\System\MavoXqX.exe
  2⤵
  PID:12840
- C:\Windows\System\xcNNKdr.exe
  C:\Windows\System\xcNNKdr.exe
  2⤵
  PID:12660
- C:\Windows\System\ZUhQLtK.exe
  C:\Windows\System\ZUhQLtK.exe
  2⤵
  PID:13736
- C:\Windows\System\DIekgeN.exe
  C:\Windows\System\DIekgeN.exe
  2⤵
  PID:13764
- C:\Windows\System\uPvfXsV.exe
  C:\Windows\System\uPvfXsV.exe
  2⤵
  PID:6192
- C:\Windows\System\IAAKJkq.exe
  C:\Windows\System\IAAKJkq.exe
  2⤵
  PID:13372
- C:\Windows\System\CFOLrkK.exe
  C:\Windows\System\CFOLrkK.exe
  2⤵
  PID:13884
- C:\Windows\System\Hcafoev.exe
  C:\Windows\System\Hcafoev.exe
  2⤵
  PID:13740
- C:\Windows\System\cKRKVHG.exe
  C:\Windows\System\cKRKVHG.exe
  2⤵
  PID:13652
- C:\Windows\System\qeiPonq.exe
  C:\Windows\System\qeiPonq.exe
  2⤵
  PID:13704
- C:\Windows\System\ZqmnfwR.exe
  C:\Windows\System\ZqmnfwR.exe
  2⤵
  PID:11720
- C:\Windows\System\HMVBBgB.exe
  C:\Windows\System\HMVBBgB.exe
  2⤵
  PID:13776
- C:\Windows\System\gwgGtaA.exe
  C:\Windows\System\gwgGtaA.exe
  2⤵
  PID:13856
- C:\Windows\System\iilRywb.exe
  C:\Windows\System\iilRywb.exe
  2⤵
  PID:14016
- C:\Windows\System\rnOZWos.exe
  C:\Windows\System\rnOZWos.exe
  2⤵
  PID:6428
- C:\Windows\System\lUzOxNP.exe
  C:\Windows\System\lUzOxNP.exe
  2⤵
  PID:6424
- C:\Windows\System\HVmJRsm.exe
  C:\Windows\System\HVmJRsm.exe
  2⤵
  PID:6520
- C:\Windows\System\bKEIchH.exe
  C:\Windows\System\bKEIchH.exe
  2⤵
  PID:6540
- C:\Windows\System\UBOtlxr.exe
  C:\Windows\System\UBOtlxr.exe
  2⤵
  PID:6372
- C:\Windows\System\TNRXzvC.exe
  C:\Windows\System\TNRXzvC.exe
  2⤵
  PID:6864
- C:\Windows\System\xVsnDLK.exe
  C:\Windows\System\xVsnDLK.exe
  2⤵
  PID:6816
- C:\Windows\System\JFujseS.exe
  C:\Windows\System\JFujseS.exe
  2⤵
  PID:6956
- C:\Windows\System\WNpXDaL.exe
  C:\Windows\System\WNpXDaL.exe
  2⤵
  PID:13388
- C:\Windows\System\PWAQgjc.exe
  C:\Windows\System\PWAQgjc.exe
  2⤵
  PID:6272
- C:\Windows\System\cWslENH.exe
  C:\Windows\System\cWslENH.exe
  2⤵
  PID:6716
- C:\Windows\System\lHqupiN.exe
  C:\Windows\System\lHqupiN.exe
  2⤵
  PID:12592
- C:\Windows\System\SOnUHOy.exe
  C:\Windows\System\SOnUHOy.exe
  2⤵
  PID:6760
- C:\Windows\System\DlZWHpF.exe
  C:\Windows\System\DlZWHpF.exe
  2⤵
  PID:6708
- C:\Windows\System\DdeFZyn.exe
  C:\Windows\System\DdeFZyn.exe
  2⤵
  PID:6852
- C:\Windows\System\DhzjKDp.exe
  C:\Windows\System\DhzjKDp.exe
  2⤵
  PID:14160
- C:\Windows\System\fQSBFFk.exe
  C:\Windows\System\fQSBFFk.exe
  2⤵
  PID:13828
- C:\Windows\System\KQrpONF.exe
  C:\Windows\System\KQrpONF.exe
  2⤵
  PID:13516
- C:\Windows\System\cUTtbtY.exe
  C:\Windows\System\cUTtbtY.exe
  2⤵
  PID:13540
- C:\Windows\System\yLFWBYf.exe
  C:\Windows\System\yLFWBYf.exe
  2⤵
  PID:14216
- C:\Windows\System\ZybyXWS.exe
  C:\Windows\System\ZybyXWS.exe
  2⤵
  PID:12376
- C:\Windows\System\PLIqBIf.exe
  C:\Windows\System\PLIqBIf.exe
  2⤵
  PID:11144
- C:\Windows\System\nTYyYdE.exe
  C:\Windows\System\nTYyYdE.exe
  2⤵
  PID:13844
- C:\Windows\System\lklqQZs.exe
  C:\Windows\System\lklqQZs.exe
  2⤵
  PID:12460
- C:\Windows\System\cdHofrR.exe
  C:\Windows\System\cdHofrR.exe
  2⤵
  PID:5428
- C:\Windows\System\iHeHhCi.exe
  C:\Windows\System\iHeHhCi.exe
  2⤵
  PID:6284
- C:\Windows\System\lMSjWms.exe
  C:\Windows\System\lMSjWms.exe
  2⤵
  PID:5788
- C:\Windows\System\VBZabVd.exe
  C:\Windows\System\VBZabVd.exe
  2⤵
  PID:5184
- C:\Windows\System\OguVHlL.exe
  C:\Windows\System\OguVHlL.exe
  2⤵
  PID:7016
- C:\Windows\System\zvWqPer.exe
  C:\Windows\System\zvWqPer.exe
  2⤵
  PID:6460
- C:\Windows\System\cyRhkWU.exe
  C:\Windows\System\cyRhkWU.exe
  2⤵
  PID:13296
- C:\Windows\System\lddwNNC.exe
  C:\Windows\System\lddwNNC.exe
  2⤵
  PID:7112
- C:\Windows\System\iuMSaXC.exe
  C:\Windows\System\iuMSaXC.exe
  2⤵
  PID:13596
- C:\Windows\System\TYWHzZR.exe
  C:\Windows\System\TYWHzZR.exe
  2⤵
  PID:6548
- C:\Windows\System\TkZxiRI.exe
  C:\Windows\System\TkZxiRI.exe
  2⤵
  PID:14128
- C:\Windows\System\KrEsTUL.exe
  C:\Windows\System\KrEsTUL.exe
  2⤵
  PID:5896
- C:\Windows\System\CeiLCLJ.exe
  C:\Windows\System\CeiLCLJ.exe
  2⤵
  PID:6744
- C:\Windows\System\LmYKPNl.exe
  C:\Windows\System\LmYKPNl.exe
  2⤵
  PID:14156
- C:\Windows\System\pnXfOPA.exe
  C:\Windows\System\pnXfOPA.exe
  2⤵
  PID:412
- C:\Windows\System\uyDWyBF.exe
  C:\Windows\System\uyDWyBF.exe
  2⤵
  PID:14096
- C:\Windows\System\ruswGoN.exe
  C:\Windows\System\ruswGoN.exe
  2⤵
  PID:6792
- C:\Windows\System\pvoSRuf.exe
  C:\Windows\System\pvoSRuf.exe
  2⤵
  PID:7564
- C:\Windows\System\ZrmsnQG.exe
  C:\Windows\System\ZrmsnQG.exe
  2⤵
  PID:13972
- C:\Windows\System\bTfhtaS.exe
  C:\Windows\System\bTfhtaS.exe
  2⤵
  PID:3224
- C:\Windows\System\NysHvcq.exe
  C:\Windows\System\NysHvcq.exe
  2⤵
  PID:7484
- C:\Windows\System\fkOFEgU.exe
  C:\Windows\System\fkOFEgU.exe
  2⤵
  PID:14212
- C:\Windows\System\dBzPQaL.exe
  C:\Windows\System\dBzPQaL.exe
  2⤵
  PID:13564
- C:\Windows\System\MGKOsen.exe
  C:\Windows\System\MGKOsen.exe
  2⤵
  PID:12468
- C:\Windows\System\esIpUvD.exe
  C:\Windows\System\esIpUvD.exe
  2⤵
  PID:14088
- C:\Windows\System\fGPlNYx.exe
  C:\Windows\System\fGPlNYx.exe
  2⤵
  PID:7196
- C:\Windows\System\dSICQFI.exe
  C:\Windows\System\dSICQFI.exe
  2⤵
  PID:7612
- C:\Windows\System\VYHRJEd.exe
  C:\Windows\System\VYHRJEd.exe
  2⤵
  PID:6344
- C:\Windows\System\FRESErh.exe
  C:\Windows\System\FRESErh.exe
  2⤵
  PID:8148
- C:\Windows\System\uNrEvUZ.exe
  C:\Windows\System\uNrEvUZ.exe
  2⤵
  PID:7312
- C:\Windows\System\zhlFVpl.exe
  C:\Windows\System\zhlFVpl.exe
  2⤵
  PID:7572
- C:\Windows\System\uwTJVYw.exe
  C:\Windows\System\uwTJVYw.exe
  2⤵
  PID:7240
- C:\Windows\System\erwsFis.exe
  C:\Windows\System\erwsFis.exe
  2⤵
  PID:8164
- C:\Windows\System\VJKLNdZ.exe
  C:\Windows\System\VJKLNdZ.exe
  2⤵
  PID:6380
- C:\Windows\System\ySGNdsY.exe
  C:\Windows\System\ySGNdsY.exe
  2⤵
  PID:8028
- C:\Windows\System\RfEkFYo.exe
  C:\Windows\System\RfEkFYo.exe
  2⤵
  PID:7588
- C:\Windows\System\uTncbMD.exe
  C:\Windows\System\uTncbMD.exe
  2⤵
  PID:8160
- C:\Windows\System\dhPBtyO.exe
  C:\Windows\System\dhPBtyO.exe
  2⤵
  PID:14344
- C:\Windows\System\tZnKJHN.exe
  C:\Windows\System\tZnKJHN.exe
  2⤵
  PID:14368
- C:\Windows\System\xRbAJRY.exe
  C:\Windows\System\xRbAJRY.exe
  2⤵
  PID:14384
- C:\Windows\System\TjOEpGp.exe
  C:\Windows\System\TjOEpGp.exe
  2⤵
  PID:14416
- C:\Windows\System\aYnrrjF.exe
  C:\Windows\System\aYnrrjF.exe
  2⤵
  PID:14440
- C:\Windows\System\RhBojiP.exe
  C:\Windows\System\RhBojiP.exe
  2⤵
  PID:14552
- C:\Windows\System\QpdUFFY.exe
  C:\Windows\System\QpdUFFY.exe
  2⤵
  PID:14572
- C:\Windows\System\jXeIGjc.exe
  C:\Windows\System\jXeIGjc.exe
  2⤵
  PID:14588
- C:\Windows\System\Fhbuaij.exe
  C:\Windows\System\Fhbuaij.exe
  2⤵
  PID:14608
- C:\Windows\System\HkEDmEh.exe
  C:\Windows\System\HkEDmEh.exe
  2⤵
  PID:14628
- C:\Windows\System\FZjfSRD.exe
  C:\Windows\System\FZjfSRD.exe
  2⤵
  PID:14648
- C:\Windows\System\xERpzse.exe
  C:\Windows\System\xERpzse.exe
  2⤵
  PID:14668
- C:\Windows\System\bKXbbjZ.exe
  C:\Windows\System\bKXbbjZ.exe
  2⤵
  PID:14688
- C:\Windows\System\ADVFSdx.exe
  C:\Windows\System\ADVFSdx.exe
  2⤵
  PID:14712
- C:\Windows\System\DcMKNJk.exe
  C:\Windows\System\DcMKNJk.exe
  2⤵
  PID:14732
- C:\Windows\System\CEUimVp.exe
  C:\Windows\System\CEUimVp.exe
  2⤵
  PID:14752
- C:\Windows\System\sfWUOLv.exe
  C:\Windows\System\sfWUOLv.exe
  2⤵
  PID:14772
- C:\Windows\System\tNMcStQ.exe
  C:\Windows\System\tNMcStQ.exe
  2⤵
  PID:14808
- C:\Windows\System\EhsALvq.exe
  C:\Windows\System\EhsALvq.exe
  2⤵
  PID:14828
- C:\Windows\System\VEcEjqg.exe
  C:\Windows\System\VEcEjqg.exe
  2⤵
  PID:14844
- C:\Windows\System\AeUhEQC.exe
  C:\Windows\System\AeUhEQC.exe
  2⤵
  PID:14860
- C:\Windows\System\dyuDRsO.exe
  C:\Windows\System\dyuDRsO.exe
  2⤵
  PID:14876
- C:\Windows\System\QTPHGsW.exe
  C:\Windows\System\QTPHGsW.exe
  2⤵
  PID:14892
- C:\Windows\System\inTtmFj.exe
  C:\Windows\System\inTtmFj.exe
  2⤵
  PID:14920
- C:\Windows\System\uncLaOi.exe
  C:\Windows\System\uncLaOi.exe
  2⤵
  PID:14936
- C:\Windows\System\fTUquYD.exe
  C:\Windows\System\fTUquYD.exe
  2⤵
  PID:14960
- C:\Windows\System\YTyZhZW.exe
  C:\Windows\System\YTyZhZW.exe
  2⤵
  PID:14984
- C:\Windows\System\wIlCUPt.exe
  C:\Windows\System\wIlCUPt.exe
  2⤵
  PID:15000
- C:\Windows\System\GjyYsup.exe
  C:\Windows\System\GjyYsup.exe
  2⤵
  PID:15020
- C:\Windows\System\xMkDOMA.exe
  C:\Windows\System\xMkDOMA.exe
  2⤵
  PID:15056
- C:\Windows\System\EsGFRdb.exe
  C:\Windows\System\EsGFRdb.exe
  2⤵
  PID:15072
- C:\Windows\System\uAForIk.exe
  C:\Windows\System\uAForIk.exe
  2⤵
  PID:15096
- C:\Windows\System\fxBEfLv.exe
  C:\Windows\System\fxBEfLv.exe
  2⤵
  PID:15116
- C:\Windows\System\TvrRuZy.exe
  C:\Windows\System\TvrRuZy.exe
  2⤵
  PID:15140
- C:\Windows\System\vJzASDF.exe
  C:\Windows\System\vJzASDF.exe
  2⤵
  PID:15164
- C:\Windows\System\DtrwzBr.exe
  C:\Windows\System\DtrwzBr.exe
  2⤵
  PID:15188
- C:\Windows\System\bmDLhTJ.exe
  C:\Windows\System\bmDLhTJ.exe
  2⤵
  PID:15208
- C:\Windows\System\FbHoqHp.exe
  C:\Windows\System\FbHoqHp.exe
  2⤵
  PID:15228
- C:\Windows\System\daFcrFx.exe
  C:\Windows\System\daFcrFx.exe
  2⤵
  PID:15248
- C:\Windows\System\XcTqxFX.exe
  C:\Windows\System\XcTqxFX.exe
  2⤵
  PID:15268
- C:\Windows\System\WRsNMgZ.exe
  C:\Windows\System\WRsNMgZ.exe
  2⤵
  PID:15292
- C:\Windows\System\uIdCozd.exe
  C:\Windows\System\uIdCozd.exe
  2⤵
  PID:15316
- C:\Windows\System\eVbBwwF.exe
  C:\Windows\System\eVbBwwF.exe
  2⤵
  PID:15336
- C:\Windows\System\ZntvWgi.exe
  C:\Windows\System\ZntvWgi.exe
  2⤵
  PID:15356
- C:\Windows\System\yTnHufF.exe
  C:\Windows\System\yTnHufF.exe
  2⤵
  PID:5588
- C:\Windows\System\nJLWNay.exe
  C:\Windows\System\nJLWNay.exe
  2⤵
  PID:14140
- C:\Windows\System\oWvMKcP.exe
  C:\Windows\System\oWvMKcP.exe
  2⤵
  PID:7176
- C:\Windows\System\EGvfryr.exe
  C:\Windows\System\EGvfryr.exe
  2⤵
  PID:13000
- C:\Windows\System\avxQKtY.exe
  C:\Windows\System\avxQKtY.exe
  2⤵
  PID:14340
- C:\Windows\System\BZtCIuw.exe
  C:\Windows\System\BZtCIuw.exe
  2⤵
  PID:14392
- C:\Windows\System\MXsolda.exe
  C:\Windows\System\MXsolda.exe
  2⤵
  PID:14500
- C:\Windows\System\IHJzeID.exe
  C:\Windows\System\IHJzeID.exe
  2⤵
  PID:7200
- C:\Windows\System\YKKXIWA.exe
  C:\Windows\System\YKKXIWA.exe
  2⤵
  PID:7628
- C:\Windows\System\abinnoe.exe
  C:\Windows\System\abinnoe.exe
  2⤵
  PID:14616
- C:\Windows\System\PshLldp.exe
  C:\Windows\System\PshLldp.exe
  2⤵
  PID:14684
- C:\Windows\System\cGzhRnT.exe
  C:\Windows\System\cGzhRnT.exe
  2⤵
  PID:7796
- C:\Windows\System\eJeEtSN.exe
  C:\Windows\System\eJeEtSN.exe
  2⤵
  PID:14724
- C:\Windows\System\XyrEroj.exe
  C:\Windows\System\XyrEroj.exe
  2⤵
  PID:7400
- C:\Windows\System\uunUjgZ.exe
  C:\Windows\System\uunUjgZ.exe
  2⤵
  PID:7916
- C:\Windows\System\gTrzSpf.exe
  C:\Windows\System\gTrzSpf.exe
  2⤵
  PID:14796
- C:\Windows\System\imJNahh.exe
  C:\Windows\System\imJNahh.exe
  2⤵
  PID:14884
- C:\Windows\System\pvEeoQC.exe
  C:\Windows\System\pvEeoQC.exe
  2⤵
  PID:14904
- C:\Windows\System\boypOIA.exe
  C:\Windows\System\boypOIA.exe
  2⤵
  PID:14600
- C:\Windows\System\uNsegPi.exe
  C:\Windows\System\uNsegPi.exe
  2⤵
  PID:14948
- C:\Windows\System\QkfdoVA.exe
  C:\Windows\System\QkfdoVA.exe
  2⤵
  PID:14972
- C:\Windows\System\dzezNPI.exe
  C:\Windows\System\dzezNPI.exe
  2⤵
  PID:15016
- C:\Windows\System\xCaFGlp.exe
  C:\Windows\System\xCaFGlp.exe
  2⤵
  PID:7680
- C:\Windows\System\YRTZzcl.exe
  C:\Windows\System\YRTZzcl.exe
  2⤵
  PID:8344
- C:\Windows\System\mneahYV.exe
  C:\Windows\System\mneahYV.exe
  2⤵
  PID:15148
- C:\Windows\System\TnSmkgv.exe
  C:\Windows\System\TnSmkgv.exe
  2⤵
  PID:8348
- C:\Windows\System\McGdzzT.exe
  C:\Windows\System\McGdzzT.exe
  2⤵
  PID:8496
- C:\Windows\System\ZxrxcHH.exe
  C:\Windows\System\ZxrxcHH.exe
  2⤵
  PID:14528
- C:\Windows\System\BTSpohL.exe
  C:\Windows\System\BTSpohL.exe
  2⤵
  PID:7360
- C:\Windows\System\XcMIBsl.exe
  C:\Windows\System\XcMIBsl.exe
  2⤵
  PID:5480
- C:\Windows\System\inCCSIH.exe
  C:\Windows\System\inCCSIH.exe
  2⤵
  PID:8336
- C:\Windows\System\lOMuDrE.exe
  C:\Windows\System\lOMuDrE.exe
  2⤵
  PID:8476
- C:\Windows\System\tWJgmtQ.exe
  C:\Windows\System\tWJgmtQ.exe
  2⤵
  PID:8460
- C:\Windows\System\BuKowRH.exe
  C:\Windows\System\BuKowRH.exe
  2⤵
  PID:15088
- C:\Windows\System\gRWQubs.exe
  C:\Windows\System\gRWQubs.exe
  2⤵
  PID:15112
- C:\Windows\System\wGxoWdU.exe
  C:\Windows\System\wGxoWdU.exe
  2⤵
  PID:14852
- C:\Windows\System\ZQytLCk.exe
  C:\Windows\System\ZQytLCk.exe
  2⤵
  PID:15264
- C:\Windows\System\bxKQRWq.exe
  C:\Windows\System\bxKQRWq.exe
  2⤵
  PID:14872
- C:\Windows\System\qTHvyHK.exe
  C:\Windows\System\qTHvyHK.exe
  2⤵
  PID:8540
- C:\Windows\System\fSXmmzP.exe
  C:\Windows\System\fSXmmzP.exe
  2⤵
  PID:7508
- C:\Windows\System\QnlqMRD.exe
  C:\Windows\System\QnlqMRD.exe
  2⤵
  PID:7860
- C:\Windows\System\OTsrePX.exe
  C:\Windows\System\OTsrePX.exe
  2⤵
  PID:14944
- C:\Windows\System\fDxeIOO.exe
  C:\Windows\System\fDxeIOO.exe
  2⤵
  PID:3248
- C:\Windows\System\qQyAaGR.exe
  C:\Windows\System\qQyAaGR.exe
  2⤵
  PID:8416
- C:\Windows\System\yaluhgq.exe
  C:\Windows\System\yaluhgq.exe
  2⤵
  PID:8488
- C:\Windows\System\OLfHkyI.exe
  C:\Windows\System\OLfHkyI.exe
  2⤵
  PID:7996
- C:\Windows\System\fAueNFf.exe
  C:\Windows\System\fAueNFf.exe
  2⤵
  PID:14804
- C:\Windows\System\gEBLogp.exe
  C:\Windows\System\gEBLogp.exe
  2⤵
  PID:15380
- C:\Windows\System\AcNGrHt.exe
  C:\Windows\System\AcNGrHt.exe
  2⤵
  PID:15400
- C:\Windows\System\NyzqcrD.exe
  C:\Windows\System\NyzqcrD.exe
  2⤵
  PID:15420
- C:\Windows\System\pjpxmHO.exe
  C:\Windows\System\pjpxmHO.exe
  2⤵
  PID:15436
- C:\Windows\System\hAUFwli.exe
  C:\Windows\System\hAUFwli.exe
  2⤵
  PID:15456
- C:\Windows\System\cKSdxcy.exe
  C:\Windows\System\cKSdxcy.exe
  2⤵
  PID:15480
- C:\Windows\System\upHRNQZ.exe
  C:\Windows\System\upHRNQZ.exe
  2⤵
  PID:16376
- C:\Windows\System\xSoYbEe.exe
  C:\Windows\System\xSoYbEe.exe
  2⤵
  PID:15124
- C:\Windows\System\oWpOJET.exe
  C:\Windows\System\oWpOJET.exe
  2⤵
  PID:15280
- C:\Windows\System\AZMXFdq.exe
  C:\Windows\System\AZMXFdq.exe
  2⤵
  PID:15172
- C:\Windows\System\gzEVxXj.exe
  C:\Windows\System\gzEVxXj.exe
  2⤵
  PID:15244
- C:\Windows\System\siRACAB.exe
  C:\Windows\System\siRACAB.exe
  2⤵
  PID:15372
- C:\Windows\System\vMgcGJV.exe
  C:\Windows\System\vMgcGJV.exe
  2⤵
  PID:8332
- C:\Windows\System\hcPqGdl.exe
  C:\Windows\System\hcPqGdl.exe
  2⤵
  PID:5056
- C:\Windows\System\WhNmsSu.exe
  C:\Windows\System\WhNmsSu.exe
  2⤵
  PID:15792
- C:\Windows\System\JPgpovy.exe
  C:\Windows\System\JPgpovy.exe
  2⤵
  PID:15824
- C:\Windows\System\yfUrjmz.exe
  C:\Windows\System\yfUrjmz.exe
  2⤵
  PID:15900
- C:\Windows\System\jzSDWco.exe
  C:\Windows\System\jzSDWco.exe
  2⤵
  PID:16196
- C:\Windows\System\OIWaqhz.exe
  C:\Windows\System\OIWaqhz.exe
  2⤵
  PID:16232
- C:\Windows\System\wLuvQoA.exe
  C:\Windows\System\wLuvQoA.exe
  2⤵
  PID:16268
- C:\Windows\System\uDHudFf.exe
  C:\Windows\System\uDHudFf.exe
  2⤵
  PID:16288
- C:\Windows\System\bnmQNXP.exe
  C:\Windows\System\bnmQNXP.exe
  2⤵
  PID:16340
- C:\Windows\System\dJoixuG.exe
  C:\Windows\System\dJoixuG.exe
  2⤵
  PID:16368
- C:\Windows\System\jZLGulg.exe
  C:\Windows\System\jZLGulg.exe
  2⤵
  PID:7660
- C:\Windows\System\WDyXcWo.exe
  C:\Windows\System\WDyXcWo.exe
  2⤵
  PID:15300
- C:\Windows\System\QSIGDHu.exe
  C:\Windows\System\QSIGDHu.exe
  2⤵
  PID:15328
- C:\Windows\System\ZcxjrgC.exe
  C:\Windows\System\ZcxjrgC.exe
  2⤵
  PID:15332
- C:\Windows\System\SjvewhN.exe
  C:\Windows\System\SjvewhN.exe
  2⤵
  PID:15132
- C:\Windows\System\PmDOsOu.exe
  C:\Windows\System\PmDOsOu.exe
  2⤵
  PID:14524
- C:\Windows\System\tAXhVIK.exe
  C:\Windows\System\tAXhVIK.exe
  2⤵
  PID:4272
- C:\Windows\System\qHgQJUa.exe
  C:\Windows\System\qHgQJUa.exe
  2⤵
  PID:8424
- C:\Windows\System\IVOUkIr.exe
  C:\Windows\System\IVOUkIr.exe
  2⤵
  PID:8288
- C:\Windows\System\kNPfBCY.exe
  C:\Windows\System\kNPfBCY.exe
  2⤵
  PID:7656
- C:\Windows\System\iDmdbGM.exe
  C:\Windows\System\iDmdbGM.exe
  2⤵
  PID:14048
- C:\Windows\System\MxgRWax.exe
  C:\Windows\System\MxgRWax.exe
  2⤵
  PID:15136
- C:\Windows\System\fvUlvCR.exe
  C:\Windows\System\fvUlvCR.exe
  2⤵
  PID:2252
- C:\Windows\System\MaveLGG.exe
  C:\Windows\System\MaveLGG.exe
  2⤵
  PID:8608
- C:\Windows\System\MXrTQWM.exe
  C:\Windows\System\MXrTQWM.exe
  2⤵
  PID:15816
- C:\Windows\System\kDCXilF.exe
  C:\Windows\System\kDCXilF.exe
  2⤵
  PID:15744
- C:\Windows\System\RtENXPT.exe
  C:\Windows\System\RtENXPT.exe
  2⤵
  PID:9224
- C:\Windows\System\bPMAsde.exe
  C:\Windows\System\bPMAsde.exe
  2⤵
  PID:15768
- C:\Windows\System\tWdOhIm.exe
  C:\Windows\System\tWdOhIm.exe
  2⤵
  PID:15988
- C:\Windows\System\jQyCORG.exe
  C:\Windows\System\jQyCORG.exe
  2⤵
  PID:16036
- C:\Windows\System\KIQRGtd.exe
  C:\Windows\System\KIQRGtd.exe
  2⤵
  PID:16068
- C:\Windows\System\LyMtMpT.exe
  C:\Windows\System\LyMtMpT.exe
  2⤵
  PID:6048
- C:\Windows\System\DrpxWwl.exe
  C:\Windows\System\DrpxWwl.exe
  2⤵
  PID:7128
- C:\Windows\System\WNglNxs.exe
  C:\Windows\System\WNglNxs.exe
  2⤵
  PID:8472
- C:\Windows\System\tJUOzcz.exe
  C:\Windows\System\tJUOzcz.exe
  2⤵
  PID:8940
- C:\Windows\System\GTsORXV.exe
  C:\Windows\System\GTsORXV.exe
  2⤵
  PID:9824
- C:\Windows\System\jkSNXqX.exe
  C:\Windows\System\jkSNXqX.exe
  2⤵
  PID:9844
- C:\Windows\System\NViJuts.exe
  C:\Windows\System\NViJuts.exe
  2⤵
  PID:9868
- C:\Windows\System\dmaokqK.exe
  C:\Windows\System\dmaokqK.exe
  2⤵
  PID:15980
- C:\Windows\System\kMXWgCl.exe
  C:\Windows\System\kMXWgCl.exe
  2⤵
  PID:16248
- C:\Windows\System\AaTmKrl.exe
  C:\Windows\System\AaTmKrl.exe
  2⤵
  PID:15312
- C:\Windows\System\zMWWNRc.exe
  C:\Windows\System\zMWWNRc.exe
  2⤵
  PID:14396
- C:\Windows\System\HEMFcnb.exe
  C:\Windows\System\HEMFcnb.exe
  2⤵
  PID:9196
- C:\Windows\System\MhMgCGH.exe
  C:\Windows\System\MhMgCGH.exe
  2⤵
  PID:15604
- C:\Windows\System\elwrPbz.exe
  C:\Windows\System\elwrPbz.exe
  2⤵
  PID:9372
- C:\Windows\System\AGzsdbL.exe
  C:\Windows\System\AGzsdbL.exe
  2⤵
  PID:9872
- C:\Windows\System\EPWysmd.exe
  C:\Windows\System\EPWysmd.exe
  2⤵
  PID:16336
- C:\Windows\System\FsunOck.exe
  C:\Windows\System\FsunOck.exe
  2⤵
  PID:16352
- C:\Windows\System\EwHKkhu.exe
  C:\Windows\System\EwHKkhu.exe
  2⤵
  PID:7940
- C:\Windows\System\QYmYmGE.exe
  C:\Windows\System\QYmYmGE.exe
  2⤵
  PID:9392
- C:\Windows\System\tcDyRIz.exe
  C:\Windows\System\tcDyRIz.exe
  2⤵
  PID:4996
- C:\Windows\System\gyqukcv.exe
  C:\Windows\System\gyqukcv.exe
  2⤵
  PID:9312
- C:\Windows\System\VtECjfy.exe
  C:\Windows\System\VtECjfy.exe
  2⤵
  PID:14640
- C:\Windows\System\tbKaTjC.exe
  C:\Windows\System\tbKaTjC.exe
  2⤵
  PID:9804
- C:\Windows\System\VyWgrsl.exe
  C:\Windows\System\VyWgrsl.exe
  2⤵
  PID:9268
- C:\Windows\System\dNXzCKX.exe
  C:\Windows\System\dNXzCKX.exe
  2⤵
  PID:7900
- C:\Windows\System\HeJtRDN.exe
  C:\Windows\System\HeJtRDN.exe
  2⤵
  PID:16264
- C:\Windows\System\TfYXppi.exe
  C:\Windows\System\TfYXppi.exe
  2⤵
  PID:9256
- C:\Windows\System\eqbwGob.exe
  C:\Windows\System\eqbwGob.exe
  2⤵
  PID:16028
- C:\Windows\System\tMhpSNJ.exe
  C:\Windows\System\tMhpSNJ.exe
  2⤵
  PID:9440
- C:\Windows\System\yeenaRM.exe
  C:\Windows\System\yeenaRM.exe
  2⤵
  PID:4772
- C:\Windows\System\xNEWFMF.exe
  C:\Windows\System\xNEWFMF.exe
  2⤵
  PID:9884
- C:\Windows\System\vhUKJHT.exe
  C:\Windows\System\vhUKJHT.exe
  2⤵
  PID:15352
- C:\Windows\System\rcPgdYy.exe
  C:\Windows\System\rcPgdYy.exe
  2⤵
  PID:8484
- C:\Windows\System\xpJixmC.exe
  C:\Windows\System\xpJixmC.exe
  2⤵
  PID:8744
- C:\Windows\System\wKwEeCQ.exe
  C:\Windows\System\wKwEeCQ.exe
  2⤵
  PID:2556
- C:\Windows\System\vbfKJqH.exe
  C:\Windows\System\vbfKJqH.exe
  2⤵
  PID:380
- C:\Windows\System\YHWDKRx.exe
  C:\Windows\System\YHWDKRx.exe
  2⤵
  PID:9520
- C:\Windows\System\YrWFcaJ.exe
  C:\Windows\System\YrWFcaJ.exe
  2⤵
  PID:2352
- C:\Windows\System\eELwEpi.exe
  C:\Windows\System\eELwEpi.exe
  2⤵
  PID:9240
- C:\Windows\System\ktWHyGr.exe
  C:\Windows\System\ktWHyGr.exe
  2⤵
  PID:14456
- C:\Windows\System\orjmIvr.exe
  C:\Windows\System\orjmIvr.exe
  2⤵
  PID:5148
- C:\Windows\System\vWiCkpr.exe
  C:\Windows\System\vWiCkpr.exe
  2⤵
  PID:8980
- C:\Windows\System\RVyRutq.exe
  C:\Windows\System\RVyRutq.exe
  2⤵
  PID:10672
- C:\Windows\System\frpacJc.exe
  C:\Windows\System\frpacJc.exe
  2⤵
  PID:10844
- C:\Windows\System\REzepwC.exe
  C:\Windows\System\REzepwC.exe
  2⤵
  PID:8880
- C:\Windows\System\mdHrLaq.exe
  C:\Windows\System\mdHrLaq.exe
  2⤵
  PID:10688
- C:\Windows\System\HFIhPOY.exe
  C:\Windows\System\HFIhPOY.exe
  2⤵
  PID:11028
- C:\Windows\System\rMKiUmv.exe
  C:\Windows\System\rMKiUmv.exe
  2⤵
  PID:10712
- C:\Windows\System\gpdrSuR.exe
  C:\Windows\System\gpdrSuR.exe
  2⤵
  PID:1688
- C:\Windows\System\pRyXJnK.exe
  C:\Windows\System\pRyXJnK.exe
  2⤵
  PID:4632
- C:\Windows\System\AodZZxK.exe
  C:\Windows\System\AodZZxK.exe
  2⤵
  PID:8468
- C:\Windows\System\kPCdPki.exe
  C:\Windows\System\kPCdPki.exe
  2⤵
  PID:9644
- C:\Windows\System\uKWSjtx.exe
  C:\Windows\System\uKWSjtx.exe
  2⤵
  PID:15448
- C:\Windows\System\yWViYCe.exe
  C:\Windows\System\yWViYCe.exe
  2⤵
  PID:9704
- C:\Windows\System\mAFaVNS.exe
  C:\Windows\System\mAFaVNS.exe
  2⤵
  PID:9040
- C:\Windows\System\UhDTOxs.exe
  C:\Windows\System\UhDTOxs.exe
  2⤵
  PID:10076
- C:\Windows\System\lzemcVC.exe
  C:\Windows\System\lzemcVC.exe
  2⤵
  PID:10760
- C:\Windows\System\lLuxGZW.exe
  C:\Windows\System\lLuxGZW.exe
  2⤵
  PID:9728
- C:\Windows\System\mILsTks.exe
  C:\Windows\System\mILsTks.exe
  2⤵
  PID:2168
- C:\Windows\System\fzBnMuL.exe
  C:\Windows\System\fzBnMuL.exe
  2⤵
  PID:9672
- C:\Windows\System\mAjZDcM.exe
  C:\Windows\System\mAjZDcM.exe
  2⤵
  PID:64
- C:\Windows\System\FlFkvjY.exe
  C:\Windows\System\FlFkvjY.exe
  2⤵
  PID:15628
- C:\Windows\System\xpocvVQ.exe
  C:\Windows\System\xpocvVQ.exe
  2⤵
  PID:15288
- C:\Windows\System\lISQfrS.exe
  C:\Windows\System\lISQfrS.exe
  2⤵
  PID:5408
- C:\Windows\System\YfdMZBV.exe
  C:\Windows\System\YfdMZBV.exe
  2⤵
  PID:9516
- C:\Windows\System\EjZUWCX.exe
  C:\Windows\System\EjZUWCX.exe
  2⤵
  PID:9744
- C:\Windows\System\lXSbcfF.exe
  C:\Windows\System\lXSbcfF.exe
  2⤵
  PID:2472
- C:\Windows\System\GozGmOb.exe
  C:\Windows\System\GozGmOb.exe
  2⤵
  PID:8256
- C:\Windows\System\RzTPWfB.exe
  C:\Windows\System\RzTPWfB.exe
  2⤵
  PID:5040
- C:\Windows\System\atdQdfk.exe
  C:\Windows\System\atdQdfk.exe
  2⤵
  PID:11112
- C:\Windows\System\FGtvVFh.exe
  C:\Windows\System\FGtvVFh.exe
  2⤵
  PID:9684
- C:\Windows\System\VTcCaXc.exe
  C:\Windows\System\VTcCaXc.exe
  2⤵
  PID:16320
- C:\Windows\System\oLDedOI.exe
  C:\Windows\System\oLDedOI.exe
  2⤵
  PID:10880
- C:\Windows\System\Wpqtwpk.exe
  C:\Windows\System\Wpqtwpk.exe
  2⤵
  PID:16052
- C:\Windows\System\jzuYwXF.exe
  C:\Windows\System\jzuYwXF.exe
  2⤵
  PID:15108
- C:\Windows\System\jtxhaaX.exe
  C:\Windows\System\jtxhaaX.exe
  2⤵
  PID:8664
- C:\Windows\System\xaOxjqU.exe
  C:\Windows\System\xaOxjqU.exe
  2⤵
  PID:11056
- C:\Windows\System\GfpxLwQ.exe
  C:\Windows\System\GfpxLwQ.exe
  2⤵
  PID:11192
- C:\Windows\System\YnNTozx.exe
  C:\Windows\System\YnNTozx.exe
  2⤵
  PID:15064
- C:\Windows\System\IIdZfYf.exe
  C:\Windows\System\IIdZfYf.exe
  2⤵
  PID:10640
- C:\Windows\System\cmCfMGk.exe
  C:\Windows\System\cmCfMGk.exe
  2⤵
  PID:10296
- C:\Windows\System\kxILIie.exe
  C:\Windows\System\kxILIie.exe
  2⤵
  PID:10708
- C:\Windows\System\YGOEuJi.exe
  C:\Windows\System\YGOEuJi.exe
  2⤵
  PID:8292
- C:\Windows\System\uNuBRWT.exe
  C:\Windows\System\uNuBRWT.exe
  2⤵
  PID:16276
- C:\Windows\System\jvCSKAA.exe
  C:\Windows\System\jvCSKAA.exe
  2⤵
  PID:9356
- C:\Windows\System\CGsOWCQ.exe
  C:\Windows\System\CGsOWCQ.exe
  2⤵
  PID:9892
- C:\Windows\System\YuvKZiG.exe
  C:\Windows\System\YuvKZiG.exe
  2⤵
  PID:3592
- C:\Windows\System\GCbVeXC.exe
  C:\Windows\System\GCbVeXC.exe
  2⤵
  PID:9832
- C:\Windows\System\HuYDttB.exe
  C:\Windows\System\HuYDttB.exe
  2⤵
  PID:10164
- C:\Windows\System\aRGeScY.exe
  C:\Windows\System\aRGeScY.exe
  2⤵
  PID:10432
- C:\Windows\System\mXHucbT.exe
  C:\Windows\System\mXHucbT.exe
  2⤵
  PID:464
- C:\Windows\System\YazVSRg.exe
  C:\Windows\System\YazVSRg.exe
  2⤵
  PID:9888
- C:\Windows\System\rxNzkvJ.exe
  C:\Windows\System\rxNzkvJ.exe
  2⤵
  PID:13360
- C:\Windows\System\cIhMcui.exe
  C:\Windows\System\cIhMcui.exe
  2⤵
  PID:11188
- C:\Windows\System\NYBmyIJ.exe
  C:\Windows\System\NYBmyIJ.exe
  2⤵
  PID:8452
- C:\Windows\System\TkgoBab.exe
  C:\Windows\System\TkgoBab.exe
  2⤵
  PID:9836
- C:\Windows\System\sAXCNmZ.exe
  C:\Windows\System\sAXCNmZ.exe
  2⤵
  PID:10516
- C:\Windows\System\TNanrVK.exe
  C:\Windows\System\TNanrVK.exe
  2⤵
  PID:11352
- C:\Windows\System\ZtVVBEv.exe
  C:\Windows\System\ZtVVBEv.exe
  2⤵
  PID:6140
- C:\Windows\System\vXmshhU.exe
  C:\Windows\System\vXmshhU.exe
  2⤵
  PID:10860
- C:\Windows\System\ylHlsRj.exe
  C:\Windows\System\ylHlsRj.exe
  2⤵
  PID:5180
- C:\Windows\System\ljDUwnt.exe
  C:\Windows\System\ljDUwnt.exe
  2⤵
  PID:10312
- C:\Windows\System\KnOgiSI.exe
  C:\Windows\System\KnOgiSI.exe
  2⤵
  PID:12928
- C:\Windows\System\VyLddYF.exe
  C:\Windows\System\VyLddYF.exe
  2⤵
  PID:4408
- C:\Windows\System\BLVhLXK.exe
  C:\Windows\System\BLVhLXK.exe
  2⤵
  PID:15408
- C:\Windows\System\hejRJFU.exe
  C:\Windows\System\hejRJFU.exe
  2⤵
  PID:10892
- C:\Windows\System\KtpJUKc.exe
  C:\Windows\System\KtpJUKc.exe
  2⤵
  PID:8920
- C:\Windows\System\QAApzup.exe
  C:\Windows\System\QAApzup.exe
  2⤵
  PID:11100
- C:\Windows\System\OPULAyN.exe
  C:\Windows\System\OPULAyN.exe
  2⤵
  PID:9772
- C:\Windows\System\xfFFHmK.exe
  C:\Windows\System\xfFFHmK.exe
  2⤵
  PID:11420
- C:\Windows\System\zCOwcYi.exe
  C:\Windows\System\zCOwcYi.exe
  2⤵
  PID:13924
- C:\Windows\System\qTuUTMY.exe
  C:\Windows\System\qTuUTMY.exe
  2⤵
  PID:13968
- C:\Windows\System\ycawzaS.exe
  C:\Windows\System\ycawzaS.exe
  2⤵
  PID:11224
- C:\Windows\System\wvNuBmR.exe
  C:\Windows\System\wvNuBmR.exe
  2⤵
  PID:2856
- C:\Windows\System\CKptHps.exe
  C:\Windows\System\CKptHps.exe
  2⤵
  PID:3832
- C:\Windows\System\xbEcBOh.exe
  C:\Windows\System\xbEcBOh.exe
  2⤵
  PID:14072
- C:\Windows\System\SnSDLav.exe
  C:\Windows\System\SnSDLav.exe
  2⤵
  PID:14084
- C:\Windows\System\FguEHHO.exe
  C:\Windows\System\FguEHHO.exe
  2⤵
  PID:15324
- C:\Windows\System\jczgyKo.exe
  C:\Windows\System\jczgyKo.exe
  2⤵
  PID:11512
- C:\Windows\System\CaMtTFK.exe
  C:\Windows\System\CaMtTFK.exe
  2⤵
  PID:5312
- C:\Windows\System\PryBAor.exe
  C:\Windows\System\PryBAor.exe
  2⤵
  PID:8896
- C:\Windows\System\Fmizqqn.exe
  C:\Windows\System\Fmizqqn.exe
  2⤵
  PID:8592
- C:\Windows\System\heMyuFv.exe
  C:\Windows\System\heMyuFv.exe
  2⤵
  PID:8364
- C:\Windows\System\grNiAKl.exe
  C:\Windows\System\grNiAKl.exe
  2⤵
  PID:11860
- C:\Windows\System\bfYfeFL.exe
  C:\Windows\System\bfYfeFL.exe
  2⤵
  PID:8420
- C:\Windows\System\DyDYGwh.exe
  C:\Windows\System\DyDYGwh.exe
  2⤵
  PID:10852
- C:\Windows\System\CrMcues.exe
  C:\Windows\System\CrMcues.exe
  2⤵
  PID:6044
- C:\Windows\System\VtMZflO.exe
  C:\Windows\System\VtMZflO.exe
  2⤵
  PID:12020
- C:\Windows\System\AMFfZNm.exe
  C:\Windows\System\AMFfZNm.exe
  2⤵
  PID:12180
- C:\Windows\System\iZQzRou.exe
  C:\Windows\System\iZQzRou.exe
  2⤵
  PID:12152
- C:\Windows\System\veTQCfR.exe
  C:\Windows\System\veTQCfR.exe
  2⤵
  PID:12164
- C:\Windows\System\GbtfnhU.exe
  C:\Windows\System\GbtfnhU.exe
  2⤵
  PID:9664
- C:\Windows\System\JVAtGYQ.exe
  C:\Windows\System\JVAtGYQ.exe
  2⤵
  PID:4072
- C:\Windows\System\JevRUCd.exe
  C:\Windows\System\JevRUCd.exe
  2⤵
  PID:3148
- C:\Windows\System\SKAEvFR.exe
  C:\Windows\System\SKAEvFR.exe
  2⤵
  PID:10092
- C:\Windows\System\vhyAvfn.exe
  C:\Windows\System\vhyAvfn.exe
  2⤵
  PID:1484
- C:\Windows\System\eOYUViN.exe
  C:\Windows\System\eOYUViN.exe
  2⤵
  PID:9724
- C:\Windows\System\CFDUoOq.exe
  C:\Windows\System\CFDUoOq.exe
  2⤵
  PID:6208
- C:\Windows\System\YhfqbWB.exe
  C:\Windows\System\YhfqbWB.exe
  2⤵
  PID:11888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:7884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_zz0h20ra.bou.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zz0h20ra.bou.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AghOSwm.exe

Path C:\Windows\System\AghOSwm.exe
Size 1.9MB
SHA256 2f78cc18a5b8b4056628003e6337f5c79219e3c5ccc57ee337dd531109d3c907
MD5 327ef997ab96a440f134673393454d79
SHA1 1fdd630d248e18c773681fe634d919a1ab705103
SHA512 6b68b9671463cf4030e90122822dcbf5aafba8f3d81d7ee79ae56db4c1126e12b255a05a32756e9fd879bb9b3e387ef64b6a8333b7ab0587742813d26e2a0552
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo7:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AtAuxhi.exe

Path C:\Windows\System\AtAuxhi.exe
Size 1.9MB
SHA256 3fc442d97627f9a156b0c7a97ea9ff36ba686b8851406cc01fe887b5dbb4ffa8
MD5 ec925f2af0d00279d8a3e3dbe32d1642
SHA1 3d23b700ba11aef6e400d62934a4f26f0554046f
SHA512 e1a5689242ebb6d8d8e465a6e451b5cc9795c67a2b248b63bc42c3198088e80f311e9c38e5b21e9bd8a9044d7bcda987e85d7c3156fa63dd60d6761aa067eb86
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoB:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDJjYdP.exe

Path C:\Windows\System\BDJjYdP.exe
Size 1.9MB
SHA256 a581d033385c8bfa519f370c2b7313e0b65ebd982a6979b6e492b3e58f4880d9
MD5 7b1b097560c0f9f0ad8576ed040658d9
SHA1 fc4bdab671d3d9e57fece8a0c86f0e56924b3106
SHA512 87e173f4b529c4d5c7fbcf9b325970d39df85a3b741acdac8f53c431a8a6b253f08bfc837f57af1d2fdce01bb625ae94e5baa8458b671755592c02fde97a9ed6
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoa:NABt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CHimUUv.exe

Path C:\Windows\System\CHimUUv.exe
Size 1.9MB
SHA256 707d5480afffc8496484c7f178aecf079cbdb627b1b8a3d0ee33ae0fb02e3aec
MD5 2d9e82f42e777395a17cf57f9eb61e03
SHA1 eab842f8817a590bc2447162b2e55cae7bb380bb
SHA512 2885b3c5d268e4db801078bbfba97ba49a74dc5d665cc40b5efa85c7ecee731b38545f49ca9511a6aa6394e54c54c789325f618990bbbdee74d85bf5c051ce99
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo1:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

EMrDZDr.exe

Path C:\Windows\System\EMrDZDr.exe
Size 1.9MB
SHA256 abb202eee0e2c3cfc693b713c5827bef59549865efa94d598098f6e802c57d14
MD5 9e318b98a35170d272df14e0bf292d5c
SHA1 902c1cfa0daf2cb4d796de5879fbac35bbbb79ee
SHA512 66c20f17ac64861062d2fb1448554bf8e152df4aa3d40987fe83cccf22b5bb9b352d385013dae4b1ca0f3075fb3af2ead904d8bca616358198bc98aa11f3abf6
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoJ:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

HYDVewf.exe

Path C:\Windows\System\HYDVewf.exe
Size 1.9MB
SHA256 77099a7e7449814e4119409b329df10cec30d3b5ea35e97a95663f313226b0bc
MD5 ae90d3a8bfaca2d432e1b270905489e6
SHA1 f828a0e681e602eb847e2f4bfb4bd8eca8d09c28
SHA512 b83b0c42319c7cbc0fa467820f2dcd599ba181fba263b35491ed767e0abafd74e30387d857ac8e7355dd249529f1a83a127409039f538ff2785c2e65b8e37a43
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuop:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

HkVhdzA.exe

Path C:\Windows\System\HkVhdzA.exe
Size 1.9MB
SHA256 b78f403399871a2d066b53f15b8a247b35235df6c41cdae756710a9c01b4ef94
MD5 c7ab9706ed16fd529f4d19c433c5570d
SHA1 8fb9647c171981edb5bbca008ef3d27be4b90d48
SHA512 62093ff03e0abda299ac5fe4c16f3cb969c1a3ded192c4fa8ae9f91d6064994f9fb82c7afb4cbc369c215e589b324bc70a963e9601bf5bde8c285053b8b88eec
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoy:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JBMRaCm.exe

Path C:\Windows\System\JBMRaCm.exe
Size 1.9MB
SHA256 0394d92f9fa7f9183b6dcfec7aff52b4ee97b756811622054d74b0d1b0d5949a
MD5 23f8535f257416e7ee7c4e742d0e3aca
SHA1 f07a6f4cdeb567960022cd54dc1fba390a37c68e
SHA512 6f199a91e4cac117d12dec2def6a937f4bf093f61d9f2b09c1f6dfeb721f9aabecaadd310d02e5269db191a7645a2ab98f368b7528431a8479714396171eaf48
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoY:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MDxyyCv.exe

Path C:\Windows\System\MDxyyCv.exe
Size 1.9MB
SHA256 77472e0d5f6ecc05ac9c1167e6239318abc121aa0fdf4034bd47a8c09644d895
MD5 9d81d82124cbcc12cdbf787416cc9942
SHA1 5e27b3f78d60ba248f5bc8b71b9abec1b8347477
SHA512 65b07a1f4d1768e96ee0b8e9d8f3513cb3680a5bebf3c3a50f628b5d51726c2108cdf7653ac7ae19696cfc030aa0de3c0994ae8994dfad2dd3f70fd3383086e1
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoy:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

MIyxtkw.exe

Path C:\Windows\System\MIyxtkw.exe
Size 1.9MB
SHA256 3a00cfd4fac3af73be344d6c3534162e3670e775b69ed62465f52cabd1dd6652
MD5 df778e6954196f389e64262231b3c6a4
SHA1 558c429ddc8066c3195848047856133126d547a5
SHA512 0a9b83b64f98e26e87eb350fcaafabd0f24aacb9b9ef55b823727e6d87e0efa3f75621c1bfa96266140561b5aabccdafd0c0b697cbccd5ffc21e12d9896369d6
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoO:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

NOsnlSC.exe

Path C:\Windows\System\NOsnlSC.exe
Size 1.9MB
SHA256 073067d412909b76dff1fbf90b7a17c190cf45f4a16e3a26fdc6d654294ce4fd
MD5 930c3d0375346b2cd8d1cb720edeeaf4
SHA1 8a50ab710afad5415b83fbb6fda8adb0103efe1a
SHA512 8a3ed4d5e221a4ca786caece1e097bb69b0da4691f9aa2fdeef9af32d60a4369fe6a170d54744271db370a6f2d93d925d639c9a499f1b08921c4e25836e3a276
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoz:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

RsLbqat.exe

Path C:\Windows\System\RsLbqat.exe
Size 1.9MB
SHA256 22903b1ccd1ed1461c0379bfeafcff2cd95c842bc4f0bac3f554991bb1275c92
MD5 efdbcf550b5a8053ad6d232520a53ab6
SHA1 13aa1d9891ab2866a40ce59014ec84de286ce36c
SHA512 8d199467f4b3f7da8ecd5bff602c14c99d5a225bf0ccaef410c2bfb289031ec80dda0d1e4e5ce7e338052a6991fa081377d8762163cacae455d00978351ccbb6
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoY:NABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

STtDOod.exe

Path C:\Windows\System\STtDOod.exe
Size 1.9MB
SHA256 bd339da4dd5eda073875e477883757636e0e152683b4eccce949f46f7f4e2bf9
MD5 c80e51bffccf15e7e10ea3a5b29860fb
SHA1 65821a4a15ce4783c565275260cf2794737a3b17
SHA512 86193b606d7a809f7f8430c48c5c0bb002b9e522b1b1b27529132196003372da9413a25870c3a295a48e494c16292f932263882e1c39b9a9af2a1913a4eab015
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuol:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

UEpuNBN.exe

Path C:\Windows\System\UEpuNBN.exe
Size 1.9MB
SHA256 5fa669126dd1de90308d109a9bd7fdd7a276096aaf0a7ce6e39aa8b108c9fe70
MD5 68b43817d45d2b2f96f1f7c0b89072eb
SHA1 d32d4c6714d0330125ce6a42d151dcab3721d0d0
SHA512 7dcbf0cfcff485c7ef005e526b922bc7b248e10361620033d6b310df0aee889f31b750cefda681be32eecc015464d26a8307a382daa07c539ee88e956fa8673a
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoR:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

VJgrMFy.exe

Path C:\Windows\System\VJgrMFy.exe
Size 1.9MB
SHA256 0750c8413eef192da449969ee435baea9cb6db5e98a4b99b3f4763b27d9f4a86
MD5 69dbdc64b9d2ba988067d7e57ebe8b3a
SHA1 468cf18c3b9863b4cd620d0f666bc5b30e7e84cf
SHA512 7ed8ce977b5e127931fb146aa058f9f664bb17d551864409b6c2f1b9beddb3c0b6a5850d144fac069e562bc0fe7212e13f4f489d01e40fa18d1ed482d05395be
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoU:NABR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WDckPUk.exe

Path C:\Windows\System\WDckPUk.exe
Size 1.9MB
SHA256 f68bc034d8325fdf36f6074086347d0c25da40f070c385d549f82e3b07860340
MD5 c714e44f2598a935f47d12a93d6eb5d5
SHA1 63e25e01f54829a87781e241142d1c4947b9d9c9
SHA512 9279d68ee74427bedd783cfe3434b9f225b5afc0d799aac7e84241aa73f0ea3739eff50187d4b829c5e5ebf290c1fff4f4bc64b2632831e6d0996961a4b55005
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuop:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

WIaeKZc.exe

Path C:\Windows\System\WIaeKZc.exe
Size 1.9MB
SHA256 48ca8d5361791859ebaa8a7734377c3a5a9041e774098c2919568ddd33449ad2
MD5 4d7311e7bdf32d53b4a1e79a87787643
SHA1 f6d844dadc2cef1ead2436ea4c87fda88e3c5a23
SHA512 4fcce3071eb82555430414a80fe23d5b24acd7e28c59e2cf4dca4eb50955cdf682953ce5a7892561d5228c5bf8bbae03510e7e1d07a99d045ac8dda177b153d6
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuod:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

XTTIQcz.exe

Path C:\Windows\System\XTTIQcz.exe
Size 1.9MB
SHA256 998fb81ea23967ed1dfff2739164209075a293639aaa614a4eada32b88d7da9c
MD5 130ac60c0d7e829915ac9d5a49273786
SHA1 7aee2cd3cdf1e08247743aa28beac4fb48c7fde5
SHA512 bb8c0208411e799d9ee4d0d355038cb220d8bd049c20c4f038b471d1c9f391ff9eaf6d3357606cb9221c0473ce0d443739366229781450d6a1c5fe43a408f739
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoue:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

YxYqbJb.exe

Path C:\Windows\System\YxYqbJb.exe
Size 1.9MB
SHA256 d60c0dc8a5563436a5eb0cf4964db0db8cb88b676f8b9fe064c3fa5567c816c8
MD5 9824726750017a3c9ff4c17490672e2c
SHA1 9d9f5a26b4a6df28cdbdf08718dee42a49a86f66
SHA512 e7c98dd0dd0507c5ce4226a75533133b36aa8e6a47e532a46e2ed48140c1786ce350abb0f7f7732d405c799772b32c59fb1c792b0b9278cfb8531ca80f153f9f
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoo:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

aSqxrOn.exe

Path C:\Windows\System\aSqxrOn.exe
Size 1.9MB
SHA256 c46e0b7ecdf1c3dfb0a163c84cd71d73728904917a5a15e28c6a4bee1a3379da
MD5 bf39148933643fad3bb8b1f8e0d75399
SHA1 b54ccdef26e42e8ac245b6791444a85daa2086fd
SHA512 dabb1bdaa9cf78b1dc62091538d4fe024573459aedbf6b2541c31d188062127e762b554e65e4175c4ffd217b221098c518e56395072db05fd1a05fe77cb6084e
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoJ:NAB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

erytwwg.exe

Path C:\Windows\System\erytwwg.exe
Size 1.9MB
SHA256 fa3cf74ce75ae303ed8c5fc67dae7e46c3fb6e4b49744efd91fe394f2c45795a
MD5 f5f0e7bbd599512c96c2c61d4f1dc49e
SHA1 00176e78ce73b6134d7f9bcbf39766b7b9c2185c
SHA512 96438b67a791e9ba956166969e54e6b7d977dca3a30da37f335cfbb1f2485109a69a4b2107d1a936087aa06dddcb89b394a44ac77255d1faddbc3a6db5778a5e
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo8:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

esfpNWD.exe

Path C:\Windows\System\esfpNWD.exe
Size 1.9MB
SHA256 132964ea2b6b612ed6a3a9d67845d5a9c3b41fbeb446f233a97b752677467ff0
MD5 4ab663e24d97be07abaf588e636ae0b5
SHA1 78da894be928be48c699c7bd91a12954037cc300
SHA512 1823f1f9ef10c29da0389d41a2d3d3989e675cdcdeb5577a02bdb2cebbd8b4f7c8b1e0460f932cd6bc6eab1b4c2e30699fccd11a7cff6855db7085efb63f9d6b
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoo:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fcarhrI.exe

Path C:\Windows\System\fcarhrI.exe
Size 1.9MB
SHA256 d49d801917fffb2f65b78cb836cace2312af729282238e998f8a432838ca74b0
MD5 6382d92604391662d42aea16bdf5cb11
SHA1 03e3898e71c2c7eac2f854237f8c27573143f882
SHA512 576ef1cb160eaa88662211ea8b0c22d66167808c81a9e015b72ee37046c607d5cd9422984978051d5e4c65322e4db6111c244f71da7bbca41b3322a93536c694
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo4:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjKmYYT.exe

Path C:\Windows\System\jjKmYYT.exe
Size 1.9MB
SHA256 727eb35ffca6b9dfa77aa65a3d93273c8e516738730dda6c95c7ae943115991d
MD5 166c3d7bd3767467d94bf836f22a7133
SHA1 f72cee43db35eee837a7c10cd32cb3707960020d
SHA512 9d56a2055c1419ba62dfb9adf79db826d30bf245999994ef82026928ce01a07fcd75bd92bf39d8558a5280818153aea269d9307c295e4ac99c5627cb42072eb8
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuov:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

lvKiyHR.exe

Path C:\Windows\System\lvKiyHR.exe
Size 1.9MB
SHA256 26323474bd952c3b58781aab12d6885610029e8d6948e72873cea612089ac84f
MD5 a853eb1529f1fd1db50e50faca5388db
SHA1 25eb5d5005b36744936ab03dc6a5139b756a89bd
SHA512 7806e09a17c68e6e5d77fdcde2dcd51dcc166c7da0ea1eac4ed96b07745c764538565b246491432a428ec6e90a5b019499aa8504d14f07a868282e519c06d73e
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuo3:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

nGUpFIS.exe

Path C:\Windows\System\nGUpFIS.exe
Size 1.9MB
SHA256 2b5c321233e7e3baf28c44771073860493ba5d115239050b742601718fe5b9d8
MD5 0f8656c88514b04817ed9ffdb41bae4c
SHA1 2f0c1a79fb269b34246c8b384eb417d95ec4ce6c
SHA512 15662603a9c12b6f5ed7c41d6fc7ddaf3a17b39c13a8314aaed6b1cf6fbdd48aa01f7099498fe6df3937bec2544bf0adfced8ffd4987abd7a5b076b06787d22d
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoQw:NABO
MD5 SHA1 SHA512 SSDEEP

Submit Download

uJONAaP.exe

Path C:\Windows\System\uJONAaP.exe
Size 1.9MB
SHA256 422b35660f4f1b1c969a9253929f6dfb04689a18aca734be4adcd435a34ea830
MD5 756b653a5757d4bb6b2f7e763d513bc7
SHA1 dbefa8817a522d78eb69054a0f64d31f798705f9
SHA512 8a1b80573fd56d098543d29f638cd0e5b96da88e3bb63fd6737bf331b53d6c608ed4cc8d23dd4b0b4dcef286645f1e4d3ca6db2510a3a7ebea703f1a6427d3fc
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoH:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vYNioZy.exe

Path C:\Windows\System\vYNioZy.exe
Size 1.9MB
SHA256 3b26286aceff8ceef9c5771186716462ede4a95d24a5fd1d9a8e25aa78bd7076
MD5 48941a6e88cc32b6f1a63aeccfb04b07
SHA1 13a7e9afb6df6595017614e7077f49f732486be0
SHA512 1caa2700e955fbb3061419a806ec611b9ce3d509acdfe73ff60b7402ec7b91955e37f1cb36fc3037b7785e5a03182fdd626478dca348c950f50c101fb14f419e
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuol:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

vxqqRHG.exe

Path C:\Windows\System\vxqqRHG.exe
Size 1.9MB
SHA256 c7e9a2782a9cb32df00970d6c2743cf02647abc04e7c944e419e8e95a725d733
MD5 178d2495c24d96c81a494c712f6335b1
SHA1 01313e4b5b54fac5ec1f0252de5684b98aa273c0
SHA512 5f192ebed359651db59b548abfbdbb695607321a48da6647aa6662b4842ee48fc7dfbea857093a3a2a648ee4c01581d3ee45c5811389cf913bfc0bff39e8d6cf
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuon:NABE
MD5 SHA1 SHA512 SSDEEP

Submit Download

wJmEcDZ.exe

Path C:\Windows\System\wJmEcDZ.exe
Size 1.9MB
SHA256 288a3e69547a84676e8be276614d8666c4bc89470d0e0cd4fbb58f3a7aa32f43
MD5 f621b2ca36bd658e7589273b41305062
SHA1 0f23a8694bbdf0df6002cad93fd8b6e032f91a81
SHA512 6ab6e15cb7c27c38a6182850c44f878f72ad81783af1bddb2f6c29ed985ea41692c1b752be09bd687e6987bd83e271d13c394fab9a992be3389c9487947344b8
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoE:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wVAfzsM.exe

Path C:\Windows\System\wVAfzsM.exe
Size 1.9MB
SHA256 8d8ba98ccd77e869c4d3bbe5afbb15d67a52f1847c5da3637c2a213dc67aa899
MD5 120edfc1521672a96488a0c748144046
SHA1 40a44063cfdb3881da57f3ec5f38a536ee6f819d
SHA512 ff210d2f76d15a23d872887dd18840554d6b626001b9a442878773029e95259452edf089191b76bf33ec250ccf4645aa757494eb1549a7f1652225902feee8b2
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoP:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpHbjcg.exe

Path C:\Windows\System\wpHbjcg.exe
Size 1.9MB
SHA256 ba3b07f4d49e161c11ce8305e8b548856561c3e3f3700fd8ee15a5719ef9b6ee
MD5 d26611701b008b5b3f45e8e459b32936
SHA1 70f68d392af865dd772180153d39cdd2e0707ae7
SHA512 3f0e39b87e39f179a15a1a0d42107c8022adae7251c83bb811e5f131276f2be5927d90b3b3099216fc770ef04403d0df65896af08bb0628571d1016b92a65fcb
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuoR:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

xukScsF.exe

Path C:\Windows\System\xukScsF.exe
Size 1.9MB
SHA256 08de51ba2570114aab051aaaf2074c78fea3b74fa4481132ea8ed2bef13f1a1e
MD5 86e76bb4f60b3e091a907bd5ca3c4a11
SHA1 b4eb1a021e8dbd2956eb9b83f1cdf7f490cea7a5
SHA512 f6ebde43f2dff38307fe04d71aaac8813bcbe5c56fb5f373bcecc1c175f838a2260447bce37bb9c96dceedfc4f9ef42599ab149eac38b5d0e47caf9315d7294a
SSDEEP 49152:Lz071uv4BPMkibTIA5LDGTUDgcGl7yuor:NABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-18-0x000001956FC60000-0x000001956FC82000-memory.dmp

Download

memory/536-121-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/536-95-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/536-172-0x0000019571310000-0x0000019571AB6000-memory.dmp

Download

memory/536-113-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/536-39-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/536-37-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/536-82-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Download

memory/536-35-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Download

memory/536-3-0x00007FF9872D3000-0x00007FF9872D5000-memory.dmp

Download

memory/1480-77-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp

Download

memory/1480-1-0x0000021679A90000-0x0000021679AA0000-memory.dmp

Download

memory/1480-0-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp

Download

memory/1480-250-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp

Download

memory/1480-96-0x00007FF70E2E0000-0x00007FF70E6D2000-memory.dmp

Download

memory/1844-148-0x00007FF7E60C0000-0x00007FF7E64B2000-memory.dmp

Download

memory/1844-1463-0x00007FF7E60C0000-0x00007FF7E64B2000-memory.dmp

Download

memory/2140-9-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp

Download

memory/2140-970-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp

Download

memory/2140-89-0x00007FF7C2940000-0x00007FF7C2D32000-memory.dmp

Download

memory/2284-1099-0x00007FF792790000-0x00007FF792B82000-memory.dmp

Download

memory/2284-72-0x00007FF792790000-0x00007FF792B82000-memory.dmp

Download

memory/2528-138-0x00007FF786520000-0x00007FF786912000-memory.dmp

Download

memory/2528-1411-0x00007FF786520000-0x00007FF786912000-memory.dmp

Download

memory/3288-146-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp

Download

memory/3288-57-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp

Download

memory/3288-1018-0x00007FF7A2580000-0x00007FF7A2972000-memory.dmp

Download

memory/3400-122-0x00007FF7F0820000-0x00007FF7F0C12000-memory.dmp

Download

memory/3400-1338-0x00007FF7F0820000-0x00007FF7F0C12000-memory.dmp

Download

memory/3444-1488-0x00007FF73F870000-0x00007FF73FC62000-memory.dmp

Download

memory/3444-194-0x00007FF73F870000-0x00007FF73FC62000-memory.dmp

Download

memory/3620-1603-0x00007FF704D70000-0x00007FF705162000-memory.dmp

Download

memory/3620-206-0x00007FF704D70000-0x00007FF705162000-memory.dmp

Download

memory/3840-46-0x00007FF774B90000-0x00007FF774F82000-memory.dmp

Download

memory/3840-1001-0x00007FF774B90000-0x00007FF774F82000-memory.dmp

Download

memory/3912-130-0x00007FF64CAB0000-0x00007FF64CEA2000-memory.dmp

Download

memory/3912-1349-0x00007FF64CAB0000-0x00007FF64CEA2000-memory.dmp

Download

memory/4004-38-0x00007FF712110000-0x00007FF712502000-memory.dmp

Download

memory/4004-977-0x00007FF712110000-0x00007FF712502000-memory.dmp

Download

memory/4084-973-0x00007FF672F00000-0x00007FF6732F2000-memory.dmp

Download

memory/4084-40-0x00007FF672F00000-0x00007FF6732F2000-memory.dmp

Download

memory/4168-1560-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp

Download

memory/4168-203-0x00007FF7FEEF0000-0x00007FF7FF2E2000-memory.dmp

Download

memory/4232-1155-0x00007FF6AB070000-0x00007FF6AB462000-memory.dmp

Download

memory/4232-107-0x00007FF6AB070000-0x00007FF6AB462000-memory.dmp

Download

memory/4256-106-0x00007FF6AB050000-0x00007FF6AB442000-memory.dmp

Download

memory/4256-1200-0x00007FF6AB050000-0x00007FF6AB442000-memory.dmp

Download

memory/4296-1172-0x00007FF682030000-0x00007FF682422000-memory.dmp

Download

memory/4296-79-0x00007FF682030000-0x00007FF682422000-memory.dmp

Download

memory/4404-1580-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp

Download

memory/4404-201-0x00007FF76B9F0000-0x00007FF76BDE2000-memory.dmp

Download

memory/4412-1311-0x00007FF7DC080000-0x00007FF7DC472000-memory.dmp

Download

memory/4412-123-0x00007FF7DC080000-0x00007FF7DC472000-memory.dmp

Download

memory/4444-64-0x00007FF6D46C0000-0x00007FF6D4AB2000-memory.dmp

Download

memory/4444-1093-0x00007FF6D46C0000-0x00007FF6D4AB2000-memory.dmp

Download

memory/4696-1319-0x00007FF739B00000-0x00007FF739EF2000-memory.dmp

Download

memory/4696-120-0x00007FF739B00000-0x00007FF739EF2000-memory.dmp

Download

memory/4720-1267-0x00007FF793560000-0x00007FF793952000-memory.dmp

Download

memory/4720-119-0x00007FF793560000-0x00007FF793952000-memory.dmp

Download

memory/4948-52-0x00007FF6A1F50000-0x00007FF6A2342000-memory.dmp

Download

memory/4948-1003-0x00007FF6A1F50000-0x00007FF6A2342000-memory.dmp

Download

memory/4988-972-0x00007FF68E0C0000-0x00007FF68E4B2000-memory.dmp

Download

memory/4988-36-0x00007FF68E0C0000-0x00007FF68E4B2000-memory.dmp

Download

memory/5108-1462-0x00007FF7630D0000-0x00007FF7634C2000-memory.dmp

Download

memory/5108-140-0x00007FF7630D0000-0x00007FF7634C2000-memory.dmp

Download