xmrig | 473c60fa6f513fad5e512ccd3c9b5ff94c176e8f8625edb260429d84c3ef610b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
Size

1.4MB
MD5

1819afe96222ce32ce00a9a686b66420
SHA1

19ad66757d1b62b075f676d94fb4823ad0064c9f
SHA256

473c60fa6f513fad5e512ccd3c9b5ff94c176e8f8625edb260429d84c3ef610b
SHA512

c6539be4ff154ccf5441f3a02fe5b1278e16c266159c63be2f2d81cb47719c0b727b913db1d93af7cecfc583ea08f5d01b9b39c7929588bafe21855259960b13
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY3W7qE8TrWhBya+l3a+pH8TOy:Lz071uv4BPMkibTIA53WjoWya+lK6Hw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3596-30-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp	xmrig
behavioral2/memory/336-73-0x00007FF7BB9F0000-0x00007FF7BBDE2000-memory.dmp	xmrig
behavioral2/memory/2176-123-0x00007FF744820000-0x00007FF744C12000-memory.dmp	xmrig
behavioral2/memory/1488-187-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp	xmrig
behavioral2/memory/1840-181-0x00007FF604AE0000-0x00007FF604ED2000-memory.dmp	xmrig
behavioral2/memory/508-180-0x00007FF680400000-0x00007FF6807F2000-memory.dmp	xmrig
behavioral2/memory/1820-174-0x00007FF72F5A0000-0x00007FF72F992000-memory.dmp	xmrig
behavioral2/memory/3204-163-0x00007FF682470000-0x00007FF682862000-memory.dmp	xmrig
behavioral2/memory/4928-157-0x00007FF756FC0000-0x00007FF7573B2000-memory.dmp	xmrig
behavioral2/memory/3000-146-0x00007FF7733B0000-0x00007FF7737A2000-memory.dmp	xmrig
behavioral2/memory/2536-140-0x00007FF762090000-0x00007FF762482000-memory.dmp	xmrig
behavioral2/memory/4512-129-0x00007FF70C850000-0x00007FF70CC42000-memory.dmp	xmrig
behavioral2/memory/3432-117-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp	xmrig
behavioral2/memory/1080-105-0x00007FF63ED50000-0x00007FF63F142000-memory.dmp	xmrig
behavioral2/memory/3336-93-0x00007FF7B8610000-0x00007FF7B8A02000-memory.dmp	xmrig
behavioral2/memory/4652-89-0x00007FF79A010000-0x00007FF79A402000-memory.dmp	xmrig
behavioral2/memory/4580-83-0x00007FF790C00000-0x00007FF790FF2000-memory.dmp	xmrig
behavioral2/memory/4828-75-0x00007FF718860000-0x00007FF718C52000-memory.dmp	xmrig
behavioral2/memory/4588-1332-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp	xmrig
behavioral2/memory/3148-1988-0x00007FF783110000-0x00007FF783502000-memory.dmp	xmrig
behavioral2/memory/3748-2487-0x00007FF733690000-0x00007FF733A82000-memory.dmp	xmrig
behavioral2/memory/1668-2720-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp	xmrig
behavioral2/memory/3432-2733-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp	xmrig
behavioral2/memory/2176-2734-0x00007FF744820000-0x00007FF744C12000-memory.dmp	xmrig
behavioral2/memory/1488-2799-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp	xmrig
behavioral2/memory/3148-2819-0x00007FF783110000-0x00007FF783502000-memory.dmp	xmrig
behavioral2/memory/336-2813-0x00007FF7BB9F0000-0x00007FF7BBDE2000-memory.dmp	xmrig
behavioral2/memory/2388-2810-0x00007FF69E020000-0x00007FF69E412000-memory.dmp	xmrig
behavioral2/memory/1604-2821-0x00007FF6E83F0000-0x00007FF6E87E2000-memory.dmp	xmrig
behavioral2/memory/4580-2831-0x00007FF790C00000-0x00007FF790FF2000-memory.dmp	xmrig
behavioral2/memory/3336-2847-0x00007FF7B8610000-0x00007FF7B8A02000-memory.dmp	xmrig
behavioral2/memory/4652-2839-0x00007FF79A010000-0x00007FF79A402000-memory.dmp	xmrig
behavioral2/memory/4828-2827-0x00007FF718860000-0x00007FF718C52000-memory.dmp	xmrig
behavioral2/memory/3596-2801-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp	xmrig
behavioral2/memory/4588-2794-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp	xmrig
behavioral2/memory/3000-2873-0x00007FF7733B0000-0x00007FF7737A2000-memory.dmp	xmrig
behavioral2/memory/1668-2869-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp	xmrig
behavioral2/memory/2176-2865-0x00007FF744820000-0x00007FF744C12000-memory.dmp	xmrig
behavioral2/memory/1840-2893-0x00007FF604AE0000-0x00007FF604ED2000-memory.dmp	xmrig
behavioral2/memory/3204-2875-0x00007FF682470000-0x00007FF682862000-memory.dmp	xmrig
behavioral2/memory/4928-2871-0x00007FF756FC0000-0x00007FF7573B2000-memory.dmp	xmrig
behavioral2/memory/3432-2867-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp	xmrig
behavioral2/memory/4512-2863-0x00007FF70C850000-0x00007FF70CC42000-memory.dmp	xmrig
behavioral2/memory/2536-2860-0x00007FF762090000-0x00007FF762482000-memory.dmp	xmrig
behavioral2/memory/3748-2859-0x00007FF733690000-0x00007FF733A82000-memory.dmp	xmrig
behavioral2/memory/1080-2857-0x00007FF63ED50000-0x00007FF63F142000-memory.dmp	xmrig
behavioral2/memory/1820-2881-0x00007FF72F5A0000-0x00007FF72F992000-memory.dmp	xmrig
behavioral2/memory/4892-3714-0x00007FF748CA0000-0x00007FF749092000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4020	powershell.exe
11	4020	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4020	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1488	kGgUHQT.exe
4588	ZAVqERY.exe
3596	uLNUOvm.exe
2388	PPGNKOd.exe
3148	jClqiRE.exe
1604	xCZHgCS.exe
336	zuILCqp.exe
4580	zskHNUp.exe
4828	iZpMEdv.exe
4652	QLzYWgu.exe
4892	cPvUxiB.exe
3336	MEiLdHk.exe
1080	pOBuLyd.exe
3748	KcgKhiR.exe
1668	YiGESLN.exe
3432	kzlxceo.exe
2176	qQHtOYV.exe
4512	oRipqmX.exe
2536	ZMCMhaY.exe
3000	bLtKlJF.exe
4928	IMJhsPC.exe
3204	agAuFan.exe
1840	pMMFdoz.exe
1820	DCVyZqZ.exe
3740	iqMGfeH.exe
2540	bXWESVx.exe
4632	UYEMFlX.exe
408	GOMrJJH.exe
392	CYHXtYt.exe
228	foSiSRC.exe
628	vBtXysY.exe
1848	NiTMdEL.exe
3232	cqIvOAD.exe
2108	fCaRhdN.exe
4628	zoOzVGf.exe
3376	VEgdqyn.exe
4448	xbDwwrk.exe
5052	eGdUNmX.exe
1676	zzXQaqG.exe
2260	bKrbizu.exe
3568	lgWbcyD.exe
1088	NFpmSeX.exe
4016	VAnlIsz.exe
1492	MvkOpFh.exe
2404	UYuMuVR.exe
1508	XHEbLwB.exe
2232	AZNBLgN.exe
1392	BGNrWZt.exe
4720	BFyRcFX.exe
1012	Vrluthk.exe
4040	NHKazeT.exe
4296	sXjLkOy.exe
3016	DhLkiFb.exe
4316	NJUnkci.exe
4964	LzYTRdZ.exe
4984	tmvSAVh.exe
4952	LXOmhHL.exe
432	eKUTLIJ.exe
1352	YsGOHVS.exe
2136	RNLlInH.exe
3968	gfSzikh.exe
1584	wVwgVcn.exe
5136	GysYWFO.exe
5168	ilODHSG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/508-0-0x00007FF680400000-0x00007FF6807F2000-memory.dmp	upx
behavioral2/files/0x000700000002340b-8.dat	upx
behavioral2/memory/1488-9-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp	upx
behavioral2/files/0x000700000002340c-19.dat	upx
behavioral2/files/0x000700000002340d-22.dat	upx
behavioral2/memory/3596-30-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp	upx
behavioral2/files/0x000700000002340e-48.dat	upx
behavioral2/files/0x0007000000023413-58.dat	upx
behavioral2/memory/336-73-0x00007FF7BB9F0000-0x00007FF7BBDE2000-memory.dmp	upx
behavioral2/files/0x0007000000023411-79.dat	upx
behavioral2/files/0x0008000000023408-86.dat	upx
behavioral2/files/0x0008000000023415-106.dat	upx
behavioral2/files/0x000700000002341a-114.dat	upx
behavioral2/memory/2176-123-0x00007FF744820000-0x00007FF744C12000-memory.dmp	upx
behavioral2/files/0x000700000002341d-132.dat	upx
behavioral2/files/0x0007000000023420-149.dat	upx
behavioral2/files/0x0007000000023428-203.dat	upx
behavioral2/files/0x0007000000023429-200.dat	upx
behavioral2/files/0x0007000000023427-198.dat	upx
behavioral2/files/0x0007000000023426-193.dat	upx
behavioral2/files/0x0007000000023425-188.dat	upx
behavioral2/memory/1488-187-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp	upx
behavioral2/files/0x0007000000023424-182.dat	upx
behavioral2/memory/1840-181-0x00007FF604AE0000-0x00007FF604ED2000-memory.dmp	upx
behavioral2/memory/508-180-0x00007FF680400000-0x00007FF6807F2000-memory.dmp	upx
behavioral2/files/0x0007000000023423-175.dat	upx
behavioral2/memory/1820-174-0x00007FF72F5A0000-0x00007FF72F992000-memory.dmp	upx
behavioral2/files/0x0007000000023422-169.dat	upx
behavioral2/files/0x0007000000023421-164.dat	upx
behavioral2/memory/3204-163-0x00007FF682470000-0x00007FF682862000-memory.dmp	upx
behavioral2/memory/4928-157-0x00007FF756FC0000-0x00007FF7573B2000-memory.dmp	upx
behavioral2/files/0x000700000002341f-152.dat	upx
behavioral2/files/0x000700000002341e-147.dat	upx
behavioral2/memory/3000-146-0x00007FF7733B0000-0x00007FF7737A2000-memory.dmp	upx
behavioral2/memory/2536-140-0x00007FF762090000-0x00007FF762482000-memory.dmp	upx
behavioral2/files/0x000700000002341c-135.dat	upx
behavioral2/files/0x000700000002341b-130.dat	upx
behavioral2/memory/4512-129-0x00007FF70C850000-0x00007FF70CC42000-memory.dmp	upx
behavioral2/files/0x0007000000023419-118.dat	upx
behavioral2/memory/3432-117-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp	upx
behavioral2/files/0x0007000000023418-112.dat	upx
behavioral2/memory/1668-111-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp	upx
behavioral2/memory/1080-105-0x00007FF63ED50000-0x00007FF63F142000-memory.dmp	upx
behavioral2/files/0x0008000000023416-100.dat	upx
behavioral2/memory/3748-99-0x00007FF733690000-0x00007FF733A82000-memory.dmp	upx
behavioral2/memory/3336-93-0x00007FF7B8610000-0x00007FF7B8A02000-memory.dmp	upx
behavioral2/memory/4652-89-0x00007FF79A010000-0x00007FF79A402000-memory.dmp	upx
behavioral2/files/0x0007000000023417-84.dat	upx
behavioral2/memory/4580-83-0x00007FF790C00000-0x00007FF790FF2000-memory.dmp	upx
behavioral2/memory/4892-78-0x00007FF748CA0000-0x00007FF749092000-memory.dmp	upx
behavioral2/memory/4828-75-0x00007FF718860000-0x00007FF718C52000-memory.dmp	upx
behavioral2/files/0x0007000000023412-71.dat	upx
behavioral2/files/0x0007000000023414-70.dat	upx
behavioral2/memory/3148-63-0x00007FF783110000-0x00007FF783502000-memory.dmp	upx
behavioral2/files/0x000700000002340f-55.dat	upx
behavioral2/memory/1604-47-0x00007FF6E83F0000-0x00007FF6E87E2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-38.dat	upx
behavioral2/memory/2388-36-0x00007FF69E020000-0x00007FF69E412000-memory.dmp	upx
behavioral2/memory/4588-14-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp	upx
behavioral2/files/0x0008000000023407-13.dat	upx
behavioral2/memory/4588-1332-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp	upx
behavioral2/memory/3148-1988-0x00007FF783110000-0x00007FF783502000-memory.dmp	upx
behavioral2/memory/3748-2487-0x00007FF733690000-0x00007FF733A82000-memory.dmp	upx
behavioral2/memory/1668-2720-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ilvJmyi.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\UAgknpv.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\zQJphKS.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\KjkfEWj.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\GwuovIr.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\Zzdbigs.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\rnPThZD.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\ozHONZN.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\MhlGFyL.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\zzXFTSb.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\nYczZSt.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\vAkyvef.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\RfdNWXq.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\STludQm.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\PPYeBfv.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\NaaBbgi.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\zJeMKER.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\YzzKKqO.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\nTbSMfF.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\QKwpaNw.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\plHsRVc.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\xHFCWSz.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\LFcVUTA.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\atoHpbP.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\cFuEZlF.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\RQjDKoQ.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\UhqYQOb.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\VrthYPX.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\ahqYlZh.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\PLYeavU.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\sLfQtix.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\PnpFUWv.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\iaKKwgd.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\fZOQgvd.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\QylMMND.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\pwUGEnL.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\dSzWYbz.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\bvkAPdT.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\YYBzYiv.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\DrocHoV.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\FHodrkW.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\VuhLsyY.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\IkJICPJ.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\EbntQWG.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\pPBtvnn.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\FaInTor.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\HFfDfbb.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\YPOXovd.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\HAUnfIq.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\LHQczhR.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\KqvCyTO.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\tGyczDg.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\BodBjxb.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\ZKZQQZJ.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\QoIWlbk.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\OYeOJLN.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\SwdoZmH.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\bYauYsf.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\erUtEYv.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\zEUNDGP.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\juHKCJF.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\ZtaYfjR.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\sXrUjsV.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
File created	C:\Windows\System\uNXWvqZ.exe	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4020	powershell.exe
4020	powershell.exe
4020	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeLockMemoryPrivilege	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 4020	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	83
PID 508 wrote to memory of 4020	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	83
PID 508 wrote to memory of 1488	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	84
PID 508 wrote to memory of 1488	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	84
PID 508 wrote to memory of 4588	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	85
PID 508 wrote to memory of 4588	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	85
PID 508 wrote to memory of 3596	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	86
PID 508 wrote to memory of 3596	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	86
PID 508 wrote to memory of 2388	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	87
PID 508 wrote to memory of 2388	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	87
PID 508 wrote to memory of 3148	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	88
PID 508 wrote to memory of 3148	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	88
PID 508 wrote to memory of 1604	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	89
PID 508 wrote to memory of 1604	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	89
PID 508 wrote to memory of 336	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	90
PID 508 wrote to memory of 336	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	90
PID 508 wrote to memory of 4652	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	91
PID 508 wrote to memory of 4652	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	91
PID 508 wrote to memory of 4580	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	92
PID 508 wrote to memory of 4580	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	92
PID 508 wrote to memory of 4828	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	93
PID 508 wrote to memory of 4828	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	93
PID 508 wrote to memory of 4892	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	94
PID 508 wrote to memory of 4892	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	94
PID 508 wrote to memory of 3336	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	95
PID 508 wrote to memory of 3336	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	95
PID 508 wrote to memory of 1080	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	96
PID 508 wrote to memory of 1080	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	96
PID 508 wrote to memory of 3748	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	97
PID 508 wrote to memory of 3748	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	97
PID 508 wrote to memory of 1668	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	98
PID 508 wrote to memory of 1668	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	98
PID 508 wrote to memory of 3432	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	99
PID 508 wrote to memory of 3432	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	99
PID 508 wrote to memory of 2176	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	100
PID 508 wrote to memory of 2176	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	100
PID 508 wrote to memory of 4512	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	101
PID 508 wrote to memory of 4512	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	101
PID 508 wrote to memory of 2536	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	102
PID 508 wrote to memory of 2536	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	102
PID 508 wrote to memory of 3000	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	103
PID 508 wrote to memory of 3000	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	103
PID 508 wrote to memory of 4928	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	104
PID 508 wrote to memory of 4928	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	104
PID 508 wrote to memory of 3204	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	105
PID 508 wrote to memory of 3204	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	105
PID 508 wrote to memory of 1840	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	106
PID 508 wrote to memory of 1840	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	106
PID 508 wrote to memory of 1820	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	107
PID 508 wrote to memory of 1820	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	107
PID 508 wrote to memory of 3740	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	108
PID 508 wrote to memory of 3740	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	108
PID 508 wrote to memory of 2540	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	109
PID 508 wrote to memory of 2540	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	109
PID 508 wrote to memory of 4632	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	110
PID 508 wrote to memory of 4632	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	110
PID 508 wrote to memory of 408	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	111
PID 508 wrote to memory of 408	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	111
PID 508 wrote to memory of 392	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	112
PID 508 wrote to memory of 392	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	112
PID 508 wrote to memory of 228	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	113
PID 508 wrote to memory of 228	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	113
PID 508 wrote to memory of 628	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	114
PID 508 wrote to memory of 628	508	1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1819afe96222ce32ce00a9a686b66420_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4020" "2984" "2904" "2988" "0" "0" "2992" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13036
- C:\Windows\System\kGgUHQT.exe
  C:\Windows\System\kGgUHQT.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\ZAVqERY.exe
  C:\Windows\System\ZAVqERY.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\uLNUOvm.exe
  C:\Windows\System\uLNUOvm.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\PPGNKOd.exe
  C:\Windows\System\PPGNKOd.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\jClqiRE.exe
  C:\Windows\System\jClqiRE.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\xCZHgCS.exe
  C:\Windows\System\xCZHgCS.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\zuILCqp.exe
  C:\Windows\System\zuILCqp.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\QLzYWgu.exe
  C:\Windows\System\QLzYWgu.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\zskHNUp.exe
  C:\Windows\System\zskHNUp.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\iZpMEdv.exe
  C:\Windows\System\iZpMEdv.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\cPvUxiB.exe
  C:\Windows\System\cPvUxiB.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\MEiLdHk.exe
  C:\Windows\System\MEiLdHk.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\pOBuLyd.exe
  C:\Windows\System\pOBuLyd.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\KcgKhiR.exe
  C:\Windows\System\KcgKhiR.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\YiGESLN.exe
  C:\Windows\System\YiGESLN.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\kzlxceo.exe
  C:\Windows\System\kzlxceo.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\qQHtOYV.exe
  C:\Windows\System\qQHtOYV.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\oRipqmX.exe
  C:\Windows\System\oRipqmX.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\ZMCMhaY.exe
  C:\Windows\System\ZMCMhaY.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\bLtKlJF.exe
  C:\Windows\System\bLtKlJF.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\IMJhsPC.exe
  C:\Windows\System\IMJhsPC.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\agAuFan.exe
  C:\Windows\System\agAuFan.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\pMMFdoz.exe
  C:\Windows\System\pMMFdoz.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\DCVyZqZ.exe
  C:\Windows\System\DCVyZqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\iqMGfeH.exe
  C:\Windows\System\iqMGfeH.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\bXWESVx.exe
  C:\Windows\System\bXWESVx.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\UYEMFlX.exe
  C:\Windows\System\UYEMFlX.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\GOMrJJH.exe
  C:\Windows\System\GOMrJJH.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\CYHXtYt.exe
  C:\Windows\System\CYHXtYt.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\foSiSRC.exe
  C:\Windows\System\foSiSRC.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\vBtXysY.exe
  C:\Windows\System\vBtXysY.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\NiTMdEL.exe
  C:\Windows\System\NiTMdEL.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\cqIvOAD.exe
  C:\Windows\System\cqIvOAD.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\fCaRhdN.exe
  C:\Windows\System\fCaRhdN.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\zoOzVGf.exe
  C:\Windows\System\zoOzVGf.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\VEgdqyn.exe
  C:\Windows\System\VEgdqyn.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\xbDwwrk.exe
  C:\Windows\System\xbDwwrk.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\eGdUNmX.exe
  C:\Windows\System\eGdUNmX.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\zzXQaqG.exe
  C:\Windows\System\zzXQaqG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\bKrbizu.exe
  C:\Windows\System\bKrbizu.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\lgWbcyD.exe
  C:\Windows\System\lgWbcyD.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\NFpmSeX.exe
  C:\Windows\System\NFpmSeX.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\VAnlIsz.exe
  C:\Windows\System\VAnlIsz.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\MvkOpFh.exe
  C:\Windows\System\MvkOpFh.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\UYuMuVR.exe
  C:\Windows\System\UYuMuVR.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\XHEbLwB.exe
  C:\Windows\System\XHEbLwB.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\AZNBLgN.exe
  C:\Windows\System\AZNBLgN.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\BGNrWZt.exe
  C:\Windows\System\BGNrWZt.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\BFyRcFX.exe
  C:\Windows\System\BFyRcFX.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\Vrluthk.exe
  C:\Windows\System\Vrluthk.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\NHKazeT.exe
  C:\Windows\System\NHKazeT.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\sXjLkOy.exe
  C:\Windows\System\sXjLkOy.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\DhLkiFb.exe
  C:\Windows\System\DhLkiFb.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\NJUnkci.exe
  C:\Windows\System\NJUnkci.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\LzYTRdZ.exe
  C:\Windows\System\LzYTRdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\tmvSAVh.exe
  C:\Windows\System\tmvSAVh.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\LXOmhHL.exe
  C:\Windows\System\LXOmhHL.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\eKUTLIJ.exe
  C:\Windows\System\eKUTLIJ.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\YsGOHVS.exe
  C:\Windows\System\YsGOHVS.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\RNLlInH.exe
  C:\Windows\System\RNLlInH.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\gfSzikh.exe
  C:\Windows\System\gfSzikh.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\wVwgVcn.exe
  C:\Windows\System\wVwgVcn.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\GysYWFO.exe
  C:\Windows\System\GysYWFO.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\ilODHSG.exe
  C:\Windows\System\ilODHSG.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\iqodWiw.exe
  C:\Windows\System\iqodWiw.exe
  2⤵
  PID:5196
- C:\Windows\System\QylMMND.exe
  C:\Windows\System\QylMMND.exe
  2⤵
  PID:5228
- C:\Windows\System\VkzzCdb.exe
  C:\Windows\System\VkzzCdb.exe
  2⤵
  PID:5252
- C:\Windows\System\FAPaYAv.exe
  C:\Windows\System\FAPaYAv.exe
  2⤵
  PID:5284
- C:\Windows\System\xxVMnyb.exe
  C:\Windows\System\xxVMnyb.exe
  2⤵
  PID:5308
- C:\Windows\System\ERmKzhh.exe
  C:\Windows\System\ERmKzhh.exe
  2⤵
  PID:5336
- C:\Windows\System\wzxvmLH.exe
  C:\Windows\System\wzxvmLH.exe
  2⤵
  PID:5368
- C:\Windows\System\RtqnDYC.exe
  C:\Windows\System\RtqnDYC.exe
  2⤵
  PID:5404
- C:\Windows\System\OpxvbXG.exe
  C:\Windows\System\OpxvbXG.exe
  2⤵
  PID:5432
- C:\Windows\System\bEiWjJF.exe
  C:\Windows\System\bEiWjJF.exe
  2⤵
  PID:5460
- C:\Windows\System\OJXCcUy.exe
  C:\Windows\System\OJXCcUy.exe
  2⤵
  PID:5492
- C:\Windows\System\ZYSvSlO.exe
  C:\Windows\System\ZYSvSlO.exe
  2⤵
  PID:5516
- C:\Windows\System\acNnfCq.exe
  C:\Windows\System\acNnfCq.exe
  2⤵
  PID:5544
- C:\Windows\System\mEJnJxb.exe
  C:\Windows\System\mEJnJxb.exe
  2⤵
  PID:5572
- C:\Windows\System\tiqFFNE.exe
  C:\Windows\System\tiqFFNE.exe
  2⤵
  PID:5604
- C:\Windows\System\gEvSTxB.exe
  C:\Windows\System\gEvSTxB.exe
  2⤵
  PID:5632
- C:\Windows\System\nwsRBRF.exe
  C:\Windows\System\nwsRBRF.exe
  2⤵
  PID:5656
- C:\Windows\System\imgRdvN.exe
  C:\Windows\System\imgRdvN.exe
  2⤵
  PID:5688
- C:\Windows\System\Ejcyikp.exe
  C:\Windows\System\Ejcyikp.exe
  2⤵
  PID:5716
- C:\Windows\System\lkJsAHj.exe
  C:\Windows\System\lkJsAHj.exe
  2⤵
  PID:5744
- C:\Windows\System\cxGMwtG.exe
  C:\Windows\System\cxGMwtG.exe
  2⤵
  PID:5772
- C:\Windows\System\TsabLZl.exe
  C:\Windows\System\TsabLZl.exe
  2⤵
  PID:5800
- C:\Windows\System\WvvhgKI.exe
  C:\Windows\System\WvvhgKI.exe
  2⤵
  PID:5828
- C:\Windows\System\snOveEM.exe
  C:\Windows\System\snOveEM.exe
  2⤵
  PID:5856
- C:\Windows\System\tiovwBP.exe
  C:\Windows\System\tiovwBP.exe
  2⤵
  PID:5884
- C:\Windows\System\ZGmVpgS.exe
  C:\Windows\System\ZGmVpgS.exe
  2⤵
  PID:5912
- C:\Windows\System\mDadVac.exe
  C:\Windows\System\mDadVac.exe
  2⤵
  PID:5944
- C:\Windows\System\bXziWwR.exe
  C:\Windows\System\bXziWwR.exe
  2⤵
  PID:5968
- C:\Windows\System\qGFlIuh.exe
  C:\Windows\System\qGFlIuh.exe
  2⤵
  PID:6000
- C:\Windows\System\CCtfmdD.exe
  C:\Windows\System\CCtfmdD.exe
  2⤵
  PID:6024
- C:\Windows\System\rvjTsUG.exe
  C:\Windows\System\rvjTsUG.exe
  2⤵
  PID:6056
- C:\Windows\System\XqmZSUm.exe
  C:\Windows\System\XqmZSUm.exe
  2⤵
  PID:6084
- C:\Windows\System\FlBkFiL.exe
  C:\Windows\System\FlBkFiL.exe
  2⤵
  PID:6112
- C:\Windows\System\yYRAGOY.exe
  C:\Windows\System\yYRAGOY.exe
  2⤵
  PID:6136
- C:\Windows\System\dqOuhhY.exe
  C:\Windows\System\dqOuhhY.exe
  2⤵
  PID:4572
- C:\Windows\System\edHOoEb.exe
  C:\Windows\System\edHOoEb.exe
  2⤵
  PID:1696
- C:\Windows\System\ZQPAAgA.exe
  C:\Windows\System\ZQPAAgA.exe
  2⤵
  PID:980
- C:\Windows\System\bBrezmp.exe
  C:\Windows\System\bBrezmp.exe
  2⤵
  PID:3648
- C:\Windows\System\RRmGzeA.exe
  C:\Windows\System\RRmGzeA.exe
  2⤵
  PID:5124
- C:\Windows\System\kpgOYNl.exe
  C:\Windows\System\kpgOYNl.exe
  2⤵
  PID:3832
- C:\Windows\System\mQWyQss.exe
  C:\Windows\System\mQWyQss.exe
  2⤵
  PID:2344
- C:\Windows\System\VuxTPxu.exe
  C:\Windows\System\VuxTPxu.exe
  2⤵
  PID:5296
- C:\Windows\System\lgLbGhx.exe
  C:\Windows\System\lgLbGhx.exe
  2⤵
  PID:5360
- C:\Windows\System\XjzcVWs.exe
  C:\Windows\System\XjzcVWs.exe
  2⤵
  PID:5420
- C:\Windows\System\FnwGybt.exe
  C:\Windows\System\FnwGybt.exe
  2⤵
  PID:5476
- C:\Windows\System\AJwGZCs.exe
  C:\Windows\System\AJwGZCs.exe
  2⤵
  PID:5536
- C:\Windows\System\oyyWTpb.exe
  C:\Windows\System\oyyWTpb.exe
  2⤵
  PID:5616
- C:\Windows\System\CuDvMLA.exe
  C:\Windows\System\CuDvMLA.exe
  2⤵
  PID:5676
- C:\Windows\System\gBFKGKN.exe
  C:\Windows\System\gBFKGKN.exe
  2⤵
  PID:5736
- C:\Windows\System\fNyaCEC.exe
  C:\Windows\System\fNyaCEC.exe
  2⤵
  PID:5792
- C:\Windows\System\UeKIBBU.exe
  C:\Windows\System\UeKIBBU.exe
  2⤵
  PID:5868
- C:\Windows\System\xLxRDhW.exe
  C:\Windows\System\xLxRDhW.exe
  2⤵
  PID:5936
- C:\Windows\System\MUohgzt.exe
  C:\Windows\System\MUohgzt.exe
  2⤵
  PID:2080
- C:\Windows\System\FdbYVHG.exe
  C:\Windows\System\FdbYVHG.exe
  2⤵
  PID:6040
- C:\Windows\System\EfbBqKi.exe
  C:\Windows\System\EfbBqKi.exe
  2⤵
  PID:6076
- C:\Windows\System\NYLYlov.exe
  C:\Windows\System\NYLYlov.exe
  2⤵
  PID:2936
- C:\Windows\System\PEGUcBX.exe
  C:\Windows\System\PEGUcBX.exe
  2⤵
  PID:2280
- C:\Windows\System\pwUGEnL.exe
  C:\Windows\System\pwUGEnL.exe
  2⤵
  PID:5156
- C:\Windows\System\TJxiGBg.exe
  C:\Windows\System\TJxiGBg.exe
  2⤵
  PID:5220
- C:\Windows\System\zvVnPQF.exe
  C:\Windows\System\zvVnPQF.exe
  2⤵
  PID:5332
- C:\Windows\System\LxnCuwo.exe
  C:\Windows\System\LxnCuwo.exe
  2⤵
  PID:2816
- C:\Windows\System\sJnvDjA.exe
  C:\Windows\System\sJnvDjA.exe
  2⤵
  PID:4516
- C:\Windows\System\pbPklCG.exe
  C:\Windows\System\pbPklCG.exe
  2⤵
  PID:5732
- C:\Windows\System\RvmjHpC.exe
  C:\Windows\System\RvmjHpC.exe
  2⤵
  PID:5848
- C:\Windows\System\RIDWWZC.exe
  C:\Windows\System\RIDWWZC.exe
  2⤵
  PID:5960
- C:\Windows\System\zFmwWru.exe
  C:\Windows\System\zFmwWru.exe
  2⤵
  PID:6068
- C:\Windows\System\PvOHPyn.exe
  C:\Windows\System\PvOHPyn.exe
  2⤵
  PID:6132
- C:\Windows\System\QRvMquV.exe
  C:\Windows\System\QRvMquV.exe
  2⤵
  PID:4728
- C:\Windows\System\acpASyR.exe
  C:\Windows\System\acpASyR.exe
  2⤵
  PID:5324
- C:\Windows\System\kktcNpl.exe
  C:\Windows\System\kktcNpl.exe
  2⤵
  PID:5452
- C:\Windows\System\HrzvNOV.exe
  C:\Windows\System\HrzvNOV.exe
  2⤵
  PID:5044
- C:\Windows\System\zFZkGsc.exe
  C:\Windows\System\zFZkGsc.exe
  2⤵
  PID:3444
- C:\Windows\System\wqlrwkg.exe
  C:\Windows\System\wqlrwkg.exe
  2⤵
  PID:6152
- C:\Windows\System\hcHCDgd.exe
  C:\Windows\System\hcHCDgd.exe
  2⤵
  PID:6180
- C:\Windows\System\kFDvdxl.exe
  C:\Windows\System\kFDvdxl.exe
  2⤵
  PID:6208
- C:\Windows\System\ECkDAMW.exe
  C:\Windows\System\ECkDAMW.exe
  2⤵
  PID:6236
- C:\Windows\System\WHRigty.exe
  C:\Windows\System\WHRigty.exe
  2⤵
  PID:6260
- C:\Windows\System\jHdsMSS.exe
  C:\Windows\System\jHdsMSS.exe
  2⤵
  PID:6288
- C:\Windows\System\siZyZzk.exe
  C:\Windows\System\siZyZzk.exe
  2⤵
  PID:6320
- C:\Windows\System\XTupkzV.exe
  C:\Windows\System\XTupkzV.exe
  2⤵
  PID:6348
- C:\Windows\System\YsoqvjE.exe
  C:\Windows\System\YsoqvjE.exe
  2⤵
  PID:6376
- C:\Windows\System\QwYKagW.exe
  C:\Windows\System\QwYKagW.exe
  2⤵
  PID:6404
- C:\Windows\System\Tajqhpy.exe
  C:\Windows\System\Tajqhpy.exe
  2⤵
  PID:6428
- C:\Windows\System\xzQqOzB.exe
  C:\Windows\System\xzQqOzB.exe
  2⤵
  PID:6460
- C:\Windows\System\sLfQtix.exe
  C:\Windows\System\sLfQtix.exe
  2⤵
  PID:6488
- C:\Windows\System\mvjtodb.exe
  C:\Windows\System\mvjtodb.exe
  2⤵
  PID:6516
- C:\Windows\System\IxYEPZd.exe
  C:\Windows\System\IxYEPZd.exe
  2⤵
  PID:6544
- C:\Windows\System\Qisxsel.exe
  C:\Windows\System\Qisxsel.exe
  2⤵
  PID:6576
- C:\Windows\System\qgTPOaQ.exe
  C:\Windows\System\qgTPOaQ.exe
  2⤵
  PID:6600
- C:\Windows\System\WbKENxy.exe
  C:\Windows\System\WbKENxy.exe
  2⤵
  PID:6628
- C:\Windows\System\orecume.exe
  C:\Windows\System\orecume.exe
  2⤵
  PID:6656
- C:\Windows\System\dkQzArg.exe
  C:\Windows\System\dkQzArg.exe
  2⤵
  PID:6684
- C:\Windows\System\tQgBxEs.exe
  C:\Windows\System\tQgBxEs.exe
  2⤵
  PID:6712
- C:\Windows\System\HrwnNKW.exe
  C:\Windows\System\HrwnNKW.exe
  2⤵
  PID:6740
- C:\Windows\System\IIDDjKs.exe
  C:\Windows\System\IIDDjKs.exe
  2⤵
  PID:6764
- C:\Windows\System\IeyNdSs.exe
  C:\Windows\System\IeyNdSs.exe
  2⤵
  PID:6792
- C:\Windows\System\PnpFUWv.exe
  C:\Windows\System\PnpFUWv.exe
  2⤵
  PID:6820
- C:\Windows\System\pXNRVWh.exe
  C:\Windows\System\pXNRVWh.exe
  2⤵
  PID:6848
- C:\Windows\System\zpXgDQL.exe
  C:\Windows\System\zpXgDQL.exe
  2⤵
  PID:6876
- C:\Windows\System\gRLnyHE.exe
  C:\Windows\System\gRLnyHE.exe
  2⤵
  PID:6904
- C:\Windows\System\pSbDVwr.exe
  C:\Windows\System\pSbDVwr.exe
  2⤵
  PID:6932
- C:\Windows\System\vyvUNbX.exe
  C:\Windows\System\vyvUNbX.exe
  2⤵
  PID:6960
- C:\Windows\System\lvYskbO.exe
  C:\Windows\System\lvYskbO.exe
  2⤵
  PID:6988
- C:\Windows\System\xRWATun.exe
  C:\Windows\System\xRWATun.exe
  2⤵
  PID:7016
- C:\Windows\System\oCuAnbu.exe
  C:\Windows\System\oCuAnbu.exe
  2⤵
  PID:7044
- C:\Windows\System\jRvnSgD.exe
  C:\Windows\System\jRvnSgD.exe
  2⤵
  PID:7072
- C:\Windows\System\YzzKKqO.exe
  C:\Windows\System\YzzKKqO.exe
  2⤵
  PID:7104
- C:\Windows\System\GfhSUQs.exe
  C:\Windows\System\GfhSUQs.exe
  2⤵
  PID:7132
- C:\Windows\System\xODOhId.exe
  C:\Windows\System\xODOhId.exe
  2⤵
  PID:7164
- C:\Windows\System\OSHletb.exe
  C:\Windows\System\OSHletb.exe
  2⤵
  PID:3960
- C:\Windows\System\aZSnywV.exe
  C:\Windows\System\aZSnywV.exe
  2⤵
  PID:4980
- C:\Windows\System\jPaFLZZ.exe
  C:\Windows\System\jPaFLZZ.exe
  2⤵
  PID:6224
- C:\Windows\System\YwGusVH.exe
  C:\Windows\System\YwGusVH.exe
  2⤵
  PID:6252
- C:\Windows\System\VTQVHae.exe
  C:\Windows\System\VTQVHae.exe
  2⤵
  PID:6280
- C:\Windows\System\bXTlZLL.exe
  C:\Windows\System\bXTlZLL.exe
  2⤵
  PID:3160
- C:\Windows\System\oiybSJf.exe
  C:\Windows\System\oiybSJf.exe
  2⤵
  PID:2512
- C:\Windows\System\OkxpQPd.exe
  C:\Windows\System\OkxpQPd.exe
  2⤵
  PID:6368
- C:\Windows\System\KXhtSPz.exe
  C:\Windows\System\KXhtSPz.exe
  2⤵
  PID:6416
- C:\Windows\System\jjHXXzH.exe
  C:\Windows\System\jjHXXzH.exe
  2⤵
  PID:6504
- C:\Windows\System\VHzHgvw.exe
  C:\Windows\System\VHzHgvw.exe
  2⤵
  PID:6556
- C:\Windows\System\JkkzEIE.exe
  C:\Windows\System\JkkzEIE.exe
  2⤵
  PID:6612
- C:\Windows\System\YbIAoct.exe
  C:\Windows\System\YbIAoct.exe
  2⤵
  PID:6652
- C:\Windows\System\fwwAWAI.exe
  C:\Windows\System\fwwAWAI.exe
  2⤵
  PID:6724
- C:\Windows\System\qdhJTyA.exe
  C:\Windows\System\qdhJTyA.exe
  2⤵
  PID:6780
- C:\Windows\System\Dskbcam.exe
  C:\Windows\System\Dskbcam.exe
  2⤵
  PID:6868
- C:\Windows\System\OcgxQzX.exe
  C:\Windows\System\OcgxQzX.exe
  2⤵
  PID:6920
- C:\Windows\System\hwcgvkn.exe
  C:\Windows\System\hwcgvkn.exe
  2⤵
  PID:6976
- C:\Windows\System\kSyylzl.exe
  C:\Windows\System\kSyylzl.exe
  2⤵
  PID:7008
- C:\Windows\System\KqknwVw.exe
  C:\Windows\System\KqknwVw.exe
  2⤵
  PID:7068
- C:\Windows\System\pQsmphu.exe
  C:\Windows\System\pQsmphu.exe
  2⤵
  PID:3068
- C:\Windows\System\cCNWKmx.exe
  C:\Windows\System\cCNWKmx.exe
  2⤵
  PID:7156
- C:\Windows\System\yJFVrWM.exe
  C:\Windows\System\yJFVrWM.exe
  2⤵
  PID:2156
- C:\Windows\System\ENeKyKd.exe
  C:\Windows\System\ENeKyKd.exe
  2⤵
  PID:5212
- C:\Windows\System\KZyjnvW.exe
  C:\Windows\System\KZyjnvW.exe
  2⤵
  PID:4384
- C:\Windows\System\LONOkis.exe
  C:\Windows\System\LONOkis.exe
  2⤵
  PID:3572
- C:\Windows\System\ElCjWft.exe
  C:\Windows\System\ElCjWft.exe
  2⤵
  PID:3180
- C:\Windows\System\eiogFpm.exe
  C:\Windows\System\eiogFpm.exe
  2⤵
  PID:452
- C:\Windows\System\ZZFNFyk.exe
  C:\Windows\System\ZZFNFyk.exe
  2⤵
  PID:3388
- C:\Windows\System\VlbFMyT.exe
  C:\Windows\System\VlbFMyT.exe
  2⤵
  PID:3824
- C:\Windows\System\djmjRhG.exe
  C:\Windows\System\djmjRhG.exe
  2⤵
  PID:2744
- C:\Windows\System\WYSvcEh.exe
  C:\Windows\System\WYSvcEh.exe
  2⤵
  PID:3540
- C:\Windows\System\aqbsroq.exe
  C:\Windows\System\aqbsroq.exe
  2⤵
  PID:6396
- C:\Windows\System\YWODAmR.exe
  C:\Windows\System\YWODAmR.exe
  2⤵
  PID:6532
- C:\Windows\System\yixKOQU.exe
  C:\Windows\System\yixKOQU.exe
  2⤵
  PID:6760
- C:\Windows\System\gKDqRDF.exe
  C:\Windows\System\gKDqRDF.exe
  2⤵
  PID:6816
- C:\Windows\System\tfoylTB.exe
  C:\Windows\System\tfoylTB.exe
  2⤵
  PID:7036
- C:\Windows\System\yALYZMZ.exe
  C:\Windows\System\yALYZMZ.exe
  2⤵
  PID:6164
- C:\Windows\System\HWmwpAA.exe
  C:\Windows\System\HWmwpAA.exe
  2⤵
  PID:7148
- C:\Windows\System\fNFTXCn.exe
  C:\Windows\System\fNFTXCn.exe
  2⤵
  PID:5032
- C:\Windows\System\GhOORqi.exe
  C:\Windows\System\GhOORqi.exe
  2⤵
  PID:4480
- C:\Windows\System\MpQMCZf.exe
  C:\Windows\System\MpQMCZf.exe
  2⤵
  PID:2880
- C:\Windows\System\IyeWbCM.exe
  C:\Windows\System\IyeWbCM.exe
  2⤵
  PID:6592
- C:\Windows\System\AWcYmjx.exe
  C:\Windows\System\AWcYmjx.exe
  2⤵
  PID:5788
- C:\Windows\System\fwrNIOc.exe
  C:\Windows\System\fwrNIOc.exe
  2⤵
  PID:7188
- C:\Windows\System\VAdZONY.exe
  C:\Windows\System\VAdZONY.exe
  2⤵
  PID:7216
- C:\Windows\System\RXcDEcr.exe
  C:\Windows\System\RXcDEcr.exe
  2⤵
  PID:7244
- C:\Windows\System\IcbYcUh.exe
  C:\Windows\System\IcbYcUh.exe
  2⤵
  PID:7280
- C:\Windows\System\pblEokg.exe
  C:\Windows\System\pblEokg.exe
  2⤵
  PID:7300
- C:\Windows\System\jUmjZwH.exe
  C:\Windows\System\jUmjZwH.exe
  2⤵
  PID:7320
- C:\Windows\System\YcXySkI.exe
  C:\Windows\System\YcXySkI.exe
  2⤵
  PID:7340
- C:\Windows\System\HFfDfbb.exe
  C:\Windows\System\HFfDfbb.exe
  2⤵
  PID:7356
- C:\Windows\System\bUJYBFl.exe
  C:\Windows\System\bUJYBFl.exe
  2⤵
  PID:7380
- C:\Windows\System\suFUjdh.exe
  C:\Windows\System\suFUjdh.exe
  2⤵
  PID:7416
- C:\Windows\System\MwPZXfd.exe
  C:\Windows\System\MwPZXfd.exe
  2⤵
  PID:7484
- C:\Windows\System\ohwtUPw.exe
  C:\Windows\System\ohwtUPw.exe
  2⤵
  PID:7500
- C:\Windows\System\zXanLpi.exe
  C:\Windows\System\zXanLpi.exe
  2⤵
  PID:7524
- C:\Windows\System\uTFWRWZ.exe
  C:\Windows\System\uTFWRWZ.exe
  2⤵
  PID:7552
- C:\Windows\System\WSwBYDn.exe
  C:\Windows\System\WSwBYDn.exe
  2⤵
  PID:7576
- C:\Windows\System\znkDunk.exe
  C:\Windows\System\znkDunk.exe
  2⤵
  PID:7592
- C:\Windows\System\mJlFryw.exe
  C:\Windows\System\mJlFryw.exe
  2⤵
  PID:7644
- C:\Windows\System\HmYQEBd.exe
  C:\Windows\System\HmYQEBd.exe
  2⤵
  PID:7676
- C:\Windows\System\QiOMPfU.exe
  C:\Windows\System\QiOMPfU.exe
  2⤵
  PID:7696
- C:\Windows\System\pTDMBEP.exe
  C:\Windows\System\pTDMBEP.exe
  2⤵
  PID:7720
- C:\Windows\System\OmBTPWj.exe
  C:\Windows\System\OmBTPWj.exe
  2⤵
  PID:7756
- C:\Windows\System\BwYQlIc.exe
  C:\Windows\System\BwYQlIc.exe
  2⤵
  PID:7812
- C:\Windows\System\nZiRQVZ.exe
  C:\Windows\System\nZiRQVZ.exe
  2⤵
  PID:7828
- C:\Windows\System\mmeGBVO.exe
  C:\Windows\System\mmeGBVO.exe
  2⤵
  PID:7868
- C:\Windows\System\ezixrPJ.exe
  C:\Windows\System\ezixrPJ.exe
  2⤵
  PID:7884
- C:\Windows\System\tUJJita.exe
  C:\Windows\System\tUJJita.exe
  2⤵
  PID:7904
- C:\Windows\System\wYFykDA.exe
  C:\Windows\System\wYFykDA.exe
  2⤵
  PID:7936
- C:\Windows\System\DOzeqHA.exe
  C:\Windows\System\DOzeqHA.exe
  2⤵
  PID:7960
- C:\Windows\System\ehyPDMM.exe
  C:\Windows\System\ehyPDMM.exe
  2⤵
  PID:7992
- C:\Windows\System\MhHpoeJ.exe
  C:\Windows\System\MhHpoeJ.exe
  2⤵
  PID:8016
- C:\Windows\System\lTjhlCf.exe
  C:\Windows\System\lTjhlCf.exe
  2⤵
  PID:8048
- C:\Windows\System\AzkluAG.exe
  C:\Windows\System\AzkluAG.exe
  2⤵
  PID:8064
- C:\Windows\System\CrhVpJA.exe
  C:\Windows\System\CrhVpJA.exe
  2⤵
  PID:8092
- C:\Windows\System\WzZkErP.exe
  C:\Windows\System\WzZkErP.exe
  2⤵
  PID:8124
- C:\Windows\System\bKATVdQ.exe
  C:\Windows\System\bKATVdQ.exe
  2⤵
  PID:8156
- C:\Windows\System\ZsVXAQX.exe
  C:\Windows\System\ZsVXAQX.exe
  2⤵
  PID:4756
- C:\Windows\System\xRlMNfu.exe
  C:\Windows\System\xRlMNfu.exe
  2⤵
  PID:7060
- C:\Windows\System\bzEAVnQ.exe
  C:\Windows\System\bzEAVnQ.exe
  2⤵
  PID:7196
- C:\Windows\System\uKHqABP.exe
  C:\Windows\System\uKHqABP.exe
  2⤵
  PID:7272
- C:\Windows\System\FrnMvaH.exe
  C:\Windows\System\FrnMvaH.exe
  2⤵
  PID:7308
- C:\Windows\System\sFPyeFy.exe
  C:\Windows\System\sFPyeFy.exe
  2⤵
  PID:7288
- C:\Windows\System\enVKOJq.exe
  C:\Windows\System\enVKOJq.exe
  2⤵
  PID:7480
- C:\Windows\System\wsRrESb.exe
  C:\Windows\System\wsRrESb.exe
  2⤵
  PID:7548
- C:\Windows\System\RarWIAs.exe
  C:\Windows\System\RarWIAs.exe
  2⤵
  PID:7620
- C:\Windows\System\ytLtZqL.exe
  C:\Windows\System\ytLtZqL.exe
  2⤵
  PID:7792
- C:\Windows\System\pItiiDP.exe
  C:\Windows\System\pItiiDP.exe
  2⤵
  PID:3812
- C:\Windows\System\ETOhgRB.exe
  C:\Windows\System\ETOhgRB.exe
  2⤵
  PID:7376
- C:\Windows\System\LlRJCYd.exe
  C:\Windows\System\LlRJCYd.exe
  2⤵
  PID:7296
- C:\Windows\System\iMTaMTu.exe
  C:\Windows\System\iMTaMTu.exe
  2⤵
  PID:7496
- C:\Windows\System\GHJGRJT.exe
  C:\Windows\System\GHJGRJT.exe
  2⤵
  PID:7692
- C:\Windows\System\bMdreaL.exe
  C:\Windows\System\bMdreaL.exe
  2⤵
  PID:7744
- C:\Windows\System\StEatCa.exe
  C:\Windows\System\StEatCa.exe
  2⤵
  PID:7824
- C:\Windows\System\DXotaHq.exe
  C:\Windows\System\DXotaHq.exe
  2⤵
  PID:7912
- C:\Windows\System\isFRizG.exe
  C:\Windows\System\isFRizG.exe
  2⤵
  PID:8180
- C:\Windows\System\UvhpuQR.exe
  C:\Windows\System\UvhpuQR.exe
  2⤵
  PID:8084
- C:\Windows\System\QcIqajW.exe
  C:\Windows\System\QcIqajW.exe
  2⤵
  PID:7932
- C:\Windows\System\HjgfhVj.exe
  C:\Windows\System\HjgfhVj.exe
  2⤵
  PID:4400
- C:\Windows\System\sefwXPu.exe
  C:\Windows\System\sefwXPu.exe
  2⤵
  PID:7588
- C:\Windows\System\CoubOKQ.exe
  C:\Windows\System\CoubOKQ.exe
  2⤵
  PID:7736
- C:\Windows\System\yFgjoio.exe
  C:\Windows\System\yFgjoio.exe
  2⤵
  PID:7900
- C:\Windows\System\wuIkNgN.exe
  C:\Windows\System\wuIkNgN.exe
  2⤵
  PID:7956
- C:\Windows\System\mFHYgKi.exe
  C:\Windows\System\mFHYgKi.exe
  2⤵
  PID:8056
- C:\Windows\System\UjpZJeb.exe
  C:\Windows\System\UjpZJeb.exe
  2⤵
  PID:8196
- C:\Windows\System\EfAIXOH.exe
  C:\Windows\System\EfAIXOH.exe
  2⤵
  PID:8216
- C:\Windows\System\PnQcvbt.exe
  C:\Windows\System\PnQcvbt.exe
  2⤵
  PID:8232
- C:\Windows\System\aCGlifg.exe
  C:\Windows\System\aCGlifg.exe
  2⤵
  PID:8260
- C:\Windows\System\XtuzJiz.exe
  C:\Windows\System\XtuzJiz.exe
  2⤵
  PID:8304
- C:\Windows\System\SlfFUrl.exe
  C:\Windows\System\SlfFUrl.exe
  2⤵
  PID:8340
- C:\Windows\System\ZOMVzIY.exe
  C:\Windows\System\ZOMVzIY.exe
  2⤵
  PID:8360
- C:\Windows\System\grfnioS.exe
  C:\Windows\System\grfnioS.exe
  2⤵
  PID:8408
- C:\Windows\System\ZOgeAJz.exe
  C:\Windows\System\ZOgeAJz.exe
  2⤵
  PID:8424
- C:\Windows\System\AVMsFcw.exe
  C:\Windows\System\AVMsFcw.exe
  2⤵
  PID:8444
- C:\Windows\System\RZilmfY.exe
  C:\Windows\System\RZilmfY.exe
  2⤵
  PID:8480
- C:\Windows\System\lXTRwOB.exe
  C:\Windows\System\lXTRwOB.exe
  2⤵
  PID:8508
- C:\Windows\System\CvBikMP.exe
  C:\Windows\System\CvBikMP.exe
  2⤵
  PID:8528
- C:\Windows\System\KhaApRY.exe
  C:\Windows\System\KhaApRY.exe
  2⤵
  PID:8580
- C:\Windows\System\OzwetNG.exe
  C:\Windows\System\OzwetNG.exe
  2⤵
  PID:8596
- C:\Windows\System\ZLtkVRN.exe
  C:\Windows\System\ZLtkVRN.exe
  2⤵
  PID:8624
- C:\Windows\System\fsrffyi.exe
  C:\Windows\System\fsrffyi.exe
  2⤵
  PID:8644
- C:\Windows\System\NUwxssf.exe
  C:\Windows\System\NUwxssf.exe
  2⤵
  PID:8664
- C:\Windows\System\oqrMZDq.exe
  C:\Windows\System\oqrMZDq.exe
  2⤵
  PID:8684
- C:\Windows\System\qiKUrsf.exe
  C:\Windows\System\qiKUrsf.exe
  2⤵
  PID:8716
- C:\Windows\System\LdBjdrl.exe
  C:\Windows\System\LdBjdrl.exe
  2⤵
  PID:8732
- C:\Windows\System\oOLpDQA.exe
  C:\Windows\System\oOLpDQA.exe
  2⤵
  PID:8752
- C:\Windows\System\PthWEkb.exe
  C:\Windows\System\PthWEkb.exe
  2⤵
  PID:8780
- C:\Windows\System\aOVJYdf.exe
  C:\Windows\System\aOVJYdf.exe
  2⤵
  PID:8796
- C:\Windows\System\fsrrPpE.exe
  C:\Windows\System\fsrrPpE.exe
  2⤵
  PID:8868
- C:\Windows\System\WLtqTOp.exe
  C:\Windows\System\WLtqTOp.exe
  2⤵
  PID:8892
- C:\Windows\System\TgpYEvS.exe
  C:\Windows\System\TgpYEvS.exe
  2⤵
  PID:8920
- C:\Windows\System\vjEqQJj.exe
  C:\Windows\System\vjEqQJj.exe
  2⤵
  PID:8964
- C:\Windows\System\fJKMJxG.exe
  C:\Windows\System\fJKMJxG.exe
  2⤵
  PID:8984
- C:\Windows\System\jUaCRSq.exe
  C:\Windows\System\jUaCRSq.exe
  2⤵
  PID:9008
- C:\Windows\System\rShFvbO.exe
  C:\Windows\System\rShFvbO.exe
  2⤵
  PID:9024
- C:\Windows\System\qmtXgKU.exe
  C:\Windows\System\qmtXgKU.exe
  2⤵
  PID:9052
- C:\Windows\System\gcsJvrU.exe
  C:\Windows\System\gcsJvrU.exe
  2⤵
  PID:9084
- C:\Windows\System\QBsENSs.exe
  C:\Windows\System\QBsENSs.exe
  2⤵
  PID:9140
- C:\Windows\System\UwnHDQz.exe
  C:\Windows\System\UwnHDQz.exe
  2⤵
  PID:9164
- C:\Windows\System\MUxncZA.exe
  C:\Windows\System\MUxncZA.exe
  2⤵
  PID:9204
- C:\Windows\System\ROOGIik.exe
  C:\Windows\System\ROOGIik.exe
  2⤵
  PID:7844
- C:\Windows\System\cWcxxZb.exe
  C:\Windows\System\cWcxxZb.exe
  2⤵
  PID:8164
- C:\Windows\System\aujXKlu.exe
  C:\Windows\System\aujXKlu.exe
  2⤵
  PID:8276
- C:\Windows\System\OSzIerV.exe
  C:\Windows\System\OSzIerV.exe
  2⤵
  PID:8292
- C:\Windows\System\UUBVpJX.exe
  C:\Windows\System\UUBVpJX.exe
  2⤵
  PID:8336
- C:\Windows\System\xzWShVT.exe
  C:\Windows\System\xzWShVT.exe
  2⤵
  PID:8420
- C:\Windows\System\dsGVpdo.exe
  C:\Windows\System\dsGVpdo.exe
  2⤵
  PID:8440
- C:\Windows\System\StOZcke.exe
  C:\Windows\System\StOZcke.exe
  2⤵
  PID:8556
- C:\Windows\System\tiNsFAL.exe
  C:\Windows\System\tiNsFAL.exe
  2⤵
  PID:8616
- C:\Windows\System\lNBhoWt.exe
  C:\Windows\System\lNBhoWt.exe
  2⤵
  PID:8660
- C:\Windows\System\vBZEWqZ.exe
  C:\Windows\System\vBZEWqZ.exe
  2⤵
  PID:8676
- C:\Windows\System\hNIfhFz.exe
  C:\Windows\System\hNIfhFz.exe
  2⤵
  PID:8788
- C:\Windows\System\xtIwPeT.exe
  C:\Windows\System\xtIwPeT.exe
  2⤵
  PID:8976
- C:\Windows\System\FYhdeDQ.exe
  C:\Windows\System\FYhdeDQ.exe
  2⤵
  PID:9016
- C:\Windows\System\SrqkJcC.exe
  C:\Windows\System\SrqkJcC.exe
  2⤵
  PID:9100
- C:\Windows\System\HqXBDHL.exe
  C:\Windows\System\HqXBDHL.exe
  2⤵
  PID:9080
- C:\Windows\System\zcQLuRs.exe
  C:\Windows\System\zcQLuRs.exe
  2⤵
  PID:9148
- C:\Windows\System\xQaYXvy.exe
  C:\Windows\System\xQaYXvy.exe
  2⤵
  PID:7184
- C:\Windows\System\pEwuojD.exe
  C:\Windows\System\pEwuojD.exe
  2⤵
  PID:8244
- C:\Windows\System\aJIuJEA.exe
  C:\Windows\System\aJIuJEA.exe
  2⤵
  PID:8396
- C:\Windows\System\ygCafHh.exe
  C:\Windows\System\ygCafHh.exe
  2⤵
  PID:8436
- C:\Windows\System\zlIvXpc.exe
  C:\Windows\System\zlIvXpc.exe
  2⤵
  PID:8700
- C:\Windows\System\LxRXTLQ.exe
  C:\Windows\System\LxRXTLQ.exe
  2⤵
  PID:8764
- C:\Windows\System\ypfGGmf.exe
  C:\Windows\System\ypfGGmf.exe
  2⤵
  PID:8952
- C:\Windows\System\TIdyodU.exe
  C:\Windows\System\TIdyodU.exe
  2⤵
  PID:9000
- C:\Windows\System\EaTOiUr.exe
  C:\Windows\System\EaTOiUr.exe
  2⤵
  PID:7976
- C:\Windows\System\MPpOFrZ.exe
  C:\Windows\System\MPpOFrZ.exe
  2⤵
  PID:9156
- C:\Windows\System\loJIiFp.exe
  C:\Windows\System\loJIiFp.exe
  2⤵
  PID:7952
- C:\Windows\System\PldOXhg.exe
  C:\Windows\System\PldOXhg.exe
  2⤵
  PID:9240
- C:\Windows\System\hLvFfie.exe
  C:\Windows\System\hLvFfie.exe
  2⤵
  PID:9256
- C:\Windows\System\fXKtRGd.exe
  C:\Windows\System\fXKtRGd.exe
  2⤵
  PID:9304
- C:\Windows\System\qxjeBEv.exe
  C:\Windows\System\qxjeBEv.exe
  2⤵
  PID:9348
- C:\Windows\System\uXXnxhj.exe
  C:\Windows\System\uXXnxhj.exe
  2⤵
  PID:9444
- C:\Windows\System\pjIAmSQ.exe
  C:\Windows\System\pjIAmSQ.exe
  2⤵
  PID:9460
- C:\Windows\System\rdWeFMg.exe
  C:\Windows\System\rdWeFMg.exe
  2⤵
  PID:9500
- C:\Windows\System\mtLMgZi.exe
  C:\Windows\System\mtLMgZi.exe
  2⤵
  PID:9516
- C:\Windows\System\kuSEgRc.exe
  C:\Windows\System\kuSEgRc.exe
  2⤵
  PID:9556
- C:\Windows\System\rNoWPHG.exe
  C:\Windows\System\rNoWPHG.exe
  2⤵
  PID:9572
- C:\Windows\System\TwXIqwZ.exe
  C:\Windows\System\TwXIqwZ.exe
  2⤵
  PID:9640
- C:\Windows\System\KqyRjas.exe
  C:\Windows\System\KqyRjas.exe
  2⤵
  PID:9656
- C:\Windows\System\RgNIkSJ.exe
  C:\Windows\System\RgNIkSJ.exe
  2⤵
  PID:9676
- C:\Windows\System\pTJVwfH.exe
  C:\Windows\System\pTJVwfH.exe
  2⤵
  PID:9700
- C:\Windows\System\mqksKhm.exe
  C:\Windows\System\mqksKhm.exe
  2⤵
  PID:9740
- C:\Windows\System\yuDShqF.exe
  C:\Windows\System\yuDShqF.exe
  2⤵
  PID:9756
- C:\Windows\System\bLXfXhQ.exe
  C:\Windows\System\bLXfXhQ.exe
  2⤵
  PID:9776
- C:\Windows\System\YkgwnmD.exe
  C:\Windows\System\YkgwnmD.exe
  2⤵
  PID:9804
- C:\Windows\System\OYCKRLk.exe
  C:\Windows\System\OYCKRLk.exe
  2⤵
  PID:9832
- C:\Windows\System\ADUeYOj.exe
  C:\Windows\System\ADUeYOj.exe
  2⤵
  PID:9864
- C:\Windows\System\oyytjcT.exe
  C:\Windows\System\oyytjcT.exe
  2⤵
  PID:9880
- C:\Windows\System\jxTHiWL.exe
  C:\Windows\System\jxTHiWL.exe
  2⤵
  PID:9900
- C:\Windows\System\SDAtcOk.exe
  C:\Windows\System\SDAtcOk.exe
  2⤵
  PID:9924
- C:\Windows\System\hPxPmLn.exe
  C:\Windows\System\hPxPmLn.exe
  2⤵
  PID:9944
- C:\Windows\System\jUsLzQR.exe
  C:\Windows\System\jUsLzQR.exe
  2⤵
  PID:9984
- C:\Windows\System\XIWjfER.exe
  C:\Windows\System\XIWjfER.exe
  2⤵
  PID:10004
- C:\Windows\System\viBVLyG.exe
  C:\Windows\System\viBVLyG.exe
  2⤵
  PID:10036
- C:\Windows\System\cfrVZpC.exe
  C:\Windows\System\cfrVZpC.exe
  2⤵
  PID:10060
- C:\Windows\System\elGTetF.exe
  C:\Windows\System\elGTetF.exe
  2⤵
  PID:10080
- C:\Windows\System\kQaYmUi.exe
  C:\Windows\System\kQaYmUi.exe
  2⤵
  PID:10120
- C:\Windows\System\hWnDPXE.exe
  C:\Windows\System\hWnDPXE.exe
  2⤵
  PID:10176
- C:\Windows\System\SnyZMjj.exe
  C:\Windows\System\SnyZMjj.exe
  2⤵
  PID:10196
- C:\Windows\System\XHeTPLI.exe
  C:\Windows\System\XHeTPLI.exe
  2⤵
  PID:10220
- C:\Windows\System\DDeHXYf.exe
  C:\Windows\System\DDeHXYf.exe
  2⤵
  PID:8568
- C:\Windows\System\qHpDILc.exe
  C:\Windows\System\qHpDILc.exe
  2⤵
  PID:9068
- C:\Windows\System\DpnzhRZ.exe
  C:\Windows\System\DpnzhRZ.exe
  2⤵
  PID:8856
- C:\Windows\System\tFOweXd.exe
  C:\Windows\System\tFOweXd.exe
  2⤵
  PID:9228
- C:\Windows\System\KoTtslZ.exe
  C:\Windows\System\KoTtslZ.exe
  2⤵
  PID:9276
- C:\Windows\System\UidqmwG.exe
  C:\Windows\System\UidqmwG.exe
  2⤵
  PID:9296
- C:\Windows\System\DQUpDlv.exe
  C:\Windows\System\DQUpDlv.exe
  2⤵
  PID:9432
- C:\Windows\System\iebKsFO.exe
  C:\Windows\System\iebKsFO.exe
  2⤵
  PID:9532
- C:\Windows\System\TmjXHkL.exe
  C:\Windows\System\TmjXHkL.exe
  2⤵
  PID:9592
- C:\Windows\System\ffVxBMs.exe
  C:\Windows\System\ffVxBMs.exe
  2⤵
  PID:9648
- C:\Windows\System\bwPWERo.exe
  C:\Windows\System\bwPWERo.exe
  2⤵
  PID:9668
- C:\Windows\System\fLCOJrE.exe
  C:\Windows\System\fLCOJrE.exe
  2⤵
  PID:9784
- C:\Windows\System\lhIFNTJ.exe
  C:\Windows\System\lhIFNTJ.exe
  2⤵
  PID:9844
- C:\Windows\System\ezTTPTM.exe
  C:\Windows\System\ezTTPTM.exe
  2⤵
  PID:9972
- C:\Windows\System\CBFXKVn.exe
  C:\Windows\System\CBFXKVn.exe
  2⤵
  PID:10000
- C:\Windows\System\llqRkyU.exe
  C:\Windows\System\llqRkyU.exe
  2⤵
  PID:10012
- C:\Windows\System\FpseKQA.exe
  C:\Windows\System\FpseKQA.exe
  2⤵
  PID:10108
- C:\Windows\System\NcxNwTE.exe
  C:\Windows\System\NcxNwTE.exe
  2⤵
  PID:10192
- C:\Windows\System\HupuuVQ.exe
  C:\Windows\System\HupuuVQ.exe
  2⤵
  PID:10204
- C:\Windows\System\RPdYWdG.exe
  C:\Windows\System\RPdYWdG.exe
  2⤵
  PID:9220
- C:\Windows\System\sQBvnvh.exe
  C:\Windows\System\sQBvnvh.exe
  2⤵
  PID:9408
- C:\Windows\System\VcaPLVg.exe
  C:\Windows\System\VcaPLVg.exe
  2⤵
  PID:9512
- C:\Windows\System\fOJAvzy.exe
  C:\Windows\System\fOJAvzy.exe
  2⤵
  PID:948
- C:\Windows\System\jXXGGSX.exe
  C:\Windows\System\jXXGGSX.exe
  2⤵
  PID:10048
- C:\Windows\System\TFHLsQK.exe
  C:\Windows\System\TFHLsQK.exe
  2⤵
  PID:10264
- C:\Windows\System\YDbxLYD.exe
  C:\Windows\System\YDbxLYD.exe
  2⤵
  PID:10284
- C:\Windows\System\jJVjfHy.exe
  C:\Windows\System\jJVjfHy.exe
  2⤵
  PID:10320
- C:\Windows\System\REHMhpB.exe
  C:\Windows\System\REHMhpB.exe
  2⤵
  PID:10368
- C:\Windows\System\mZHPpew.exe
  C:\Windows\System\mZHPpew.exe
  2⤵
  PID:10388
- C:\Windows\System\GekcxfC.exe
  C:\Windows\System\GekcxfC.exe
  2⤵
  PID:10424
- C:\Windows\System\GSFpYoc.exe
  C:\Windows\System\GSFpYoc.exe
  2⤵
  PID:10460
- C:\Windows\System\iwZZsXz.exe
  C:\Windows\System\iwZZsXz.exe
  2⤵
  PID:10484
- C:\Windows\System\wScCLTp.exe
  C:\Windows\System\wScCLTp.exe
  2⤵
  PID:10508
- C:\Windows\System\SYRZsMo.exe
  C:\Windows\System\SYRZsMo.exe
  2⤵
  PID:10532
- C:\Windows\System\mxNKZIJ.exe
  C:\Windows\System\mxNKZIJ.exe
  2⤵
  PID:10580
- C:\Windows\System\vHDYhFd.exe
  C:\Windows\System\vHDYhFd.exe
  2⤵
  PID:10596
- C:\Windows\System\eKBFyEl.exe
  C:\Windows\System\eKBFyEl.exe
  2⤵
  PID:10624
- C:\Windows\System\GyjLraU.exe
  C:\Windows\System\GyjLraU.exe
  2⤵
  PID:10640
- C:\Windows\System\hSaUwzG.exe
  C:\Windows\System\hSaUwzG.exe
  2⤵
  PID:10660
- C:\Windows\System\AzswNYg.exe
  C:\Windows\System\AzswNYg.exe
  2⤵
  PID:10696
- C:\Windows\System\YPOXovd.exe
  C:\Windows\System\YPOXovd.exe
  2⤵
  PID:10716
- C:\Windows\System\IUhCbJN.exe
  C:\Windows\System\IUhCbJN.exe
  2⤵
  PID:10736
- C:\Windows\System\SVlrMJV.exe
  C:\Windows\System\SVlrMJV.exe
  2⤵
  PID:10792
- C:\Windows\System\iJQucGg.exe
  C:\Windows\System\iJQucGg.exe
  2⤵
  PID:10808
- C:\Windows\System\LFcVUTA.exe
  C:\Windows\System\LFcVUTA.exe
  2⤵
  PID:10840
- C:\Windows\System\UMjzmWT.exe
  C:\Windows\System\UMjzmWT.exe
  2⤵
  PID:10860
- C:\Windows\System\YQYQVsS.exe
  C:\Windows\System\YQYQVsS.exe
  2⤵
  PID:10880
- C:\Windows\System\eIvuhyw.exe
  C:\Windows\System\eIvuhyw.exe
  2⤵
  PID:10896
- C:\Windows\System\MXlbAWz.exe
  C:\Windows\System\MXlbAWz.exe
  2⤵
  PID:10972
- C:\Windows\System\PnGOGGY.exe
  C:\Windows\System\PnGOGGY.exe
  2⤵
  PID:10992
- C:\Windows\System\ySXKefG.exe
  C:\Windows\System\ySXKefG.exe
  2⤵
  PID:11008
- C:\Windows\System\GeTABHJ.exe
  C:\Windows\System\GeTABHJ.exe
  2⤵
  PID:11040
- C:\Windows\System\eZZwTAR.exe
  C:\Windows\System\eZZwTAR.exe
  2⤵
  PID:11056
- C:\Windows\System\PRJpsOG.exe
  C:\Windows\System\PRJpsOG.exe
  2⤵
  PID:11084
- C:\Windows\System\FvzwErU.exe
  C:\Windows\System\FvzwErU.exe
  2⤵
  PID:11104
- C:\Windows\System\LBZWplF.exe
  C:\Windows\System\LBZWplF.exe
  2⤵
  PID:11124
- C:\Windows\System\WreIMnG.exe
  C:\Windows\System\WreIMnG.exe
  2⤵
  PID:11176
- C:\Windows\System\gVxcDcd.exe
  C:\Windows\System\gVxcDcd.exe
  2⤵
  PID:11208
- C:\Windows\System\GQWDebp.exe
  C:\Windows\System\GQWDebp.exe
  2⤵
  PID:11232
- C:\Windows\System\kpZyLZI.exe
  C:\Windows\System\kpZyLZI.exe
  2⤵
  PID:11260
- C:\Windows\System\MZSkIFx.exe
  C:\Windows\System\MZSkIFx.exe
  2⤵
  PID:9452
- C:\Windows\System\RdQhPIP.exe
  C:\Windows\System\RdQhPIP.exe
  2⤵
  PID:9824
- C:\Windows\System\gTRvzlE.exe
  C:\Windows\System\gTRvzlE.exe
  2⤵
  PID:10136
- C:\Windows\System\WLJXMfr.exe
  C:\Windows\System\WLJXMfr.exe
  2⤵
  PID:9896
- C:\Windows\System\bYauYsf.exe
  C:\Windows\System\bYauYsf.exe
  2⤵
  PID:9732
- C:\Windows\System\reUGZZs.exe
  C:\Windows\System\reUGZZs.exe
  2⤵
  PID:10332
- C:\Windows\System\FIxKcBL.exe
  C:\Windows\System\FIxKcBL.exe
  2⤵
  PID:10408
- C:\Windows\System\PTlPHiK.exe
  C:\Windows\System\PTlPHiK.exe
  2⤵
  PID:10452
- C:\Windows\System\DMqDsJd.exe
  C:\Windows\System\DMqDsJd.exe
  2⤵
  PID:10504
- C:\Windows\System\EtlGBRb.exe
  C:\Windows\System\EtlGBRb.exe
  2⤵
  PID:10588
- C:\Windows\System\NEUqMXG.exe
  C:\Windows\System\NEUqMXG.exe
  2⤵
  PID:10616
- C:\Windows\System\veaRkvL.exe
  C:\Windows\System\veaRkvL.exe
  2⤵
  PID:10732
- C:\Windows\System\ClOtglQ.exe
  C:\Windows\System\ClOtglQ.exe
  2⤵
  PID:10800
- C:\Windows\System\EryAPSg.exe
  C:\Windows\System\EryAPSg.exe
  2⤵
  PID:10836
- C:\Windows\System\DdlFlGZ.exe
  C:\Windows\System\DdlFlGZ.exe
  2⤵
  PID:10924
- C:\Windows\System\bTXIRrp.exe
  C:\Windows\System\bTXIRrp.exe
  2⤵
  PID:10964
- C:\Windows\System\dmHQUbU.exe
  C:\Windows\System\dmHQUbU.exe
  2⤵
  PID:11080
- C:\Windows\System\fdfmglr.exe
  C:\Windows\System\fdfmglr.exe
  2⤵
  PID:11132
- C:\Windows\System\JttjctV.exe
  C:\Windows\System\JttjctV.exe
  2⤵
  PID:11188
- C:\Windows\System\oOMhbmE.exe
  C:\Windows\System\oOMhbmE.exe
  2⤵
  PID:11216
- C:\Windows\System\WJFHRWR.exe
  C:\Windows\System\WJFHRWR.exe
  2⤵
  PID:11256
- C:\Windows\System\kKJVsSy.exe
  C:\Windows\System\kKJVsSy.exe
  2⤵
  PID:4596
- C:\Windows\System\HfwNwOB.exe
  C:\Windows\System\HfwNwOB.exe
  2⤵
  PID:10276
- C:\Windows\System\gtIVNaF.exe
  C:\Windows\System\gtIVNaF.exe
  2⤵
  PID:10420
- C:\Windows\System\GJFdNCK.exe
  C:\Windows\System\GJFdNCK.exe
  2⤵
  PID:10568
- C:\Windows\System\nfyJsPm.exe
  C:\Windows\System\nfyJsPm.exe
  2⤵
  PID:10608
- C:\Windows\System\eNslcjp.exe
  C:\Windows\System\eNslcjp.exe
  2⤵
  PID:10848
- C:\Windows\System\dftMffo.exe
  C:\Windows\System\dftMffo.exe
  2⤵
  PID:11092
- C:\Windows\System\hUwsoPp.exe
  C:\Windows\System\hUwsoPp.exe
  2⤵
  PID:11116
- C:\Windows\System\rPSJoUl.exe
  C:\Windows\System\rPSJoUl.exe
  2⤵
  PID:9368
- C:\Windows\System\QTHFCvv.exe
  C:\Windows\System\QTHFCvv.exe
  2⤵
  PID:9508
- C:\Windows\System\tjHfaWy.exe
  C:\Windows\System\tjHfaWy.exe
  2⤵
  PID:10692
- C:\Windows\System\QYnWrGB.exe
  C:\Windows\System\QYnWrGB.exe
  2⤵
  PID:848
- C:\Windows\System\RJKWJcM.exe
  C:\Windows\System\RJKWJcM.exe
  2⤵
  PID:9716
- C:\Windows\System\kcrJRZN.exe
  C:\Windows\System\kcrJRZN.exe
  2⤵
  PID:10300
- C:\Windows\System\couGysh.exe
  C:\Windows\System\couGysh.exe
  2⤵
  PID:11064
- C:\Windows\System\JUkLqiF.exe
  C:\Windows\System\JUkLqiF.exe
  2⤵
  PID:11052
- C:\Windows\System\RKwLEqx.exe
  C:\Windows\System\RKwLEqx.exe
  2⤵
  PID:9796
- C:\Windows\System\CbHTzwN.exe
  C:\Windows\System\CbHTzwN.exe
  2⤵
  PID:11288
- C:\Windows\System\GrdpACG.exe
  C:\Windows\System\GrdpACG.exe
  2⤵
  PID:11308
- C:\Windows\System\kGOIfRp.exe
  C:\Windows\System\kGOIfRp.exe
  2⤵
  PID:11348
- C:\Windows\System\rnuhFdJ.exe
  C:\Windows\System\rnuhFdJ.exe
  2⤵
  PID:11368
- C:\Windows\System\HPbFtio.exe
  C:\Windows\System\HPbFtio.exe
  2⤵
  PID:11404
- C:\Windows\System\rZnOYyT.exe
  C:\Windows\System\rZnOYyT.exe
  2⤵
  PID:11432
- C:\Windows\System\mxntGAA.exe
  C:\Windows\System\mxntGAA.exe
  2⤵
  PID:11472
- C:\Windows\System\JxAmxoM.exe
  C:\Windows\System\JxAmxoM.exe
  2⤵
  PID:11500
- C:\Windows\System\aaivGzm.exe
  C:\Windows\System\aaivGzm.exe
  2⤵
  PID:11532
- C:\Windows\System\xpGsIjQ.exe
  C:\Windows\System\xpGsIjQ.exe
  2⤵
  PID:11572
- C:\Windows\System\wFfOpuM.exe
  C:\Windows\System\wFfOpuM.exe
  2⤵
  PID:11588
- C:\Windows\System\LOMmLJJ.exe
  C:\Windows\System\LOMmLJJ.exe
  2⤵
  PID:11616
- C:\Windows\System\YBLfgfD.exe
  C:\Windows\System\YBLfgfD.exe
  2⤵
  PID:11632
- C:\Windows\System\atoHpbP.exe
  C:\Windows\System\atoHpbP.exe
  2⤵
  PID:11656
- C:\Windows\System\WxeaiSg.exe
  C:\Windows\System\WxeaiSg.exe
  2⤵
  PID:11680
- C:\Windows\System\sTLUdsm.exe
  C:\Windows\System\sTLUdsm.exe
  2⤵
  PID:11700
- C:\Windows\System\EmGIeoU.exe
  C:\Windows\System\EmGIeoU.exe
  2⤵
  PID:11724
- C:\Windows\System\iquHiqo.exe
  C:\Windows\System\iquHiqo.exe
  2⤵
  PID:11756
- C:\Windows\System\knzuCYF.exe
  C:\Windows\System\knzuCYF.exe
  2⤵
  PID:11800
- C:\Windows\System\pdtwXvp.exe
  C:\Windows\System\pdtwXvp.exe
  2⤵
  PID:11844
- C:\Windows\System\XKAStDp.exe
  C:\Windows\System\XKAStDp.exe
  2⤵
  PID:11868
- C:\Windows\System\WgbvAWv.exe
  C:\Windows\System\WgbvAWv.exe
  2⤵
  PID:11900
- C:\Windows\System\LmNpwUj.exe
  C:\Windows\System\LmNpwUj.exe
  2⤵
  PID:11940
- C:\Windows\System\XBeFpmK.exe
  C:\Windows\System\XBeFpmK.exe
  2⤵
  PID:11964
- C:\Windows\System\KCLOSpB.exe
  C:\Windows\System\KCLOSpB.exe
  2⤵
  PID:11980
- C:\Windows\System\KADVYTM.exe
  C:\Windows\System\KADVYTM.exe
  2⤵
  PID:12004
- C:\Windows\System\PzbeEpf.exe
  C:\Windows\System\PzbeEpf.exe
  2⤵
  PID:12024
- C:\Windows\System\nbvTONn.exe
  C:\Windows\System\nbvTONn.exe
  2⤵
  PID:12040
- C:\Windows\System\LmPWGoo.exe
  C:\Windows\System\LmPWGoo.exe
  2⤵
  PID:12092
- C:\Windows\System\YvYtXmR.exe
  C:\Windows\System\YvYtXmR.exe
  2⤵
  PID:12144
- C:\Windows\System\UHlNlhL.exe
  C:\Windows\System\UHlNlhL.exe
  2⤵
  PID:12164
- C:\Windows\System\gLInRyK.exe
  C:\Windows\System\gLInRyK.exe
  2⤵
  PID:12192
- C:\Windows\System\ConygsN.exe
  C:\Windows\System\ConygsN.exe
  2⤵
  PID:12216
- C:\Windows\System\jMvGYKo.exe
  C:\Windows\System\jMvGYKo.exe
  2⤵
  PID:12256
- C:\Windows\System\UlGLSDE.exe
  C:\Windows\System\UlGLSDE.exe
  2⤵
  PID:12272
- C:\Windows\System\eYAtVOo.exe
  C:\Windows\System\eYAtVOo.exe
  2⤵
  PID:10752
- C:\Windows\System\Worisne.exe
  C:\Windows\System\Worisne.exe
  2⤵
  PID:11328
- C:\Windows\System\cuJHCVP.exe
  C:\Windows\System\cuJHCVP.exe
  2⤵
  PID:11340
- C:\Windows\System\TCArdmV.exe
  C:\Windows\System\TCArdmV.exe
  2⤵
  PID:11392
- C:\Windows\System\gNbcune.exe
  C:\Windows\System\gNbcune.exe
  2⤵
  PID:11492
- C:\Windows\System\XCbGcBg.exe
  C:\Windows\System\XCbGcBg.exe
  2⤵
  PID:11544
- C:\Windows\System\EXOywID.exe
  C:\Windows\System\EXOywID.exe
  2⤵
  PID:11652
- C:\Windows\System\REfkMiR.exe
  C:\Windows\System\REfkMiR.exe
  2⤵
  PID:11672
- C:\Windows\System\temlUoH.exe
  C:\Windows\System\temlUoH.exe
  2⤵
  PID:11752
- C:\Windows\System\KHAQxLe.exe
  C:\Windows\System\KHAQxLe.exe
  2⤵
  PID:11780
- C:\Windows\System\HAUnfIq.exe
  C:\Windows\System\HAUnfIq.exe
  2⤵
  PID:11928
- C:\Windows\System\VNBkdRC.exe
  C:\Windows\System\VNBkdRC.exe
  2⤵
  PID:12000
- C:\Windows\System\bRuOGIG.exe
  C:\Windows\System\bRuOGIG.exe
  2⤵
  PID:12064
- C:\Windows\System\SVQOylg.exe
  C:\Windows\System\SVQOylg.exe
  2⤵
  PID:12124
- C:\Windows\System\tqyZAYA.exe
  C:\Windows\System\tqyZAYA.exe
  2⤵
  PID:12188
- C:\Windows\System\gPJwBES.exe
  C:\Windows\System\gPJwBES.exe
  2⤵
  PID:12236
- C:\Windows\System\iBWiFrt.exe
  C:\Windows\System\iBWiFrt.exe
  2⤵
  PID:10404
- C:\Windows\System\DgjDBQt.exe
  C:\Windows\System\DgjDBQt.exe
  2⤵
  PID:11280
- C:\Windows\System\RkMXBIs.exe
  C:\Windows\System\RkMXBIs.exe
  2⤵
  PID:11460
- C:\Windows\System\YqchkUt.exe
  C:\Windows\System\YqchkUt.exe
  2⤵
  PID:11664
- C:\Windows\System\bMNjLfe.exe
  C:\Windows\System\bMNjLfe.exe
  2⤵
  PID:11696
- C:\Windows\System\dBFqazb.exe
  C:\Windows\System\dBFqazb.exe
  2⤵
  PID:11812
- C:\Windows\System\bimCqJo.exe
  C:\Windows\System\bimCqJo.exe
  2⤵
  PID:12032
- C:\Windows\System\tBxkKCU.exe
  C:\Windows\System\tBxkKCU.exe
  2⤵
  PID:12120
- C:\Windows\System\xWackfG.exe
  C:\Windows\System\xWackfG.exe
  2⤵
  PID:12232
- C:\Windows\System\oQhmWvW.exe
  C:\Windows\System\oQhmWvW.exe
  2⤵
  PID:12212
- C:\Windows\System\ipHluEi.exe
  C:\Windows\System\ipHluEi.exe
  2⤵
  PID:11624
- C:\Windows\System\cFuEZlF.exe
  C:\Windows\System\cFuEZlF.exe
  2⤵
  PID:12304
- C:\Windows\System\cdUCDeE.exe
  C:\Windows\System\cdUCDeE.exe
  2⤵
  PID:12320
- C:\Windows\System\hpKzCPj.exe
  C:\Windows\System\hpKzCPj.exe
  2⤵
  PID:12344
- C:\Windows\System\iimavhh.exe
  C:\Windows\System\iimavhh.exe
  2⤵
  PID:12372
- C:\Windows\System\RgVhyFf.exe
  C:\Windows\System\RgVhyFf.exe
  2⤵
  PID:12420
- C:\Windows\System\FXYaOsz.exe
  C:\Windows\System\FXYaOsz.exe
  2⤵
  PID:12444
- C:\Windows\System\ienWtCR.exe
  C:\Windows\System\ienWtCR.exe
  2⤵
  PID:12464
- C:\Windows\System\qdDGNAR.exe
  C:\Windows\System\qdDGNAR.exe
  2⤵
  PID:12488
- C:\Windows\System\WWTDivA.exe
  C:\Windows\System\WWTDivA.exe
  2⤵
  PID:12528
- C:\Windows\System\aLHTWnd.exe
  C:\Windows\System\aLHTWnd.exe
  2⤵
  PID:12548
- C:\Windows\System\tsyqRQo.exe
  C:\Windows\System\tsyqRQo.exe
  2⤵
  PID:12572
- C:\Windows\System\hUnSLAE.exe
  C:\Windows\System\hUnSLAE.exe
  2⤵
  PID:12588
- C:\Windows\System\GpPSlJj.exe
  C:\Windows\System\GpPSlJj.exe
  2⤵
  PID:12608
- C:\Windows\System\wqMOHxj.exe
  C:\Windows\System\wqMOHxj.exe
  2⤵
  PID:12628
- C:\Windows\System\xlFBqjW.exe
  C:\Windows\System\xlFBqjW.exe
  2⤵
  PID:12652
- C:\Windows\System\NoiJGLV.exe
  C:\Windows\System\NoiJGLV.exe
  2⤵
  PID:12716
- C:\Windows\System\GqxVDci.exe
  C:\Windows\System\GqxVDci.exe
  2⤵
  PID:12736
- C:\Windows\System\JlgZyuQ.exe
  C:\Windows\System\JlgZyuQ.exe
  2⤵
  PID:12784
- C:\Windows\System\xSicMjY.exe
  C:\Windows\System\xSicMjY.exe
  2⤵
  PID:12816
- C:\Windows\System\QsbFvjY.exe
  C:\Windows\System\QsbFvjY.exe
  2⤵
  PID:12868
- C:\Windows\System\mZlryUV.exe
  C:\Windows\System\mZlryUV.exe
  2⤵
  PID:12888
- C:\Windows\System\ltsHTug.exe
  C:\Windows\System\ltsHTug.exe
  2⤵
  PID:12904
- C:\Windows\System\SswwSUD.exe
  C:\Windows\System\SswwSUD.exe
  2⤵
  PID:12928
- C:\Windows\System\IDiNNvs.exe
  C:\Windows\System\IDiNNvs.exe
  2⤵
  PID:12952
- C:\Windows\System\BIimnVd.exe
  C:\Windows\System\BIimnVd.exe
  2⤵
  PID:12980
- C:\Windows\System\LXLghqO.exe
  C:\Windows\System\LXLghqO.exe
  2⤵
  PID:13052
- C:\Windows\System\rNPoLKh.exe
  C:\Windows\System\rNPoLKh.exe
  2⤵
  PID:13068
- C:\Windows\System\rdvQwKA.exe
  C:\Windows\System\rdvQwKA.exe
  2⤵
  PID:13088
- C:\Windows\System\iiYqWtP.exe
  C:\Windows\System\iiYqWtP.exe
  2⤵
  PID:13116
- C:\Windows\System\XwMJtIT.exe
  C:\Windows\System\XwMJtIT.exe
  2⤵
  PID:13140
- C:\Windows\System\ozwwtpJ.exe
  C:\Windows\System\ozwwtpJ.exe
  2⤵
  PID:13160
- C:\Windows\System\mJcNbjR.exe
  C:\Windows\System\mJcNbjR.exe
  2⤵
  PID:13188
- C:\Windows\System\fuXEiyH.exe
  C:\Windows\System\fuXEiyH.exe
  2⤵
  PID:13216
- C:\Windows\System\VhwZOuf.exe
  C:\Windows\System\VhwZOuf.exe
  2⤵
  PID:13232
- C:\Windows\System\rRrtLDp.exe
  C:\Windows\System\rRrtLDp.exe
  2⤵
  PID:13260
- C:\Windows\System\EdPtxPD.exe
  C:\Windows\System\EdPtxPD.exe
  2⤵
  PID:13280
- C:\Windows\System\NTHtWdC.exe
  C:\Windows\System\NTHtWdC.exe
  2⤵
  PID:13300
- C:\Windows\System\JVZosgq.exe
  C:\Windows\System\JVZosgq.exe
  2⤵
  PID:11364
- C:\Windows\System\vUYLUIe.exe
  C:\Windows\System\vUYLUIe.exe
  2⤵
  PID:4332
- C:\Windows\System\lAJOBym.exe
  C:\Windows\System\lAJOBym.exe
  2⤵
  PID:11628
- C:\Windows\System\iLNJpFL.exe
  C:\Windows\System\iLNJpFL.exe
  2⤵
  PID:12364
- C:\Windows\System\xvknbIi.exe
  C:\Windows\System\xvknbIi.exe
  2⤵
  PID:12460
- C:\Windows\System\SgGSpsO.exe
  C:\Windows\System\SgGSpsO.exe
  2⤵
  PID:12536
- C:\Windows\System\fxkgXjK.exe
  C:\Windows\System\fxkgXjK.exe
  2⤵
  PID:12540
- C:\Windows\System\IgcPSQl.exe
  C:\Windows\System\IgcPSQl.exe
  2⤵
  PID:12708
- C:\Windows\System\JeDwbcw.exe
  C:\Windows\System\JeDwbcw.exe
  2⤵
  PID:12604
- C:\Windows\System\MthkNFh.exe
  C:\Windows\System\MthkNFh.exe
  2⤵
  PID:12636
- C:\Windows\System\GIryNKb.exe
  C:\Windows\System\GIryNKb.exe
  2⤵
  PID:12776
- C:\Windows\System\CIbCvVo.exe
  C:\Windows\System\CIbCvVo.exe
  2⤵
  PID:12844
- C:\Windows\System\uJPRZJQ.exe
  C:\Windows\System\uJPRZJQ.exe
  2⤵
  PID:12944
- C:\Windows\System\CmxIzFZ.exe
  C:\Windows\System\CmxIzFZ.exe
  2⤵
  PID:13176
- C:\Windows\System\BZsnqSe.exe
  C:\Windows\System\BZsnqSe.exe
  2⤵
  PID:13112
- C:\Windows\System\ABxZNWS.exe
  C:\Windows\System\ABxZNWS.exe
  2⤵
  PID:4676
- C:\Windows\System\rDndDHS.exe
  C:\Windows\System\rDndDHS.exe
  2⤵
  PID:12876
- C:\Windows\System\rUTBnIg.exe
  C:\Windows\System\rUTBnIg.exe
  2⤵
  PID:12988
- C:\Windows\System\xgAPLuO.exe
  C:\Windows\System\xgAPLuO.exe
  2⤵
  PID:12340
- C:\Windows\System\AyLAlmD.exe
  C:\Windows\System\AyLAlmD.exe
  2⤵
  PID:12512
- C:\Windows\System\NAEmVPd.exe
  C:\Windows\System\NAEmVPd.exe
  2⤵
  PID:12456
- C:\Windows\System\mxqpNtX.exe
  C:\Windows\System\mxqpNtX.exe
  2⤵
  PID:1940
- C:\Windows\System\JFilLlQ.exe
  C:\Windows\System\JFilLlQ.exe
  2⤵
  PID:11972
- C:\Windows\System\OCHJrCA.exe
  C:\Windows\System\OCHJrCA.exe
  2⤵
  PID:12672
- C:\Windows\System\IEhOszy.exe
  C:\Windows\System\IEhOszy.exe
  2⤵
  PID:3608
- C:\Windows\System\ahIHAJF.exe
  C:\Windows\System\ahIHAJF.exe
  2⤵
  PID:12728
- C:\Windows\System\pjMqjEr.exe
  C:\Windows\System\pjMqjEr.exe
  2⤵
  PID:12976
- C:\Windows\System\wPwtLIe.exe
  C:\Windows\System\wPwtLIe.exe
  2⤵
  PID:3404
- C:\Windows\System\DkfiLdU.exe
  C:\Windows\System\DkfiLdU.exe
  2⤵
  PID:3668
- C:\Windows\System\niRGaLP.exe
  C:\Windows\System\niRGaLP.exe
  2⤵
  PID:13084
- C:\Windows\System\mlRQsvN.exe
  C:\Windows\System\mlRQsvN.exe
  2⤵
  PID:696
- C:\Windows\System\RkCuQQl.exe
  C:\Windows\System\RkCuQQl.exe
  2⤵
  PID:3564
- C:\Windows\System\NBcaZsn.exe
  C:\Windows\System\NBcaZsn.exe
  2⤵
  PID:4192
- C:\Windows\System\POFhsRp.exe
  C:\Windows\System\POFhsRp.exe
  2⤵
  PID:9632
- C:\Windows\System\kfGdStQ.exe
  C:\Windows\System\kfGdStQ.exe
  2⤵
  PID:3780
- C:\Windows\System\ajQLqLa.exe
  C:\Windows\System\ajQLqLa.exe
  2⤵
  PID:3600
- C:\Windows\System\WrPIKQU.exe
  C:\Windows\System\WrPIKQU.exe
  2⤵
  PID:12316
- C:\Windows\System\tVMEkuY.exe
  C:\Windows\System\tVMEkuY.exe
  2⤵
  PID:3604
- C:\Windows\System\YxJcMGF.exe
  C:\Windows\System\YxJcMGF.exe
  2⤵
  PID:4376
- C:\Windows\System\nGtiKoE.exe
  C:\Windows\System\nGtiKoE.exe
  2⤵
  PID:13108
- C:\Windows\System\dCwwqzy.exe
  C:\Windows\System\dCwwqzy.exe
  2⤵
  PID:12732
- C:\Windows\System\iDGGHBy.exe
  C:\Windows\System\iDGGHBy.exe
  2⤵
  PID:6016
- C:\Windows\System\zxvJJWP.exe
  C:\Windows\System\zxvJJWP.exe
  2⤵
  PID:3664
- C:\Windows\System\YkgdGAu.exe
  C:\Windows\System\YkgdGAu.exe
  2⤵
  PID:13000
- C:\Windows\System\fJQgaUK.exe
  C:\Windows\System\fJQgaUK.exe
  2⤵
  PID:640
- C:\Windows\System\TsXnEjz.exe
  C:\Windows\System\TsXnEjz.exe
  2⤵
  PID:3456
- C:\Windows\System\iaKKwgd.exe
  C:\Windows\System\iaKKwgd.exe
  2⤵
  PID:12624
- C:\Windows\System\aZnXJaU.exe
  C:\Windows\System\aZnXJaU.exe
  2⤵
  PID:4460
- C:\Windows\System\kQGfGgw.exe
  C:\Windows\System\kQGfGgw.exe
  2⤵
  PID:4404
- C:\Windows\System\iRHqEwi.exe
  C:\Windows\System\iRHqEwi.exe
  2⤵
  PID:216
- C:\Windows\System\BQICbUm.exe
  C:\Windows\System\BQICbUm.exe
  2⤵
  PID:3640
- C:\Windows\System\htMfzev.exe
  C:\Windows\System\htMfzev.exe
  2⤵
  PID:4536
- C:\Windows\System\ZgKgzwS.exe
  C:\Windows\System\ZgKgzwS.exe
  2⤵
  PID:7160
- C:\Windows\System\ZvjBZOS.exe
  C:\Windows\System\ZvjBZOS.exe
  2⤵
  PID:4440
- C:\Windows\System\aMvrpRR.exe
  C:\Windows\System\aMvrpRR.exe
  2⤵
  PID:772
- C:\Windows\System\HKPZLqf.exe
  C:\Windows\System\HKPZLqf.exe
  2⤵
  PID:3188
- C:\Windows\System\fAfonzL.exe
  C:\Windows\System\fAfonzL.exe
  2⤵
  PID:6584
- C:\Windows\System\nRgFFTF.exe
  C:\Windows\System\nRgFFTF.exe
  2⤵
  PID:6752
- C:\Windows\System\syBEsQX.exe
  C:\Windows\System\syBEsQX.exe
  2⤵
  PID:7064
- C:\Windows\System\yFyxdsv.exe
  C:\Windows\System\yFyxdsv.exe
  2⤵
  PID:1064
- C:\Windows\System\lHdQpLO.exe
  C:\Windows\System\lHdQpLO.exe
  2⤵
  PID:4924
- C:\Windows\System\zAEhVMi.exe
  C:\Windows\System\zAEhVMi.exe
  2⤵
  PID:6472
- C:\Windows\System\EWIDmPc.exe
  C:\Windows\System\EWIDmPc.exe
  2⤵
  PID:6640
- C:\Windows\System\iSsCFVY.exe
  C:\Windows\System\iSsCFVY.exe
  2⤵
  PID:4592
- C:\Windows\System\UzfXJFg.exe
  C:\Windows\System\UzfXJFg.exe
  2⤵
  PID:4672
- C:\Windows\System\BMYtRek.exe
  C:\Windows\System\BMYtRek.exe
  2⤵
  PID:6452
- C:\Windows\System\QXhbGuB.exe
  C:\Windows\System\QXhbGuB.exe
  2⤵
  PID:6956
- C:\Windows\System\ORyijrk.exe
  C:\Windows\System\ORyijrk.exe
  2⤵
  PID:7336
- C:\Windows\System\NxBpfer.exe
  C:\Windows\System\NxBpfer.exe
  2⤵
  PID:7392
- C:\Windows\System\kLAvLqQ.exe
  C:\Windows\System\kLAvLqQ.exe
  2⤵
  PID:7560
- C:\Windows\System\WmAliPp.exe
  C:\Windows\System\WmAliPp.exe
  2⤵
  PID:7636
- C:\Windows\System\iISQXlh.exe
  C:\Windows\System\iISQXlh.exe
  2⤵
  PID:6844
- C:\Windows\System\GVGtudc.exe
  C:\Windows\System\GVGtudc.exe
  2⤵
  PID:2096
- C:\Windows\System\nzgsfBJ.exe
  C:\Windows\System\nzgsfBJ.exe
  2⤵
  PID:7316
- C:\Windows\System\UNxbrGu.exe
  C:\Windows\System\UNxbrGu.exe
  2⤵
  PID:7472
- C:\Windows\System\DVYlpBX.exe
  C:\Windows\System\DVYlpBX.exe
  2⤵
  PID:7200
- C:\Windows\System\OzgsHCU.exe
  C:\Windows\System\OzgsHCU.exe
  2⤵
  PID:220
- C:\Windows\System\OueBzCA.exe
  C:\Windows\System\OueBzCA.exe
  2⤵
  PID:1444
- C:\Windows\System\Fzkyyuo.exe
  C:\Windows\System\Fzkyyuo.exe
  2⤵
  PID:7768
- C:\Windows\System\Ugaizfu.exe
  C:\Windows\System\Ugaizfu.exe
  2⤵
  PID:7804
- C:\Windows\System\LHlonle.exe
  C:\Windows\System\LHlonle.exe
  2⤵
  PID:7836
- C:\Windows\System\ctKoRdb.exe
  C:\Windows\System\ctKoRdb.exe
  2⤵
  PID:4204
- C:\Windows\System\qNWLXMs.exe
  C:\Windows\System\qNWLXMs.exe
  2⤵
  PID:2600
- C:\Windows\System\ivgvfsE.exe
  C:\Windows\System\ivgvfsE.exe
  2⤵
  PID:7892
- C:\Windows\System\BQboaxa.exe
  C:\Windows\System\BQboaxa.exe
  2⤵
  PID:4008
- C:\Windows\System\IcxpGrh.exe
  C:\Windows\System\IcxpGrh.exe
  2⤵
  PID:4848
- C:\Windows\System\KUxIMfU.exe
  C:\Windows\System\KUxIMfU.exe
  2⤵
  PID:3172
- C:\Windows\System\wXWFuhr.exe
  C:\Windows\System\wXWFuhr.exe
  2⤵
  PID:12856
- C:\Windows\System\sWYeHPV.exe
  C:\Windows\System\sWYeHPV.exe
  2⤵
  PID:6676
- C:\Windows\System\AwuzgUq.exe
  C:\Windows\System\AwuzgUq.exe
  2⤵
  PID:8132
- C:\Windows\System\IUSaVMZ.exe
  C:\Windows\System\IUSaVMZ.exe
  2⤵
  PID:1924
- C:\Windows\System\zqSJSHG.exe
  C:\Windows\System\zqSJSHG.exe
  2⤵
  PID:1472
- C:\Windows\System\kyhugMK.exe
  C:\Windows\System\kyhugMK.exe
  2⤵
  PID:3340
- C:\Windows\System\GZjUEQc.exe
  C:\Windows\System\GZjUEQc.exe
  2⤵
  PID:7120
- C:\Windows\System\lBxKnNU.exe
  C:\Windows\System\lBxKnNU.exe
  2⤵
  PID:7572
- C:\Windows\System\QrGVZCm.exe
  C:\Windows\System\QrGVZCm.exe
  2⤵
  PID:2428
- C:\Windows\System\XKOGAQm.exe
  C:\Windows\System\XKOGAQm.exe
  2⤵
  PID:3728
- C:\Windows\System\JQjSTUq.exe
  C:\Windows\System\JQjSTUq.exe
  2⤵
  PID:6444
- C:\Windows\System\qmUlvbA.exe
  C:\Windows\System\qmUlvbA.exe
  2⤵
  PID:5784
- C:\Windows\System\kDbfsQI.exe
  C:\Windows\System\kDbfsQI.exe
  2⤵
  PID:816
- C:\Windows\System\WZseWDe.exe
  C:\Windows\System\WZseWDe.exe
  2⤵
  PID:6900
- C:\Windows\System\YrfxZjZ.exe
  C:\Windows\System\YrfxZjZ.exe
  2⤵
  PID:3752
- C:\Windows\System\MyJunTd.exe
  C:\Windows\System\MyJunTd.exe
  2⤵
  PID:2832
- C:\Windows\System\ciEWFKN.exe
  C:\Windows\System\ciEWFKN.exe
  2⤵
  PID:2412
- C:\Windows\System\CdOsMMP.exe
  C:\Windows\System\CdOsMMP.exe
  2⤵
  PID:7228
- C:\Windows\System\eblwcpZ.exe
  C:\Windows\System\eblwcpZ.exe
  2⤵
  PID:7688
- C:\Windows\System\FquKcDB.exe
  C:\Windows\System\FquKcDB.exe
  2⤵
  PID:7252
- C:\Windows\System\wfxbxzz.exe
  C:\Windows\System\wfxbxzz.exe
  2⤵
  PID:2308
- C:\Windows\System\DJwTVus.exe
  C:\Windows\System\DJwTVus.exe
  2⤵
  PID:7468
- C:\Windows\System\UxUIZyi.exe
  C:\Windows\System\UxUIZyi.exe
  2⤵
  PID:2848
- C:\Windows\System\KBtoBNV.exe
  C:\Windows\System\KBtoBNV.exe
  2⤵
  PID:7568
- C:\Windows\System\LnsOzEB.exe
  C:\Windows\System\LnsOzEB.exe
  2⤵
  PID:12564
- C:\Windows\System\OSmpUeP.exe
  C:\Windows\System\OSmpUeP.exe
  2⤵
  PID:636
- C:\Windows\System\aMEZfVp.exe
  C:\Windows\System\aMEZfVp.exe
  2⤵
  PID:4116
- C:\Windows\System\bAskivP.exe
  C:\Windows\System\bAskivP.exe
  2⤵
  PID:8116
- C:\Windows\System\KqEppVB.exe
  C:\Windows\System\KqEppVB.exe
  2⤵
  PID:8036
- C:\Windows\System\XXkWkwr.exe
  C:\Windows\System\XXkWkwr.exe
  2⤵
  PID:7476
- C:\Windows\System\BdIvkAX.exe
  C:\Windows\System\BdIvkAX.exe
  2⤵
  PID:7704
- C:\Windows\System\oZHzwTf.exe
  C:\Windows\System\oZHzwTf.exe
  2⤵
  PID:8288
- C:\Windows\System\fSYsEGh.exe
  C:\Windows\System\fSYsEGh.exe
  2⤵
  PID:8404
- C:\Windows\System\HbutCZL.exe
  C:\Windows\System\HbutCZL.exe
  2⤵
  PID:8488
- C:\Windows\System\wBBowfS.exe
  C:\Windows\System\wBBowfS.exe
  2⤵
  PID:8564
- C:\Windows\System\XwvlbPb.exe
  C:\Windows\System\XwvlbPb.exe
  2⤵
  PID:8576
- C:\Windows\System\enlBuat.exe
  C:\Windows\System\enlBuat.exe
  2⤵
  PID:8704
- C:\Windows\System\SbQNDKK.exe
  C:\Windows\System\SbQNDKK.exe
  2⤵
  PID:8876
- C:\Windows\System\SRVjvTt.exe
  C:\Windows\System\SRVjvTt.exe
  2⤵
  PID:8828
- C:\Windows\System\KLbgJOP.exe
  C:\Windows\System\KLbgJOP.exe
  2⤵
  PID:8956
- C:\Windows\System\fiATiWC.exe
  C:\Windows\System\fiATiWC.exe
  2⤵
  PID:9112
- C:\Windows\System\zHnxvCe.exe
  C:\Windows\System\zHnxvCe.exe
  2⤵
  PID:9120
- C:\Windows\System\csGXGNQ.exe
  C:\Windows\System\csGXGNQ.exe
  2⤵
  PID:9160
- C:\Windows\System\QtRlZkc.exe
  C:\Windows\System\QtRlZkc.exe
  2⤵
  PID:9176
- C:\Windows\System\bistAmK.exe
  C:\Windows\System\bistAmK.exe
  2⤵
  PID:8352
- C:\Windows\System\LghnrSl.exe
  C:\Windows\System\LghnrSl.exe
  2⤵
  PID:8472
- C:\Windows\System\OkVOHfz.exe
  C:\Windows\System\OkVOHfz.exe
  2⤵
  PID:8520
- C:\Windows\System\HKJDXMn.exe
  C:\Windows\System\HKJDXMn.exe
  2⤵
  PID:8880
- C:\Windows\System\gQryIcl.exe
  C:\Windows\System\gQryIcl.exe
  2⤵
  PID:8912
- C:\Windows\System\ySRsoMW.exe
  C:\Windows\System\ySRsoMW.exe
  2⤵
  PID:9040
- C:\Windows\System\ScFFEeQ.exe
  C:\Windows\System\ScFFEeQ.exe
  2⤵
  PID:7664
- C:\Windows\System\uTEcLFp.exe
  C:\Windows\System\uTEcLFp.exe
  2⤵
  PID:9264
- C:\Windows\System\cLrXyoL.exe
  C:\Windows\System\cLrXyoL.exe
  2⤵
  PID:9324
- C:\Windows\System\KJdQbUj.exe
  C:\Windows\System\KJdQbUj.exe
  2⤵
  PID:9388
- C:\Windows\System\BUbytHI.exe
  C:\Windows\System\BUbytHI.exe
  2⤵
  PID:9424
- C:\Windows\System\crqrIRk.exe
  C:\Windows\System\crqrIRk.exe
  2⤵
  PID:9492
- C:\Windows\System\NPDlWnE.exe
  C:\Windows\System\NPDlWnE.exe
  2⤵
  PID:9540
- C:\Windows\System\DQMYDPM.exe
  C:\Windows\System\DQMYDPM.exe
  2⤵
  PID:9596
- C:\Windows\System\AZgvhsE.exe
  C:\Windows\System\AZgvhsE.exe
  2⤵
  PID:9684
- C:\Windows\System\VBwrITM.exe
  C:\Windows\System\VBwrITM.exe
  2⤵
  PID:9764
- C:\Windows\System\MEHbdll.exe
  C:\Windows\System\MEHbdll.exe
  2⤵
  PID:3440
- C:\Windows\System\qAAkqDn.exe
  C:\Windows\System\qAAkqDn.exe
  2⤵
  PID:12920
- C:\Windows\System\ZhICwxV.exe
  C:\Windows\System\ZhICwxV.exe
  2⤵
  PID:5380
- C:\Windows\System\cAmsRpU.exe
  C:\Windows\System\cAmsRpU.exe
  2⤵
  PID:5696
- C:\Windows\System\mHJNVII.exe
  C:\Windows\System\mHJNVII.exe
  2⤵
  PID:7848
- C:\Windows\System\vDwbqWX.exe
  C:\Windows\System\vDwbqWX.exe
  2⤵
  PID:8268
- C:\Windows\System\HgGgzRi.exe
  C:\Windows\System\HgGgzRi.exe
  2⤵
  PID:8376
- C:\Windows\System\jvYbRFS.exe
  C:\Windows\System\jvYbRFS.exe
  2⤵
  PID:8804
- C:\Windows\System\AmSaloV.exe
  C:\Windows\System\AmSaloV.exe
  2⤵
  PID:9196
- C:\Windows\System\JotcsHL.exe
  C:\Windows\System\JotcsHL.exe
  2⤵
  PID:8888
- C:\Windows\System\wfcOyxY.exe
  C:\Windows\System\wfcOyxY.exe
  2⤵
  PID:9108
- C:\Windows\System\yqPeJeC.exe
  C:\Windows\System\yqPeJeC.exe
  2⤵
  PID:9412
- C:\Windows\System\JkKOwtJ.exe
  C:\Windows\System\JkKOwtJ.exe
  2⤵
  PID:9580
- C:\Windows\System\kxYeFlH.exe
  C:\Windows\System\kxYeFlH.exe
  2⤵
  PID:9840
- C:\Windows\System\hKCCKys.exe
  C:\Windows\System\hKCCKys.exe
  2⤵
  PID:732
- C:\Windows\System\oYXdoxT.exe
  C:\Windows\System\oYXdoxT.exe
  2⤵
  PID:3104
- C:\Windows\System\nEkQMNa.exe
  C:\Windows\System\nEkQMNa.exe
  2⤵
  PID:4972
- C:\Windows\System\LgonqkE.exe
  C:\Windows\System\LgonqkE.exe
  2⤵
  PID:5344
- C:\Windows\System\knaBAhr.exe
  C:\Windows\System\knaBAhr.exe
  2⤵
  PID:5768
- C:\Windows\System\OcktJwp.exe
  C:\Windows\System\OcktJwp.exe
  2⤵
  PID:5640
- C:\Windows\System\jJDSFNF.exe
  C:\Windows\System\jJDSFNF.exe
  2⤵
  PID:5540
- C:\Windows\System\mYpjOmm.exe
  C:\Windows\System\mYpjOmm.exe
  2⤵
  PID:5468
- C:\Windows\System\okFwzcd.exe
  C:\Windows\System\okFwzcd.exe
  2⤵
  PID:4548
- C:\Windows\System\mlVgUcK.exe
  C:\Windows\System\mlVgUcK.exe
  2⤵
  PID:4444
- C:\Windows\System\yzZyYdN.exe
  C:\Windows\System\yzZyYdN.exe
  2⤵
  PID:5224
- C:\Windows\System\TKOICDW.exe
  C:\Windows\System\TKOICDW.exe
  2⤵
  PID:3880
- C:\Windows\System\DgsxbND.exe
  C:\Windows\System\DgsxbND.exe
  2⤵
  PID:5316
- C:\Windows\System\DZmIKCB.exe
  C:\Windows\System\DZmIKCB.exe
  2⤵
  PID:5740
- C:\Windows\System\TENhnzc.exe
  C:\Windows\System\TENhnzc.exe
  2⤵
  PID:5148
- C:\Windows\System\mmGbfkd.exe
  C:\Windows\System\mmGbfkd.exe
  2⤵
  PID:12500
- C:\Windows\System\DinyGXI.exe
  C:\Windows\System\DinyGXI.exe
  2⤵
  PID:5864
- C:\Windows\System\kjEFVyO.exe
  C:\Windows\System\kjEFVyO.exe
  2⤵
  PID:7032
- C:\Windows\System\nIiFefG.exe
  C:\Windows\System\nIiFefG.exe
  2⤵
  PID:676
- C:\Windows\System\uIAcsCE.exe
  C:\Windows\System\uIAcsCE.exe
  2⤵
  PID:4836
- C:\Windows\System\cSBphLa.exe
  C:\Windows\System\cSBphLa.exe
  2⤵
  PID:4344
- C:\Windows\System\eHNXyMx.exe
  C:\Windows\System\eHNXyMx.exe
  2⤵
  PID:7204
- C:\Windows\System\mSFFdhp.exe
  C:\Windows\System\mSFFdhp.exe
  2⤵
  PID:2928
- C:\Windows\System\OpZFufl.exe
  C:\Windows\System\OpZFufl.exe
  2⤵
  PID:7740
- C:\Windows\System\xBQgvhu.exe
  C:\Windows\System\xBQgvhu.exe
  2⤵
  PID:7732
- C:\Windows\System\QJJlDHU.exe
  C:\Windows\System\QJJlDHU.exe
  2⤵
  PID:7808
- C:\Windows\System\rhmgHmr.exe
  C:\Windows\System\rhmgHmr.exe
  2⤵
  PID:4896
- C:\Windows\System\swZjZDC.exe
  C:\Windows\System\swZjZDC.exe
  2⤵
  PID:5928
- C:\Windows\System\AMPoaiR.exe
  C:\Windows\System\AMPoaiR.exe
  2⤵
  PID:6008
- C:\Windows\System\lMtCyIC.exe
  C:\Windows\System\lMtCyIC.exe
  2⤵
  PID:5996
- C:\Windows\System\sxIJNPy.exe
  C:\Windows\System\sxIJNPy.exe
  2⤵
  PID:1496
- C:\Windows\System\eWcTqHS.exe
  C:\Windows\System\eWcTqHS.exe
  2⤵
  PID:6052
- C:\Windows\System\oFrzumb.exe
  C:\Windows\System\oFrzumb.exe
  2⤵
  PID:4956
- C:\Windows\System\jfBylWl.exe
  C:\Windows\System\jfBylWl.exe
  2⤵
  PID:6120
- C:\Windows\System\UzlIQMJ.exe
  C:\Windows\System\UzlIQMJ.exe
  2⤵
  PID:2724
- C:\Windows\System\vDomOcn.exe
  C:\Windows\System\vDomOcn.exe
  2⤵
  PID:8640
- C:\Windows\System\qPygwVh.exe
  C:\Windows\System\qPygwVh.exe
  2⤵
  PID:1184
- C:\Windows\System\ZyADmLZ.exe
  C:\Windows\System\ZyADmLZ.exe
  2⤵
  PID:4084
- C:\Windows\System\RewjqaE.exe
  C:\Windows\System\RewjqaE.exe
  2⤵
  PID:1084
- C:\Windows\System\ueHjftq.exe
  C:\Windows\System\ueHjftq.exe
  2⤵
  PID:664
- C:\Windows\System\qJxAHmg.exe
  C:\Windows\System\qJxAHmg.exe
  2⤵
  PID:1376
- C:\Windows\System\erUtEYv.exe
  C:\Windows\System\erUtEYv.exe
  2⤵
  PID:7404
- C:\Windows\System\yBjbWJi.exe
  C:\Windows\System\yBjbWJi.exe
  2⤵
  PID:5132
- C:\Windows\System\LMYyXEf.exe
  C:\Windows\System\LMYyXEf.exe
  2⤵
  PID:6284
- C:\Windows\System\gZzantO.exe
  C:\Windows\System\gZzantO.exe
  2⤵
  PID:7640
- C:\Windows\System\LfuOUnI.exe
  C:\Windows\System\LfuOUnI.exe
  2⤵
  PID:6948
- C:\Windows\System\JuYnKVQ.exe
  C:\Windows\System\JuYnKVQ.exe
  2⤵
  PID:5244
- C:\Windows\System\VcaUISV.exe
  C:\Windows\System\VcaUISV.exe
  2⤵
  PID:5304
- C:\Windows\System\GXMMBCB.exe
  C:\Windows\System\GXMMBCB.exe
  2⤵
  PID:6392
- C:\Windows\System\kzLPyXG.exe
  C:\Windows\System\kzLPyXG.exe
  2⤵
  PID:5384
- C:\Windows\System\cacCegz.exe
  C:\Windows\System\cacCegz.exe
  2⤵
  PID:7752
- C:\Windows\System\kojCKqw.exe
  C:\Windows\System\kojCKqw.exe
  2⤵
  PID:4552
- C:\Windows\System\eFnqoln.exe
  C:\Windows\System\eFnqoln.exe
  2⤵
  PID:2104
- C:\Windows\System\bIBaUhs.exe
  C:\Windows\System\bIBaUhs.exe
  2⤵
  PID:3020
- C:\Windows\System\DusNdJc.exe
  C:\Windows\System\DusNdJc.exe
  2⤵
  PID:4656
- C:\Windows\System\mCvHDzy.exe
  C:\Windows\System\mCvHDzy.exe
  2⤵
  PID:3464
- C:\Windows\System\nIMvZAP.exe
  C:\Windows\System\nIMvZAP.exe
  2⤵
  PID:7224
- C:\Windows\System\ExaTZPp.exe
  C:\Windows\System\ExaTZPp.exe
  2⤵
  PID:10540
- C:\Windows\System\efQiPIR.exe
  C:\Windows\System\efQiPIR.exe
  2⤵
  PID:8140
- C:\Windows\System\LUMHoYl.exe
  C:\Windows\System\LUMHoYl.exe
  2⤵
  PID:8328
- C:\Windows\System\qEdbCjF.exe
  C:\Windows\System\qEdbCjF.exe
  2⤵
  PID:1624
- C:\Windows\System\znYnmdh.exe
  C:\Windows\System\znYnmdh.exe
  2⤵
  PID:8560
- C:\Windows\System\CoiUXAq.exe
  C:\Windows\System\CoiUXAq.exe
  2⤵
  PID:8712
- C:\Windows\System\IDKySvn.exe
  C:\Windows\System\IDKySvn.exe
  2⤵
  PID:8844
- C:\Windows\System\iyoSnzd.exe
  C:\Windows\System\iyoSnzd.exe
  2⤵
  PID:5896
- C:\Windows\System\pZVYXPX.exe
  C:\Windows\System\pZVYXPX.exe
  2⤵
  PID:8824
- C:\Windows\System\TVYCoMN.exe
  C:\Windows\System\TVYCoMN.exe
  2⤵
  PID:5984
- C:\Windows\System\eUttobK.exe
  C:\Windows\System\eUttobK.exe
  2⤵
  PID:9124
- C:\Windows\System\SixlYLE.exe
  C:\Windows\System\SixlYLE.exe
  2⤵
  PID:5992
- C:\Windows\System\wLoGCqp.exe
  C:\Windows\System\wLoGCqp.exe
  2⤵
  PID:8500
- C:\Windows\System\SuTKZID.exe
  C:\Windows\System\SuTKZID.exe
  2⤵
  PID:8608
- C:\Windows\System\KYrSaZS.exe
  C:\Windows\System\KYrSaZS.exe
  2⤵
  PID:8848
- C:\Windows\System\mmUaWNF.exe
  C:\Windows\System\mmUaWNF.exe
  2⤵
  PID:10940
- C:\Windows\System\aqotaCw.exe
  C:\Windows\System\aqotaCw.exe
  2⤵
  PID:8836
- C:\Windows\System\RAuilab.exe
  C:\Windows\System\RAuilab.exe
  2⤵
  PID:8604
- C:\Windows\System\BcanHno.exe
  C:\Windows\System\BcanHno.exe
  2⤵
  PID:9320
- C:\Windows\System\VDolueW.exe
  C:\Windows\System\VDolueW.exe
  2⤵
  PID:9284
- C:\Windows\System\VVJdikp.exe
  C:\Windows\System\VVJdikp.exe
  2⤵
  PID:9440
- C:\Windows\System\WcabXXF.exe
  C:\Windows\System\WcabXXF.exe
  2⤵
  PID:9524
- C:\Windows\System\GRjpvXJ.exe
  C:\Windows\System\GRjpvXJ.exe
  2⤵
  PID:2356
- C:\Windows\System\hSsgnNM.exe
  C:\Windows\System\hSsgnNM.exe
  2⤵
  PID:9820
- C:\Windows\System\hAdHKyr.exe
  C:\Windows\System\hAdHKyr.exe
  2⤵
  PID:5056
- C:\Windows\System\ZjqOrgE.exe
  C:\Windows\System\ZjqOrgE.exe
  2⤵
  PID:5264
- C:\Windows\System\LpaRvbt.exe
  C:\Windows\System\LpaRvbt.exe
  2⤵
  PID:2092
- C:\Windows\System\GlijXCz.exe
  C:\Windows\System\GlijXCz.exe
  2⤵
  PID:5396
- C:\Windows\System\iOBKzMv.exe
  C:\Windows\System\iOBKzMv.exe
  2⤵
  PID:8372
- C:\Windows\System\lwCrNqc.exe
  C:\Windows\System\lwCrNqc.exe
  2⤵
  PID:4212
- C:\Windows\System\MRFkgGR.exe
  C:\Windows\System\MRFkgGR.exe
  2⤵
  PID:8864
- C:\Windows\System\ACeaour.exe
  C:\Windows\System\ACeaour.exe
  2⤵
  PID:8724
- C:\Windows\System\JpvVTXA.exe
  C:\Windows\System\JpvVTXA.exe
  2⤵
  PID:5532
- C:\Windows\System\FINsaFc.exe
  C:\Windows\System\FINsaFc.exe
  2⤵
  PID:9132
- C:\Windows\System\jWZTlHG.exe
  C:\Windows\System\jWZTlHG.exe
  2⤵
  PID:10620
- C:\Windows\System\FKopvrA.exe
  C:\Windows\System\FKopvrA.exe
  2⤵
  PID:9380
- C:\Windows\System\ZhEOXBx.exe
  C:\Windows\System\ZhEOXBx.exe
  2⤵
  PID:9816
- C:\Windows\System\diYalZd.exe
  C:\Windows\System\diYalZd.exe
  2⤵
  PID:5764
- C:\Windows\System\wHccelt.exe
  C:\Windows\System\wHccelt.exe
  2⤵
  PID:3228
- C:\Windows\System\xjtwFeG.exe
  C:\Windows\System\xjtwFeG.exe
  2⤵
  PID:5428
- C:\Windows\System\xnevSpN.exe
  C:\Windows\System\xnevSpN.exe
  2⤵
  PID:11036
- C:\Windows\System\DUTmPcH.exe
  C:\Windows\System\DUTmPcH.exe
  2⤵
  PID:1152
- C:\Windows\System\oTEzApF.exe
  C:\Windows\System\oTEzApF.exe
  2⤵
  PID:1936
- C:\Windows\System\KxUSuUM.exe
  C:\Windows\System\KxUSuUM.exe
  2⤵
  PID:5580
- C:\Windows\System\MXqdddr.exe
  C:\Windows\System\MXqdddr.exe
  2⤵
  PID:4388
- C:\Windows\System\ODCRiCF.exe
  C:\Windows\System\ODCRiCF.exe
  2⤵
  PID:5488
- C:\Windows\System\FzCyMyw.exe
  C:\Windows\System\FzCyMyw.exe
  2⤵
  PID:12436
- C:\Windows\System\HTDNxQc.exe
  C:\Windows\System\HTDNxQc.exe
  2⤵
  PID:2284
- C:\Windows\System\umfemVu.exe
  C:\Windows\System\umfemVu.exe
  2⤵
  PID:10560
- C:\Windows\System\esmkpxu.exe
  C:\Windows\System\esmkpxu.exe
  2⤵
  PID:5144
- C:\Windows\System\NYVitvb.exe
  C:\Windows\System\NYVitvb.exe
  2⤵
  PID:12428
- C:\Windows\System\yJMubTP.exe
  C:\Windows\System\yJMubTP.exe
  2⤵
  PID:11120
- C:\Windows\System\oYYSrDg.exe
  C:\Windows\System\oYYSrDg.exe
  2⤵
  PID:11244
- C:\Windows\System\UuthnOG.exe
  C:\Windows\System\UuthnOG.exe
  2⤵
  PID:744
- C:\Windows\System\yKQnyhI.exe
  C:\Windows\System\yKQnyhI.exe
  2⤵
  PID:5880
- C:\Windows\System\MMqLwnH.exe
  C:\Windows\System\MMqLwnH.exe
  2⤵
  PID:5924
- C:\Windows\System\erZiSvy.exe
  C:\Windows\System\erZiSvy.exe
  2⤵
  PID:752
- C:\Windows\System\ldnRtmc.exe
  C:\Windows\System\ldnRtmc.exe
  2⤵
  PID:10988
- C:\Windows\System\XhIxdJV.exe
  C:\Windows\System\XhIxdJV.exe
  2⤵
  PID:10256
- C:\Windows\System\JUKykIX.exe
  C:\Windows\System\JUKykIX.exe
  2⤵
  PID:1040
- C:\Windows\System\MhyVrUk.exe
  C:\Windows\System\MhyVrUk.exe
  2⤵
  PID:5908
- C:\Windows\System\LHQczhR.exe
  C:\Windows\System\LHQczhR.exe
  2⤵
  PID:13124
- C:\Windows\System\fTnihgr.exe
  C:\Windows\System\fTnihgr.exe
  2⤵
  PID:3820
- C:\Windows\System\RJwcWbs.exe
  C:\Windows\System\RJwcWbs.exe
  2⤵
  PID:8948
- C:\Windows\System\BisHyOa.exe
  C:\Windows\System\BisHyOa.exe
  2⤵
  PID:1000
- C:\Windows\System\AEhGIfJ.exe
  C:\Windows\System\AEhGIfJ.exe
  2⤵
  PID:5456
- C:\Windows\System\fUwAGrD.exe
  C:\Windows\System\fUwAGrD.exe
  2⤵
  PID:6032
- C:\Windows\System\rnjILRp.exe
  C:\Windows\System\rnjILRp.exe
  2⤵
  PID:5348
- C:\Windows\System\ypiRGzM.exe
  C:\Windows\System\ypiRGzM.exe
  2⤵
  PID:11480
- C:\Windows\System\diepoYi.exe
  C:\Windows\System\diepoYi.exe
  2⤵
  PID:396
- C:\Windows\System\ocxZBZM.exe
  C:\Windows\System\ocxZBZM.exe
  2⤵
  PID:2592
- C:\Windows\System\rNccImn.exe
  C:\Windows\System\rNccImn.exe
  2⤵
  PID:10020
- C:\Windows\System\MMsniLe.exe
  C:\Windows\System\MMsniLe.exe
  2⤵
  PID:6304
- C:\Windows\System\UnCPeFg.exe
  C:\Windows\System\UnCPeFg.exe
  2⤵
  PID:8832
- C:\Windows\System\hgVFRBk.exe
  C:\Windows\System\hgVFRBk.exe
  2⤵
  PID:1180
- C:\Windows\System\HfBVgqj.exe
  C:\Windows\System\HfBVgqj.exe
  2⤵
  PID:11688
- C:\Windows\System\cuTlrIG.exe
  C:\Windows\System\cuTlrIG.exe
  2⤵
  PID:4824
- C:\Windows\System\AOSNnoP.exe
  C:\Windows\System\AOSNnoP.exe
  2⤵
  PID:7980
- C:\Windows\System\cPqIbAh.exe
  C:\Windows\System\cPqIbAh.exe
  2⤵
  PID:1220
- C:\Windows\System\qMRtMpZ.exe
  C:\Windows\System\qMRtMpZ.exe
  2⤵
  PID:6700
- C:\Windows\System\KzjhQtR.exe
  C:\Windows\System\KzjhQtR.exe
  2⤵
  PID:8172
- C:\Windows\System\tZuhKNx.exe
  C:\Windows\System\tZuhKNx.exe
  2⤵
  PID:4528
- C:\Windows\System\sycbUpy.exe
  C:\Windows\System\sycbUpy.exe
  2⤵
  PID:6344
- C:\Windows\System\PAZheiL.exe
  C:\Windows\System\PAZheiL.exe
  2⤵
  PID:6192
- C:\Windows\System\QOuVNmp.exe
  C:\Windows\System\QOuVNmp.exe
  2⤵
  PID:6356
- C:\Windows\System\JyLptXn.exe
  C:\Windows\System\JyLptXn.exe
  2⤵
  PID:11768
- C:\Windows\System\dSzWYbz.exe
  C:\Windows\System\dSzWYbz.exe
  2⤵
  PID:11824
- C:\Windows\System\QKnzYdf.exe
  C:\Windows\System\QKnzYdf.exe
  2⤵
  PID:11832
- C:\Windows\System\osVLcWu.exe
  C:\Windows\System\osVLcWu.exe
  2⤵
  PID:916
- C:\Windows\System\dytUizJ.exe
  C:\Windows\System\dytUizJ.exe
  2⤵
  PID:3476
- C:\Windows\System\VyuLWze.exe
  C:\Windows\System\VyuLWze.exe
  2⤵
  PID:6440
- C:\Windows\System\zPDxqSG.exe
  C:\Windows\System\zPDxqSG.exe
  2⤵
  PID:5508
- C:\Windows\System\nSjWXCV.exe
  C:\Windows\System\nSjWXCV.exe
  2⤵
  PID:12584
- C:\Windows\System\SQsMpjs.exe
  C:\Windows\System\SQsMpjs.exe
  2⤵
  PID:6468
- C:\Windows\System\xQpgGNw.exe
  C:\Windows\System\xQpgGNw.exe
  2⤵
  PID:5700
- C:\Windows\System\IzZONec.exe
  C:\Windows\System\IzZONec.exe
  2⤵
  PID:6512
- C:\Windows\System\WHVYdIP.exe
  C:\Windows\System\WHVYdIP.exe
  2⤵
  PID:7672
- C:\Windows\System\QHqxxHe.exe
  C:\Windows\System\QHqxxHe.exe
  2⤵
  PID:11960
- C:\Windows\System\jobBFqS.exe
  C:\Windows\System\jobBFqS.exe
  2⤵
  PID:7660
- C:\Windows\System\SrWaIPF.exe
  C:\Windows\System\SrWaIPF.exe
  2⤵
  PID:8476
- C:\Windows\System\PAGEjoI.exe
  C:\Windows\System\PAGEjoI.exe
  2⤵
  PID:6552
- C:\Windows\System\gRgvKjZ.exe
  C:\Windows\System\gRgvKjZ.exe
  2⤵
  PID:8908
- C:\Windows\System\hjxJbsJ.exe
  C:\Windows\System\hjxJbsJ.exe
  2⤵
  PID:8960
- C:\Windows\System\cpmDota.exe
  C:\Windows\System\cpmDota.exe
  2⤵
  PID:8972
- C:\Windows\System\CxWkwRX.exe
  C:\Windows\System\CxWkwRX.exe
  2⤵
  PID:12132
- C:\Windows\System\XKQZdbi.exe
  C:\Windows\System\XKQZdbi.exe
  2⤵
  PID:9200
- C:\Windows\System\iIHGpcj.exe
  C:\Windows\System\iIHGpcj.exe
  2⤵
  PID:6608
- C:\Windows\System\xupLmjC.exe
  C:\Windows\System\xupLmjC.exe
  2⤵
  PID:12152
- C:\Windows\System\EMWJriR.exe
  C:\Windows\System\EMWJriR.exe
  2⤵
  PID:12180
- C:\Windows\System\ROLGqmM.exe
  C:\Windows\System\ROLGqmM.exe
  2⤵
  PID:6648
- C:\Windows\System\jwAIVXo.exe
  C:\Windows\System\jwAIVXo.exe
  2⤵
  PID:8384
- C:\Windows\System\yqKLWmD.exe
  C:\Windows\System\yqKLWmD.exe
  2⤵
  PID:12252
- C:\Windows\System\hIuXFSE.exe
  C:\Windows\System\hIuXFSE.exe
  2⤵
  PID:9724
- C:\Windows\System\zkPDcfW.exe
  C:\Windows\System\zkPDcfW.exe
  2⤵
  PID:6708
- C:\Windows\System\wJIWnwP.exe
  C:\Windows\System\wJIWnwP.exe
  2⤵
  PID:9356
- C:\Windows\System\jzAtsWl.exe
  C:\Windows\System\jzAtsWl.exe
  2⤵
  PID:9400
- C:\Windows\System\lpoguyM.exe
  C:\Windows\System\lpoguyM.exe
  2⤵
  PID:6720
- C:\Windows\System\uajLtFe.exe
  C:\Windows\System\uajLtFe.exe
  2⤵
  PID:9728
- C:\Windows\System\juHKCJF.exe
  C:\Windows\System\juHKCJF.exe
  2⤵
  PID:8760
- C:\Windows\System\ATjgmit.exe
  C:\Windows\System\ATjgmit.exe
  2⤵
  PID:10548
- C:\Windows\System\bnYUmss.exe
  C:\Windows\System\bnYUmss.exe
  2⤵
  PID:9288
- C:\Windows\System\HEQzMfC.exe
  C:\Windows\System\HEQzMfC.exe
  2⤵
  PID:9664
- C:\Windows\System\THTySCW.exe
  C:\Windows\System\THTySCW.exe
  2⤵
  PID:5844
- C:\Windows\System\kGJNSBJ.exe
  C:\Windows\System\kGJNSBJ.exe
  2⤵
  PID:2788
- C:\Windows\System\hfNmcBh.exe
  C:\Windows\System\hfNmcBh.exe
  2⤵
  PID:10980
- C:\Windows\System\SjffWzB.exe
  C:\Windows\System\SjffWzB.exe
  2⤵
  PID:11976
- C:\Windows\System\sbzJgFD.exe
  C:\Windows\System\sbzJgFD.exe
  2⤵
  PID:12088
- C:\Windows\System\TvzrugQ.exe
  C:\Windows\System\TvzrugQ.exe
  2⤵
  PID:5664
- C:\Windows\System\wiOytNN.exe
  C:\Windows\System\wiOytNN.exe
  2⤵
  PID:5504
- C:\Windows\System\sdrVgsN.exe
  C:\Windows\System\sdrVgsN.exe
  2⤵
  PID:9936
- C:\Windows\System\vkTSbBF.exe
  C:\Windows\System\vkTSbBF.exe
  2⤵
  PID:6968
- C:\Windows\System\XZQIJVH.exe
  C:\Windows\System\XZQIJVH.exe
  2⤵
  PID:10472
- C:\Windows\System\WEruxHw.exe
  C:\Windows\System\WEruxHw.exe
  2⤵
  PID:5180
- C:\Windows\System\orylRJn.exe
  C:\Windows\System\orylRJn.exe
  2⤵
  PID:4768
- C:\Windows\System\OHDoRsY.exe
  C:\Windows\System\OHDoRsY.exe
  2⤵
  PID:5808
- C:\Windows\System\KCWgcog.exe
  C:\Windows\System\KCWgcog.exe
  2⤵
  PID:2760
- C:\Windows\System\LSOWfnr.exe
  C:\Windows\System\LSOWfnr.exe
  2⤵
  PID:1980
- C:\Windows\System\faqlMGe.exe
  C:\Windows\System\faqlMGe.exe
  2⤵
  PID:7056
- C:\Windows\System\qlqSWij.exe
  C:\Windows\System\qlqSWij.exe
  2⤵
  PID:1912
- C:\Windows\System\gHUMWqP.exe
  C:\Windows\System\gHUMWqP.exe
  2⤵
  PID:7100
- C:\Windows\System\JKbhuwe.exe
  C:\Windows\System\JKbhuwe.exe
  2⤵
  PID:888
- C:\Windows\System\tNasGIR.exe
  C:\Windows\System\tNasGIR.exe
  2⤵
  PID:7128
- C:\Windows\System\WNJmqAm.exe
  C:\Windows\System\WNJmqAm.exe
  2⤵
  PID:4900
- C:\Windows\System\DzkKdDw.exe
  C:\Windows\System\DzkKdDw.exe
  2⤵
  PID:12508
- C:\Windows\System\EyPKYYc.exe
  C:\Windows\System\EyPKYYc.exe
  2⤵
  PID:10148
- C:\Windows\System\OXMgeXH.exe
  C:\Windows\System\OXMgeXH.exe
  2⤵
  PID:3548
- C:\Windows\System\DRYFLCg.exe
  C:\Windows\System\DRYFLCg.exe
  2⤵
  PID:11556
- C:\Windows\System\DTWEQQT.exe
  C:\Windows\System\DTWEQQT.exe
  2⤵
  PID:6064
- C:\Windows\System\gkFJnix.exe
  C:\Windows\System\gkFJnix.exe
  2⤵
  PID:2360
- C:\Windows\System\aqczoUR.exe
  C:\Windows\System\aqczoUR.exe
  2⤵
  PID:12772
- C:\Windows\System\ryUfmDL.exe
  C:\Windows\System\ryUfmDL.exe
  2⤵
  PID:12832
- C:\Windows\System\oLlFDzv.exe
  C:\Windows\System\oLlFDzv.exe
  2⤵
  PID:3732
- C:\Windows\System\nLusrjz.exe
  C:\Windows\System\nLusrjz.exe
  2⤵
  PID:12968
- C:\Windows\System\thNhZdv.exe
  C:\Windows\System\thNhZdv.exe
  2⤵
  PID:6384
- C:\Windows\System\XQQvfJg.exe
  C:\Windows\System\XQQvfJg.exe
  2⤵
  PID:13016
- C:\Windows\System\EshSnDE.exe
  C:\Windows\System\EshSnDE.exe
  2⤵
  PID:6412
- C:\Windows\System\GCjAyOA.exe
  C:\Windows\System\GCjAyOA.exe
  2⤵
  PID:7460
- C:\Windows\System\XAdlSgr.exe
  C:\Windows\System\XAdlSgr.exe
  2⤵
  PID:5564
- C:\Windows\System\FxlDZRc.exe
  C:\Windows\System\FxlDZRc.exe
  2⤵
  PID:7928
- C:\Windows\System\WJybxsF.exe
  C:\Windows\System\WJybxsF.exe
  2⤵
  PID:13172
- C:\Windows\System\lfYAcZj.exe
  C:\Windows\System\lfYAcZj.exe
  2⤵
  PID:6524
- C:\Windows\System\pjmhmMo.exe
  C:\Windows\System\pjmhmMo.exe
  2⤵
  PID:10604
- C:\Windows\System\gDWMMEi.exe
  C:\Windows\System\gDWMMEi.exe
  2⤵
  PID:5932
- C:\Windows\System\VSzCjVw.exe
  C:\Windows\System\VSzCjVw.exe
  2⤵
  PID:6572
- C:\Windows\System\xaKrqOj.exe
  C:\Windows\System\xaKrqOj.exe
  2⤵
  PID:10780
- C:\Windows\System\OIUXQus.exe
  C:\Windows\System\OIUXQus.exe
  2⤵
  PID:5940
- C:\Windows\System\MSxWWTA.exe
  C:\Windows\System\MSxWWTA.exe
  2⤵
  PID:9076
- C:\Windows\System\fwtgRuO.exe
  C:\Windows\System\fwtgRuO.exe
  2⤵
  PID:9272
- C:\Windows\System\THHJcRG.exe
  C:\Windows\System\THHJcRG.exe
  2⤵
  PID:9396
- C:\Windows\System\IBPOeFJ.exe
  C:\Windows\System\IBPOeFJ.exe
  2⤵
  PID:9616
- C:\Windows\System\htMiRqC.exe
  C:\Windows\System\htMiRqC.exe
  2⤵
  PID:12972
- C:\Windows\System\nhmMWDm.exe
  C:\Windows\System\nhmMWDm.exe
  2⤵
  PID:3128
- C:\Windows\System\yjTSMFs.exe
  C:\Windows\System\yjTSMFs.exe
  2⤵
  PID:6884
- C:\Windows\System\XAZPYzp.exe
  C:\Windows\System\XAZPYzp.exe
  2⤵
  PID:6748
- C:\Windows\System\QHzuwVK.exe
  C:\Windows\System\QHzuwVK.exe
  2⤵
  PID:5400
- C:\Windows\System\xVICPdT.exe
  C:\Windows\System\xVICPdT.exe
  2⤵
  PID:5272
- C:\Windows\System\LMuHJLI.exe
  C:\Windows\System\LMuHJLI.exe
  2⤵
  PID:10516
- C:\Windows\System\QUyolcy.exe
  C:\Windows\System\QUyolcy.exe
  2⤵
  PID:5236
- C:\Windows\System\NiFJcZD.exe
  C:\Windows\System\NiFJcZD.exe
  2⤵
  PID:5780
- C:\Windows\System\jMdZWOZ.exe
  C:\Windows\System\jMdZWOZ.exe
  2⤵
  PID:12108
- C:\Windows\System\UjawArc.exe
  C:\Windows\System\UjawArc.exe
  2⤵
  PID:9568
- C:\Windows\System\PogIhYI.exe
  C:\Windows\System\PogIhYI.exe
  2⤵
  PID:10712
- C:\Windows\System\HShhDdE.exe
  C:\Windows\System\HShhDdE.exe
  2⤵
  PID:8256
- C:\Windows\System\haxqfAa.exe
  C:\Windows\System\haxqfAa.exe
  2⤵
  PID:12332
- C:\Windows\System\zIvaQJE.exe
  C:\Windows\System\zIvaQJE.exe
  2⤵
  PID:9624
- C:\Windows\System\mIECqKE.exe
  C:\Windows\System\mIECqKE.exe
  2⤵
  PID:920
- C:\Windows\System\lpUpPKs.exe
  C:\Windows\System\lpUpPKs.exe
  2⤵
  PID:4732
- C:\Windows\System\uiZQhie.exe
  C:\Windows\System\uiZQhie.exe
  2⤵
  PID:1004
- C:\Windows\System\kGWcpVN.exe
  C:\Windows\System\kGWcpVN.exe
  2⤵
  PID:7176
- C:\Windows\System\VKbdeBe.exe
  C:\Windows\System\VKbdeBe.exe
  2⤵
  PID:5588
- C:\Windows\System\UaqQUQM.exe
  C:\Windows\System\UaqQUQM.exe
  2⤵
  PID:11644
- C:\Windows\System\TdvbtHt.exe
  C:\Windows\System\TdvbtHt.exe
  2⤵
  PID:4060
- C:\Windows\System\HcJtwhn.exe
  C:\Windows\System\HcJtwhn.exe
  2⤵
  PID:6160
- C:\Windows\System\BIbBrwZ.exe
  C:\Windows\System\BIbBrwZ.exe
  2⤵
  PID:4832
- C:\Windows\System\BysKkqQ.exe
  C:\Windows\System\BysKkqQ.exe
  2⤵
  PID:11764
- C:\Windows\System\WeOIlhH.exe
  C:\Windows\System\WeOIlhH.exe
  2⤵
  PID:6456
- C:\Windows\System\DneYovX.exe
  C:\Windows\System\DneYovX.exe
  2⤵
  PID:3096
- C:\Windows\System\GfaOwiL.exe
  C:\Windows\System\GfaOwiL.exe
  2⤵
  PID:7584
- C:\Windows\System\cVyfOYl.exe
  C:\Windows\System\cVyfOYl.exe
  2⤵
  PID:13180
- C:\Windows\System\LXyCrZy.exe
  C:\Windows\System\LXyCrZy.exe
  2⤵
  PID:5820
- C:\Windows\System\hvFkdHl.exe
  C:\Windows\System\hvFkdHl.exe
  2⤵
  PID:12328
- C:\Windows\System\yBoghYp.exe
  C:\Windows\System\yBoghYp.exe
  2⤵
  PID:8680
- C:\Windows\System\rTyRydZ.exe
  C:\Windows\System\rTyRydZ.exe
  2⤵
  PID:9612
- C:\Windows\System\zqIDaCy.exe
  C:\Windows\System\zqIDaCy.exe
  2⤵
  PID:12808
- C:\Windows\System\PjePFan.exe
  C:\Windows\System\PjePFan.exe
  2⤵
  PID:6776
- C:\Windows\System\BGhOyuh.exe
  C:\Windows\System\BGhOyuh.exe
  2⤵
  PID:3484
- C:\Windows\System\mmoUdUm.exe
  C:\Windows\System\mmoUdUm.exe
  2⤵
  PID:6888
- C:\Windows\System\ZbxYpMV.exe
  C:\Windows\System\ZbxYpMV.exe
  2⤵
  PID:6800
- C:\Windows\System\ikqGxEI.exe
  C:\Windows\System\ikqGxEI.exe
  2⤵
  PID:1540
- C:\Windows\System\JWkKNER.exe
  C:\Windows\System\JWkKNER.exe
  2⤵
  PID:11444
- C:\Windows\System\hEHcFtO.exe
  C:\Windows\System\hEHcFtO.exe
  2⤵
  PID:6972
- C:\Windows\System\XtejWCA.exe
  C:\Windows\System\XtejWCA.exe
  2⤵
  PID:6996
- C:\Windows\System\NvTMkdR.exe
  C:\Windows\System\NvTMkdR.exe
  2⤵
  PID:9752
- C:\Windows\System\HiCgcFE.exe
  C:\Windows\System\HiCgcFE.exe
  2⤵
  PID:11448
- C:\Windows\System\txEjpIZ.exe
  C:\Windows\System\txEjpIZ.exe
  2⤵
  PID:12516
- C:\Windows\System\yEEbScX.exe
  C:\Windows\System\yEEbScX.exe
  2⤵
  PID:4608
- C:\Windows\System\RAPUABn.exe
  C:\Windows\System\RAPUABn.exe
  2⤵
  PID:5108
- C:\Windows\System\LmETuKJ.exe
  C:\Windows\System\LmETuKJ.exe
  2⤵
  PID:5188
- C:\Windows\System\fXUAoCN.exe
  C:\Windows\System\fXUAoCN.exe
  2⤵
  PID:11876
- C:\Windows\System\PvCuwMf.exe
  C:\Windows\System\PvCuwMf.exe
  2⤵
  PID:6484
- C:\Windows\System\BeynlmO.exe
  C:\Windows\System\BeynlmO.exe
  2⤵
  PID:5500
- C:\Windows\System\nSbRcPD.exe
  C:\Windows\System\nSbRcPD.exe
  2⤵
  PID:6564
- C:\Windows\System\tWkZmWH.exe
  C:\Windows\System\tWkZmWH.exe
  2⤵
  PID:6736
- C:\Windows\System\cIOCUNW.exe
  C:\Windows\System\cIOCUNW.exe
  2⤵
  PID:10636
- C:\Windows\System\PbCOMzF.exe
  C:\Windows\System\PbCOMzF.exe
  2⤵
  PID:13028
- C:\Windows\System\uAzyXny.exe
  C:\Windows\System\uAzyXny.exe
  2⤵
  PID:5448
- C:\Windows\System\GXMlKIe.exe
  C:\Windows\System\GXMlKIe.exe
  2⤵
  PID:13136
- C:\Windows\System\kYdOLLt.exe
  C:\Windows\System\kYdOLLt.exe
  2⤵
  PID:5568
- C:\Windows\System\pioEYuT.exe
  C:\Windows\System\pioEYuT.exe
  2⤵
  PID:3196
- C:\Windows\System\MhVMAiF.exe
  C:\Windows\System\MhVMAiF.exe
  2⤵
  PID:5904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0k2vdfoa.52o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CYHXtYt.exe

Filesize
1.5MB

MD5
9a90b44f7d31e643330f2fc5e6a2709c

SHA1
d4357885f919efc32d13b598a5142f991d4a8958

SHA256
c4ad3653c2ff6d04500fdcb687d1106adcd1ee5a10ffb85fd53b098d33a26803

SHA512
99f69a4841bd317ba7851cd0e101571fd69bb470428c7ed0294d83d42029f4d88ed8ecc5f35382e44ba33972726237e19f66f8fc19956ebd64991c1849725d49

Download Submit
C:\Windows\System\DCVyZqZ.exe

Filesize
1.4MB

MD5
e0680762fcbac64de4a11a82bb96c336

SHA1
6ae145748adb1f117f0fe5641449e69dc4080280

SHA256
4b1856051a778ded9944b5260a1651bf631e3ad440d99e0d06f8467849a3d320

SHA512
7ce699fe17b752d4129923ef1d9a11e373f097107f69e9f4dae0522705ca320beb870dcdc271d902271cf4a74bc604ccd6530a7ee2d21067cd9d072f96261b74

Download Submit
C:\Windows\System\GOMrJJH.exe

Filesize
1.4MB

MD5
dd46d80cc35b27331fe671095a96d589

SHA1
664c1efe0430f7715b348f27b1cc248b95afcab4

SHA256
39fe9debc61a3da82db6831adf6f0e318cfff8db3b9320082e617dfa8f9a42f3

SHA512
733678aca416798a1f7384c8bdf513a6a6e95c32e75cd16014f592574bcdd24863b3128e0db70abe92617a0d79c2aeb0e53c8355528c3f04449c608789eb1db2

Download Submit
C:\Windows\System\IMJhsPC.exe

Filesize
1.4MB

MD5
8b5e5c2106a0c9a0c8dea7d3e7086594

SHA1
31b95fee9ad9cf48d1af83e49d72490c9588025d

SHA256
2179593ad39272f3e68fb9ecca12c05f74ed972e9de94bb58107f2d9e949346c

SHA512
8646f14abe238b965f21a72b33a159229b2129a8c1761003d869a0cab50c725baa28a11e354733a9a79209e8517f5d422b76d1ebc5b88be61f20273dbffd3ebb

Download Submit
C:\Windows\System\KcgKhiR.exe

Filesize
1.4MB

MD5
9276b2fb7e40be7be3633217d038ecf0

SHA1
ac3ca080d4901b18529c340fa8eba906ce3ee800

SHA256
8364a07b331310a6b25b8a6a9a14b1766f23af88063d175d0a7155a59139bdbf

SHA512
7f9d7490cb62cf50f73ef6077aa9b409980d3805180e19f3374b65b2ad5b55954331c29f982b76dbaeb599e08fbe0c5a488b3e3ff7c16d36edd0b46dae3b110b

Download Submit
C:\Windows\System\MEiLdHk.exe

Filesize
1.4MB

MD5
13dda1d79124717e57672cb44dfd2c24

SHA1
c54c1b8f9f34a8591d2f2796b56a34dbaf1b52a6

SHA256
203ec9ff1fe8d8b6a48d7853a74e8f94e2a2c53c921ab0f60615b29fe9b9494f

SHA512
345b3341076f8714cbd8e8a7444091eb9f64f734b09f2d83a2052131666555cf561b3402146a6f9c66fd9eacfbfc074370a92c4050ed056a84572011c5923598

Download Submit
C:\Windows\System\NiTMdEL.exe

Filesize
1.5MB

MD5
c0354aaadcfd754a421878462201f4c8

SHA1
1743376e5f57a4f19e6d6e91c0fd8c3251554c0a

SHA256
018b35fc9a5bd9662fc00f83f0736c5a03b46283062ae110b0e981debf513a40

SHA512
b04f64003a98c2c931ab5500375d9310fa40e748078f64b1a66fd4ac3db0e99e58b68de2cca76147ded903133339e2dde45500411a81fa2af5033036917c56f5

Download Submit
C:\Windows\System\PPGNKOd.exe

Filesize
1.4MB

MD5
aa1eba89ab3e194dfe4f2f888bb02c24

SHA1
f2111a7f9b0fa06bdef03010f0ae2fe327bbd57a

SHA256
d63ee61bb12a8972f6fee315f083abd631e8fc37a89c1dc05d8fd2e5068f87eb

SHA512
84ffdd582c9d9f00df0a555e40328b2b6d97eae875650f501c31a89155d9c43f84ad5d8baa7489ada3407e4cdb31be10411a50fe8cd20812fd39adbe50faee0d

Download Submit
C:\Windows\System\QLzYWgu.exe

Filesize
1.4MB

MD5
0062126b204cd5da09d2cecf856c490d

SHA1
553470e6931e3551c5e12688c31a8db2967e867b

SHA256
e9fe8d773b9e1762d118da3135e43c630d1b13fd2d41918a6e24f624aa798063

SHA512
6826b05860493c1e21760c33ce2500770bbee3cb959c1a1780f0df8482456e9a193b8831ac105c87863c393b4dd380d63d78d6e46bf4abb3ade1af5371b6a00d

Download Submit
C:\Windows\System\UYEMFlX.exe

Filesize
1.4MB

MD5
d54470e0b561ad42fe56cf2ef627c852

SHA1
531044a08180547ed160d96e047fe9298600c67a

SHA256
c8091db67a1dee1aec487ef8e2b1bc9ef44ca0e7104fdf580323c79d8333ffca

SHA512
88d9b3c9bbb8776ade77beffa12c28727bd1371da1343557e98219fb945763a42950129b7bf70985aeb1b23a8721c01cd09921e93ec75fc1599910de8c7f7172

Download Submit
C:\Windows\System\YiGESLN.exe

Filesize
1.4MB

MD5
074b3f6a9ba4b6f4af6e263139f56309

SHA1
9daa45628f32f978f5b9ea6cbce53444d747bdfa

SHA256
12c1d6cbc84cc98edb452672bf927ecae3d5157b021db9e44c3456d5327df894

SHA512
ba4df8cb5b5b39005387f5ad3507da4d1c47652491193385604fd3bc211378c571dd51983059c8caa77f86edb46caf7d47546d39efac827a8d85d17c1152095d

Download Submit
C:\Windows\System\ZAVqERY.exe

Filesize
1.4MB

MD5
b646bf876498f8f4af3a3dc3c1cbed81

SHA1
ef6a3fa109490346beac518edd3c201adce797ec

SHA256
077d1be62df0da04d67fbc5f6832ba7a56f284da19004414b061a69af7c1ade4

SHA512
c77e0a9f07d861ada8cea28a7c2b26a943ba7d0dc384cccf363566ab8a3279b56f8c113e8d84996f6fdd3634feb02ee245143d85ced76b6ed1153f711fb14e05

Download Submit
C:\Windows\System\ZMCMhaY.exe

Filesize
1.4MB

MD5
41165f862b6ef423821251de34faab92

SHA1
47b0dd10b4d38d41bcd9b4cbde0aa701ff0afeed

SHA256
255cd1356834821dddf6d1cbedefb7d910a5d82c94c4a2f2065e076b5b1e1db1

SHA512
2d4e5c8a2918938658348ba6bd5bb766734c5c70a4b1f21197f07cfb0a2d7fed25152dc2a43f8e9947dc883588b4b8e70abd69ed7f18e08383df341ae1f2ae1c

Download Submit
C:\Windows\System\agAuFan.exe

Filesize
1.4MB

MD5
2f6dce253753948992d6ee27de88a03f

SHA1
0b33fa9a5e25e738d2e7220d16cb9a31015ace9f

SHA256
8fa507e63e64df04c15d5929db1fdfe77ce3d677ba33ee53dfc1cfacd6ac36db

SHA512
69f2c231c5dd14f5f52a604307745b87cc1ecb379ce85a0d3163c22822042dfd992850ec2fb6d3db88ea7a8b974f1c530ffa49a4397d665652b69cb4f1563085

Download Submit
C:\Windows\System\bLtKlJF.exe

Filesize
1.4MB

MD5
af49d0b6917a14c1eabdfb0ea5c9bbfc

SHA1
ddf147ee6b6975ef5aac1e040866c2140c6713e5

SHA256
2ee38fc197ff1bef6c4b73fddfc7d360df9a0f49e234cd4bf981cd44a9bf9552

SHA512
e726471069de13cb41ed7dd9173891ca89352a420d6fed00a62ee67aab4f02389817a28d8d2cc5c69aae5ee59ed542b0905a14bcc604c9490ddf58ba76c202ce

Download Submit
C:\Windows\System\bXWESVx.exe

Filesize
1.4MB

MD5
342cfd724b657268db24698eef3b6d5a

SHA1
b3c8220b3a782a12881b4effb13e53b6f3bc69ad

SHA256
b9c1427858e3cacf2cdae82f97bddff7242942316c6f50e2aa289fb116436b63

SHA512
0376a0694e7839aae2a4408ec5052fbcd3a2d91dd731b69f9b5cb860a11a826b9acd09e4fb41a6629003068f1398bb3d867fb8de3eacc766267debe806a471ec

Download Submit
C:\Windows\System\cPvUxiB.exe

Filesize
1.4MB

MD5
895d8789ad995f3670544eb517bfc65d

SHA1
eaef85b4803d461f2265f6444961229dd230a0f2

SHA256
c8273bc6c0dd3fb50c979785aca2557bc13c7dc2f87769e80112a81feb8527ae

SHA512
b51c3882aa44df447807fe8f66788088297b59cfda47c0a06b27824cf74a4f4f63cf490110cbdab6e74d37932d92ada239f962088880bc7117bd8bd5c5df7d8f

Download Submit
C:\Windows\System\cqIvOAD.exe

Filesize
1.5MB

MD5
8fb68c10d07ad78c87d6f28bf7f4ede4

SHA1
875024fc6e2d3500b5fe94a7ce837a4cb0a1ba2b

SHA256
90745d131aff32d222d05382be09d0b7722628eb9c47bc65019d4f11392d0ef1

SHA512
efefef1afcf116e450f40eeab6ebb04fc8ea724db8722c6cda0c36dcf91f5a627ea43c963ddf06e29ee074c6d79d795cb01e6f3f049b404c90e215424fea30ae

Download Submit
C:\Windows\System\foSiSRC.exe

Filesize
1.5MB

MD5
90a2ac199673b2dea6c0c5c6e813733e

SHA1
2093302d6916665c80dbc7c5d321f82a8a3c1a69

SHA256
6bf185065119e1bfe9f2110b83a70f7df7dfa13ec0acadb4db9f9e15de569b7e

SHA512
7069ecfae376ea1063c62ba017dcb8685f4f58d4b344c2360145619879f14eaee6d8b0363793ccf0a4f52cc9e360f200891cfd4bd6e206cb04bb15ffe0853cd2

Download Submit
C:\Windows\System\iLxgewL.exe

Filesize
8B

MD5
438c415b84fb7ccafacc0a09f9db21bf

SHA1
0ba291a82409b85280b72cddaa9a85efe1969946

SHA256
812617365870397d66346db9fc004e4a257242df5d09daa94af1b52721a02313

SHA512
a9403a83564f7907c4d75484a8b1a884211042f12bc9fb2ecf8f22f3cf830d9c62c0ef5603b990f366d0e7e69b7ae21ca24191731027b79845e0db0cf1e961ec

Download Submit
C:\Windows\System\iZpMEdv.exe

Filesize
1.4MB

MD5
bac64d92fef763bc62832b5e6ab1e452

SHA1
a0e1f89441e1ad3ac046a5d7869bd440d9f8b98b

SHA256
3adb09a0304572843d7401ce5efe081f843db280437d35272e41f881da2d8f53

SHA512
a220cd2c775ff1b69ac5fb31c402f1162b066e86f65e902063fe2dc1f00c740fe2b606d9304aec31c35788aadbc4e02607ee381199d44c27f8625a69f7906e27

Download Submit
C:\Windows\System\iqMGfeH.exe

Filesize
1.4MB

MD5
83c7cde2801fd837e276420c61dbe485

SHA1
7cb8a00ab7b0151ffb68c636cf097f660d90a565

SHA256
50251ae26d8247c435c3d238fc0a9d388b8c1e90117123c49216d676af1f21b1

SHA512
49ed97d33ea6265eea840e26539d4d806bbfacaca09f242a9f254c4d141a2cb821924cc42b20b5dbf5bf42d4b9d83e1b0855ba9b5a072332928aa4ae53755a8e

Download Submit
C:\Windows\System\jClqiRE.exe

Filesize
1.4MB

MD5
c5806516f489ea9d2f36e8fa3a69d44b

SHA1
b23e7a10c9bf525f23e9b31d90d632c293f116cb

SHA256
b217f8d47c1a2131f8284a7e4cb21bdad4ffecf80ef8d18bd284596a9bbec0d7

SHA512
c67bdb733b84dc6d48155df91a665f198e92faa1e644986f205f9232c58b632636d72143d4a2d405f94a8eb1b961c81f415ae36309bb3dc2d78eda0a634100c5

Download Submit
C:\Windows\System\kGgUHQT.exe

Filesize
1.4MB

MD5
84f554d57e0e6ddca5a90d0be150870a

SHA1
68cbd8c4a22aff993aa8668c5d0fe8ad881c1be4

SHA256
7354d9702c637fb90c0f43d0b13d091762096f9d3cd8a743815e0a8ed230aa7e

SHA512
a1b64b8301da9785e3b61fcd968ce4ea9ec1c5cde977b9679bed69c658a9952fc5c0d64d18c0c9836cc3f19fcbc475c28a05d26ead6da294417732302a6cf90f

Download Submit
C:\Windows\System\kzlxceo.exe

Filesize
1.4MB

MD5
1c5de2108058621ce1939de7b9bc0994

SHA1
5bef5ae34e6bb3f01e2c257925f35870105c2d33

SHA256
990ca90f092fce9a8cf5ea04c85ffaa315e7be907913dafbd28201cba864ebb9

SHA512
1e78e4e16f8ab0415b982cbdeea710a509342ddd818cc2b0912c7248f31301841612db778c6a0e961f3c96f1136a2d834c70225cbd9037ff845363a7d13f4b6d

Download Submit
C:\Windows\System\oRipqmX.exe

Filesize
1.4MB

MD5
0e8416e35b52938cfee297468a83beef

SHA1
7e2332a45f3b330c21b19eb5fac132967b71ae75

SHA256
4186564f101b3ea71efc7b517598c52b4a02c8d27783d234c2abcdaf61d4093c

SHA512
3827b3cc5c8a0229e8e2bc49dc994fbdeb0049935336131cae5162688fe0e93d7512927e26fa87ecdf4dd735cfa98ccea50d065de9a8f3cbc0f2a0e5676f9d12

Download Submit
C:\Windows\System\pMMFdoz.exe

Filesize
1.4MB

MD5
71afa44ba1d14c6eba5fb6d646e0c84d

SHA1
e692d23e7bba5bd5a5d98f7632f448dc1a13f382

SHA256
e0af477d4475a33d0d3505d5a5818122f2edfaf146669f6cb3f062f5def0c2d8

SHA512
ab2e59aa314cbcbfda2f8ecc1a23ff66cef7b99cda8f6ba5af0142e4f0a0d543fd05f0e926b533b9cb3f92602eaea047615f6ab65a758d9df01353ecd7edb1ee

Download Submit
C:\Windows\System\pOBuLyd.exe

Filesize
1.4MB

MD5
089c7afc38a76259686b1a8910dee38e

SHA1
0a9d09dfafd3566384d2e9682a2f48300d176497

SHA256
eb17c8f7e1630e19ec5ff3750d485aa617276c028f395fe94248559bad1ca601

SHA512
245eebd28c1f31f6f34d55716f7b24843fa4ef55af3965c75a37cff926ff6ea65a29c3c54c09fa2dfc8cc611f14ec8f756915170718db937f3ae02a8a27365c1

Download Submit
C:\Windows\System\qQHtOYV.exe

Filesize
1.4MB

MD5
e2c5319ab346a67a5afa4310acfd5aaf

SHA1
a83c88092f1620396344595ead5137e081e864c6

SHA256
ba8b169aececc401a5ded5389dfdbc28c0a9744179f74e741a56aee5c2562227

SHA512
cf3a4d597c4da8e0b60e1f18775d74ba1ffbc29e8870245dda3a88dcf08ccfb528e520fd3be414c98dce4b35728aecf145dc4ddae15ff6527266f6dbe6d4f4f0

Download Submit
C:\Windows\System\uLNUOvm.exe

Filesize
1.4MB

MD5
5e7c04d9415f42aa679dc724d9a0d5bd

SHA1
28b88873cf03fb96b855e9ac8e5250f03c45e5a2

SHA256
87ddb0a3dbe3601c1a3d32478b367749091429eaa61c2e4d402d859520a6ae2d

SHA512
9b32d6b4cbd78ee82eabf91c57302ed6d97427bb33e2f80973c8435b9d7154273f61905c434016ca22e3f70474a3bc258512b3cb136c241b9e31c30c0bee873c

Download Submit
C:\Windows\System\vBtXysY.exe

Filesize
1.5MB

MD5
7cd61ac4e18b069270e44db2b4312a69

SHA1
9af2adfaa9781f4ddcba61027aee890a02d9de16

SHA256
7acd14e5955db54adcf27451f065b4146937d0c1706ab449b97b7692e5582d65

SHA512
d5842df2792b6e20b879f23135ec3cb1c982de4f5dcffeb9a498a3f39b63e86a95ae4cfc0366e336d0a86d9782207299bbcfaca32461fb659af58f33c56babf4

Download Submit
C:\Windows\System\xCZHgCS.exe

Filesize
1.4MB

MD5
0d58abe217e71629f652738d02cb4252

SHA1
3e679a8ff2d4dddf98e3dc33be2d60645dd277fb

SHA256
1ee3ef449e2e438a1403f39a6a230caae0281524a8833a3ae8f30e66f753c04a

SHA512
e7557e0a01a361195ad3db525c8ede5495e60654cdabdbfcad9818b46c41b38ed6ecabcb73e8d831fbaba7e94655a22636712a76bd845ecbf065c30630fde6e2

Download Submit
C:\Windows\System\zskHNUp.exe

Filesize
1.4MB

MD5
5aef86a935c039ea6d4548bba5a2a9a6

SHA1
7682ba0ac0b0fc85ef9de8dc91d1e0c146c00dbb

SHA256
c5275489bb28b22a0edda19528f637fe55ba0a8adca5af629f1d9d203db1f6db

SHA512
ef08b72d7959d154846e8ce485c0cebb84f36ca2e4a2f3c6c9d31ad4665236abc6b5be3bd8b2fa286e7b1aebf9cb7d2f2bbc5a06d0ba54f1860b86b82d3ca95c

Download Submit
C:\Windows\System\zuILCqp.exe

Filesize
1.4MB

MD5
40d88aa2ff5962ea133391d051dc0dcd

SHA1
99cfdf0229cc3916cf1f0270b401ebc6020d09c7

SHA256
8ba7273333d1e1a4792bfec046cf4dc93adb46d3bc644f1970dc42f081b959e2

SHA512
c397238e9463a3cb797a03bca69b4b0a278f5250f161e671e184522550c2c323252acb9f537135c4f2c173b247bec628adf4de658125c29e0f6d2397c0802032

Download Submit
memory/336-2813-0x00007FF7BB9F0000-0x00007FF7BBDE2000-memory.dmp

Filesize
3.9MB

Download
memory/336-73-0x00007FF7BB9F0000-0x00007FF7BBDE2000-memory.dmp

Filesize
3.9MB

Download
memory/508-0-0x00007FF680400000-0x00007FF6807F2000-memory.dmp

Filesize
3.9MB

Download
memory/508-180-0x00007FF680400000-0x00007FF6807F2000-memory.dmp

Filesize
3.9MB

Download
memory/508-1-0x000001B1585D0000-0x000001B1585E0000-memory.dmp

Filesize
64KB

Download
memory/1080-105-0x00007FF63ED50000-0x00007FF63F142000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2857-0x00007FF63ED50000-0x00007FF63F142000-memory.dmp

Filesize
3.9MB

Download
memory/1488-187-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-2799-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp

Filesize
3.9MB

Download
memory/1488-9-0x00007FF671CD0000-0x00007FF6720C2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2821-0x00007FF6E83F0000-0x00007FF6E87E2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-47-0x00007FF6E83F0000-0x00007FF6E87E2000-memory.dmp

Filesize
3.9MB

Download
memory/1668-2869-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp

Filesize
3.9MB

Download
memory/1668-2720-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp

Filesize
3.9MB

Download
memory/1668-111-0x00007FF7BA740000-0x00007FF7BAB32000-memory.dmp

Filesize
3.9MB

Download
memory/1820-2881-0x00007FF72F5A0000-0x00007FF72F992000-memory.dmp

Filesize
3.9MB

Download
memory/1820-174-0x00007FF72F5A0000-0x00007FF72F992000-memory.dmp

Filesize
3.9MB

Download
memory/1840-2893-0x00007FF604AE0000-0x00007FF604ED2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-181-0x00007FF604AE0000-0x00007FF604ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2865-0x00007FF744820000-0x00007FF744C12000-memory.dmp

Filesize
3.9MB

Download
memory/2176-123-0x00007FF744820000-0x00007FF744C12000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2734-0x00007FF744820000-0x00007FF744C12000-memory.dmp

Filesize
3.9MB

Download
memory/2388-36-0x00007FF69E020000-0x00007FF69E412000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2810-0x00007FF69E020000-0x00007FF69E412000-memory.dmp

Filesize
3.9MB

Download
memory/2536-140-0x00007FF762090000-0x00007FF762482000-memory.dmp

Filesize
3.9MB

Download
memory/2536-2860-0x00007FF762090000-0x00007FF762482000-memory.dmp

Filesize
3.9MB

Download
memory/3000-146-0x00007FF7733B0000-0x00007FF7737A2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-2873-0x00007FF7733B0000-0x00007FF7737A2000-memory.dmp

Filesize
3.9MB

Download
memory/3148-63-0x00007FF783110000-0x00007FF783502000-memory.dmp

Filesize
3.9MB

Download
memory/3148-2819-0x00007FF783110000-0x00007FF783502000-memory.dmp

Filesize
3.9MB

Download
memory/3148-1988-0x00007FF783110000-0x00007FF783502000-memory.dmp

Filesize
3.9MB

Download
memory/3204-2875-0x00007FF682470000-0x00007FF682862000-memory.dmp

Filesize
3.9MB

Download
memory/3204-163-0x00007FF682470000-0x00007FF682862000-memory.dmp

Filesize
3.9MB

Download
memory/3336-93-0x00007FF7B8610000-0x00007FF7B8A02000-memory.dmp

Filesize
3.9MB

Download
memory/3336-2847-0x00007FF7B8610000-0x00007FF7B8A02000-memory.dmp

Filesize
3.9MB

Download
memory/3432-117-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2867-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3432-2733-0x00007FF6996B0000-0x00007FF699AA2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-2801-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp

Filesize
3.9MB

Download
memory/3596-30-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp

Filesize
3.9MB

Download
memory/3748-2487-0x00007FF733690000-0x00007FF733A82000-memory.dmp

Filesize
3.9MB

Download
memory/3748-2859-0x00007FF733690000-0x00007FF733A82000-memory.dmp

Filesize
3.9MB

Download
memory/3748-99-0x00007FF733690000-0x00007FF733A82000-memory.dmp

Filesize
3.9MB

Download
memory/4020-1968-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

Filesize
8KB

Download
memory/4020-12-0x000001768A8A0000-0x000001768A8B0000-memory.dmp

Filesize
64KB

Download
memory/4020-16-0x000001768A8A0000-0x000001768A8B0000-memory.dmp

Filesize
64KB

Download
memory/4020-17-0x00007FFB82733000-0x00007FFB82735000-memory.dmp

Filesize
8KB

Download
memory/4020-457-0x00000176A3820000-0x00000176A3FC6000-memory.dmp

Filesize
7.6MB

Download
memory/4020-64-0x000001768A840000-0x000001768A862000-memory.dmp

Filesize
136KB

Download
memory/4512-129-0x00007FF70C850000-0x00007FF70CC42000-memory.dmp

Filesize
3.9MB

Download
memory/4512-2863-0x00007FF70C850000-0x00007FF70CC42000-memory.dmp

Filesize
3.9MB

Download
memory/4580-83-0x00007FF790C00000-0x00007FF790FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-2831-0x00007FF790C00000-0x00007FF790FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-2794-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp

Filesize
3.9MB

Download
memory/4588-14-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp

Filesize
3.9MB

Download
memory/4588-1332-0x00007FF74DC60000-0x00007FF74E052000-memory.dmp

Filesize
3.9MB

Download
memory/4652-89-0x00007FF79A010000-0x00007FF79A402000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2839-0x00007FF79A010000-0x00007FF79A402000-memory.dmp

Filesize
3.9MB

Download
memory/4828-75-0x00007FF718860000-0x00007FF718C52000-memory.dmp

Filesize
3.9MB

Download
memory/4828-2827-0x00007FF718860000-0x00007FF718C52000-memory.dmp

Filesize
3.9MB

Download
memory/4892-78-0x00007FF748CA0000-0x00007FF749092000-memory.dmp

Filesize
3.9MB

Download
memory/4892-3714-0x00007FF748CA0000-0x00007FF749092000-memory.dmp

Filesize
3.9MB

Download
memory/4928-2871-0x00007FF756FC0000-0x00007FF7573B2000-memory.dmp

Filesize
3.9MB

Download
memory/4928-157-0x00007FF756FC0000-0x00007FF7573B2000-memory.dmp

Filesize
3.9MB

Download