xmrig | 22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
Size

1.6MB
MD5

125fdcf7dde1e7883c0e5de203570d70
SHA1

856ffb745e5498f873729be97dae4b67decf8f48
SHA256

22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497
SHA512

cae5bbd4c692a317c39a54c8d6acfea52850b9e15d7a855a1f3e4410aa706dac3e3d42219f9e3ac5258a5667ec6feb00e809a7d370860457653bf0e74a15ae36
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkiptb8q33F1QeQthKJAc+StNfNuUv6asC22iym:Lz071uv4BPMkivwSbaMrf2J

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/3488-29-0x00007FF7581E0000-0x00007FF7585D2000-memory.dmp	xmrig
behavioral2/memory/3004-419-0x00007FF65B780000-0x00007FF65BB72000-memory.dmp	xmrig
behavioral2/memory/2092-420-0x00007FF748E60000-0x00007FF749252000-memory.dmp	xmrig
behavioral2/memory/1016-421-0x00007FF7FBA70000-0x00007FF7FBE62000-memory.dmp	xmrig
behavioral2/memory/4072-423-0x00007FF693DA0000-0x00007FF694192000-memory.dmp	xmrig
behavioral2/memory/428-424-0x00007FF60ACF0000-0x00007FF60B0E2000-memory.dmp	xmrig
behavioral2/memory/4704-422-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp	xmrig
behavioral2/memory/1480-428-0x00007FF6BBBB0000-0x00007FF6BBFA2000-memory.dmp	xmrig
behavioral2/memory/2132-434-0x00007FF6995F0000-0x00007FF6999E2000-memory.dmp	xmrig
behavioral2/memory/1984-436-0x00007FF611810000-0x00007FF611C02000-memory.dmp	xmrig
behavioral2/memory/3104-437-0x00007FF7E1C50000-0x00007FF7E2042000-memory.dmp	xmrig
behavioral2/memory/1028-440-0x00007FF71F0C0000-0x00007FF71F4B2000-memory.dmp	xmrig
behavioral2/memory/4528-444-0x00007FF643610000-0x00007FF643A02000-memory.dmp	xmrig
behavioral2/memory/720-445-0x00007FF63F300000-0x00007FF63F6F2000-memory.dmp	xmrig
behavioral2/memory/1484-443-0x00007FF62BA00000-0x00007FF62BDF2000-memory.dmp	xmrig
behavioral2/memory/1388-435-0x00007FF652720000-0x00007FF652B12000-memory.dmp	xmrig
behavioral2/memory/2540-1249-0x00007FF6520E0000-0x00007FF6524D2000-memory.dmp	xmrig
behavioral2/memory/1624-1247-0x00007FF78B3B0000-0x00007FF78B7A2000-memory.dmp	xmrig
behavioral2/memory/2164-5247-0x00007FF7F1EC0000-0x00007FF7F22B2000-memory.dmp	xmrig
behavioral2/memory/1100-6121-0x00007FF712D80000-0x00007FF713172000-memory.dmp	xmrig
behavioral2/memory/2092-7565-0x00007FF748E60000-0x00007FF749252000-memory.dmp	xmrig
behavioral2/memory/428-7589-0x00007FF60ACF0000-0x00007FF60B0E2000-memory.dmp	xmrig
behavioral2/memory/1028-7663-0x00007FF71F0C0000-0x00007FF71F4B2000-memory.dmp	xmrig
behavioral2/memory/1484-7683-0x00007FF62BA00000-0x00007FF62BDF2000-memory.dmp	xmrig
behavioral2/memory/4528-7703-0x00007FF643610000-0x00007FF643A02000-memory.dmp	xmrig
behavioral2/memory/1100-8002-0x00007FF712D80000-0x00007FF713172000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3912	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2540	KCCmWHK.exe
2544	gTwlTTw.exe
3488	telNhFH.exe
4312	FQVAFLU.exe
3112	zcOfguH.exe
4884	Srodqgv.exe
2164	ZVKFkms.exe
1100	PKZjoXz.exe
4576	jBpgDlR.exe
3004	yNdRttQ.exe
2092	KobkNXt.exe
1016	eZtGKvn.exe
4704	fOlMnnl.exe
4072	jqBLmbw.exe
428	VPSFKaT.exe
1480	dMOjdns.exe
2132	OYoilyj.exe
1388	sQVzuSX.exe
1984	fCUnoth.exe
3104	aFIUwVA.exe
1028	TxclZSK.exe
1484	XIiCmzq.exe
4528	ReDmlIQ.exe
720	EHWqTOa.exe
3644	XYqxEEM.exe
1552	EbkbWQr.exe
5036	neSVIXu.exe
2716	SwmLJYL.exe
4572	AMYXAmP.exe
2600	eaMPDSh.exe
2932	KXwGqfN.exe
4076	JsYZNXf.exe
2920	ECZFEhh.exe
4936	tNbNRYw.exe
2788	cdcDGVz.exe
3328	IYmCXOk.exe
2572	RvzWKFN.exe
3392	ZhyFeIR.exe
1760	XIskaDQ.exe
2608	fQLUglF.exe
5040	qifFFJa.exe
3232	OOLQdVK.exe
912	mTfNIrh.exe
3648	aBOhhrp.exe
1516	RuOuByR.exe
228	qkkCnIp.exe
3396	mxcDDFY.exe
4276	fQvYVXg.exe
2232	KXuSgxB.exe
2316	OvknIyV.exe
2396	UPgOJmb.exe
1392	LhAPQfQ.exe
4148	bDNBOSY.exe
5064	LZyWkFw.exe
4980	RqfjVGx.exe
4992	YzMTcsZ.exe
536	PedKWzM.exe
4060	QtRrszR.exe
4728	fQdaVAm.exe
992	iDZHTJr.exe
4832	PGxhWVp.exe
3260	jpjRlba.exe
1648	NoNLkDa.exe
2800	nwMLhHg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1624-0-0x00007FF78B3B0000-0x00007FF78B7A2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-5.dat	upx
behavioral2/files/0x00070000000233bf-11.dat	upx
behavioral2/files/0x00070000000233c0-12.dat	upx
behavioral2/memory/3488-29-0x00007FF7581E0000-0x00007FF7585D2000-memory.dmp	upx
behavioral2/files/0x00070000000233c2-38.dat	upx
behavioral2/files/0x00070000000233c5-50.dat	upx
behavioral2/memory/4884-52-0x00007FF6BFAC0000-0x00007FF6BFEB2000-memory.dmp	upx
behavioral2/files/0x00080000000233c3-64.dat	upx
behavioral2/files/0x00070000000233c7-71.dat	upx
behavioral2/files/0x00070000000233c8-79.dat	upx
behavioral2/files/0x00070000000233c9-86.dat	upx
behavioral2/files/0x00070000000233cb-96.dat	upx
behavioral2/files/0x00070000000233ce-103.dat	upx
behavioral2/files/0x00070000000233d0-121.dat	upx
behavioral2/files/0x00070000000233d2-131.dat	upx
behavioral2/files/0x00070000000233d6-143.dat	upx
behavioral2/files/0x00070000000233db-168.dat	upx
behavioral2/files/0x00070000000233de-183.dat	upx
behavioral2/memory/3004-419-0x00007FF65B780000-0x00007FF65BB72000-memory.dmp	upx
behavioral2/memory/2092-420-0x00007FF748E60000-0x00007FF749252000-memory.dmp	upx
behavioral2/memory/1016-421-0x00007FF7FBA70000-0x00007FF7FBE62000-memory.dmp	upx
behavioral2/memory/4072-423-0x00007FF693DA0000-0x00007FF694192000-memory.dmp	upx
behavioral2/memory/428-424-0x00007FF60ACF0000-0x00007FF60B0E2000-memory.dmp	upx
behavioral2/memory/4704-422-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp	upx
behavioral2/memory/1480-428-0x00007FF6BBBB0000-0x00007FF6BBFA2000-memory.dmp	upx
behavioral2/memory/2132-434-0x00007FF6995F0000-0x00007FF6999E2000-memory.dmp	upx
behavioral2/memory/1984-436-0x00007FF611810000-0x00007FF611C02000-memory.dmp	upx
behavioral2/memory/3104-437-0x00007FF7E1C50000-0x00007FF7E2042000-memory.dmp	upx
behavioral2/memory/1028-440-0x00007FF71F0C0000-0x00007FF71F4B2000-memory.dmp	upx
behavioral2/memory/4528-444-0x00007FF643610000-0x00007FF643A02000-memory.dmp	upx
behavioral2/memory/720-445-0x00007FF63F300000-0x00007FF63F6F2000-memory.dmp	upx
behavioral2/memory/1484-443-0x00007FF62BA00000-0x00007FF62BDF2000-memory.dmp	upx
behavioral2/memory/1388-435-0x00007FF652720000-0x00007FF652B12000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-181.dat	upx
behavioral2/files/0x00070000000233dd-178.dat	upx
behavioral2/files/0x00070000000233da-171.dat	upx
behavioral2/files/0x00070000000233d9-166.dat	upx
behavioral2/files/0x00070000000233d8-161.dat	upx
behavioral2/files/0x00070000000233d7-156.dat	upx
behavioral2/files/0x00070000000233d5-146.dat	upx
behavioral2/files/0x00070000000233d4-141.dat	upx
behavioral2/files/0x00070000000233d3-136.dat	upx
behavioral2/files/0x00070000000233d1-126.dat	upx
behavioral2/files/0x00070000000233cf-116.dat	upx
behavioral2/files/0x00070000000233cd-106.dat	upx
behavioral2/files/0x00070000000233cc-101.dat	upx
behavioral2/files/0x00070000000233ca-91.dat	upx
behavioral2/files/0x00070000000233c6-69.dat	upx
behavioral2/memory/4576-67-0x00007FF609CA0000-0x00007FF60A092000-memory.dmp	upx
behavioral2/memory/1100-63-0x00007FF712D80000-0x00007FF713172000-memory.dmp	upx
behavioral2/files/0x00080000000233c4-58.dat	upx
behavioral2/memory/2164-56-0x00007FF7F1EC0000-0x00007FF7F22B2000-memory.dmp	upx
behavioral2/memory/3112-47-0x00007FF7657C0000-0x00007FF765BB2000-memory.dmp	upx
behavioral2/files/0x00070000000233c1-43.dat	upx
behavioral2/memory/4312-41-0x00007FF7A9790000-0x00007FF7A9B82000-memory.dmp	upx
behavioral2/memory/2544-17-0x00007FF701980000-0x00007FF701D72000-memory.dmp	upx
behavioral2/memory/2540-7-0x00007FF6520E0000-0x00007FF6524D2000-memory.dmp	upx
behavioral2/memory/2540-1249-0x00007FF6520E0000-0x00007FF6524D2000-memory.dmp	upx
behavioral2/memory/1624-1247-0x00007FF78B3B0000-0x00007FF78B7A2000-memory.dmp	upx
behavioral2/memory/2164-5247-0x00007FF7F1EC0000-0x00007FF7F22B2000-memory.dmp	upx
behavioral2/memory/1100-6121-0x00007FF712D80000-0x00007FF713172000-memory.dmp	upx
behavioral2/memory/2092-7565-0x00007FF748E60000-0x00007FF749252000-memory.dmp	upx
behavioral2/memory/428-7589-0x00007FF60ACF0000-0x00007FF60B0E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oUlhTCr.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\uIRatWC.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\CZHpWGD.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\DQLexIL.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\uqxipjR.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\RquZRHf.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\FfMRdoA.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\ZnZCzsk.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\TETlsIs.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\BfQonvc.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\ZDfgHvx.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\mnHPQXd.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\UCxOIrQ.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\PGzvSBZ.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\kKVWkpE.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\RdAaRCR.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\RqEVboh.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\rJcggZu.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\goBLubv.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\YmwFLtT.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\iuxVpuF.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\tSajyDl.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\ITCCCua.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\HIALOpp.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\MYasYji.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\EJNHboF.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\ayfUCRk.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\kDpLbTs.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\MUlIzec.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\BwDMAss.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\hVzHpYv.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\KBFQSWO.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\swyZBiC.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\GjJyBzI.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\EgXAfwl.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\odWPjQP.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\NbcWCmC.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\FAmojFz.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\HNiqCFG.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\FFvfmOE.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\xTzAxeF.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\jJMABKH.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\Nsgdsty.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\DbJShDj.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\AUnhbmu.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\nxTkmlg.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\DVzhhbv.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\tNjHEdk.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\WDlAphQ.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\oHblwvT.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\EwSppNr.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\nJhLytw.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\XWpBPIc.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\dBIhXbY.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\cbpxqKf.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\iNjmVZT.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\AHOKvgV.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\TXHfOHi.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\JLoNoGf.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\ouNEEAr.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\QPDpAOT.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\TeYYrxm.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\EIPpmJX.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
File created	C:\Windows\System\FCWdten.exe	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3912	powershell.exe
3912	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	powershell.exe
Token: SeLockMemoryPrivilege	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3912	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	82
PID 1624 wrote to memory of 3912	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	82
PID 1624 wrote to memory of 2540	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	83
PID 1624 wrote to memory of 2540	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	83
PID 1624 wrote to memory of 2544	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	84
PID 1624 wrote to memory of 2544	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	84
PID 1624 wrote to memory of 3488	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	85
PID 1624 wrote to memory of 3488	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	85
PID 1624 wrote to memory of 4312	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	86
PID 1624 wrote to memory of 4312	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	86
PID 1624 wrote to memory of 3112	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	87
PID 1624 wrote to memory of 3112	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	87
PID 1624 wrote to memory of 4884	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	88
PID 1624 wrote to memory of 4884	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	88
PID 1624 wrote to memory of 2164	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	89
PID 1624 wrote to memory of 2164	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	89
PID 1624 wrote to memory of 1100	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	90
PID 1624 wrote to memory of 1100	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	90
PID 1624 wrote to memory of 4576	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	91
PID 1624 wrote to memory of 4576	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	91
PID 1624 wrote to memory of 3004	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	92
PID 1624 wrote to memory of 3004	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	92
PID 1624 wrote to memory of 2092	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	93
PID 1624 wrote to memory of 2092	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	93
PID 1624 wrote to memory of 1016	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	94
PID 1624 wrote to memory of 1016	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	94
PID 1624 wrote to memory of 4704	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	95
PID 1624 wrote to memory of 4704	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	95
PID 1624 wrote to memory of 4072	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	96
PID 1624 wrote to memory of 4072	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	96
PID 1624 wrote to memory of 428	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	97
PID 1624 wrote to memory of 428	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	97
PID 1624 wrote to memory of 1480	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	98
PID 1624 wrote to memory of 1480	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	98
PID 1624 wrote to memory of 2132	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	99
PID 1624 wrote to memory of 2132	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	99
PID 1624 wrote to memory of 1388	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	100
PID 1624 wrote to memory of 1388	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	100
PID 1624 wrote to memory of 1984	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	101
PID 1624 wrote to memory of 1984	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	101
PID 1624 wrote to memory of 3104	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	102
PID 1624 wrote to memory of 3104	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	102
PID 1624 wrote to memory of 1028	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	103
PID 1624 wrote to memory of 1028	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	103
PID 1624 wrote to memory of 1484	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	104
PID 1624 wrote to memory of 1484	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	104
PID 1624 wrote to memory of 4528	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	105
PID 1624 wrote to memory of 4528	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	105
PID 1624 wrote to memory of 720	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	106
PID 1624 wrote to memory of 720	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	106
PID 1624 wrote to memory of 3644	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	107
PID 1624 wrote to memory of 3644	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	107
PID 1624 wrote to memory of 1552	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	108
PID 1624 wrote to memory of 1552	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	108
PID 1624 wrote to memory of 5036	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	109
PID 1624 wrote to memory of 5036	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	109
PID 1624 wrote to memory of 2716	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	110
PID 1624 wrote to memory of 2716	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	110
PID 1624 wrote to memory of 4572	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	111
PID 1624 wrote to memory of 4572	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	111
PID 1624 wrote to memory of 2600	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	112
PID 1624 wrote to memory of 2600	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	112
PID 1624 wrote to memory of 2932	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	113
PID 1624 wrote to memory of 2932	1624	22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\22a16e4fa599fec2c282011b424177a183f1608bee7fc35474a7557bf55aa497_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3912
- C:\Windows\System\KCCmWHK.exe
  C:\Windows\System\KCCmWHK.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\gTwlTTw.exe
  C:\Windows\System\gTwlTTw.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\telNhFH.exe
  C:\Windows\System\telNhFH.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\FQVAFLU.exe
  C:\Windows\System\FQVAFLU.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\zcOfguH.exe
  C:\Windows\System\zcOfguH.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\Srodqgv.exe
  C:\Windows\System\Srodqgv.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\ZVKFkms.exe
  C:\Windows\System\ZVKFkms.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\PKZjoXz.exe
  C:\Windows\System\PKZjoXz.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\jBpgDlR.exe
  C:\Windows\System\jBpgDlR.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\yNdRttQ.exe
  C:\Windows\System\yNdRttQ.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\KobkNXt.exe
  C:\Windows\System\KobkNXt.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\eZtGKvn.exe
  C:\Windows\System\eZtGKvn.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\fOlMnnl.exe
  C:\Windows\System\fOlMnnl.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\jqBLmbw.exe
  C:\Windows\System\jqBLmbw.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\VPSFKaT.exe
  C:\Windows\System\VPSFKaT.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\dMOjdns.exe
  C:\Windows\System\dMOjdns.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\OYoilyj.exe
  C:\Windows\System\OYoilyj.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\sQVzuSX.exe
  C:\Windows\System\sQVzuSX.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\fCUnoth.exe
  C:\Windows\System\fCUnoth.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\aFIUwVA.exe
  C:\Windows\System\aFIUwVA.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\TxclZSK.exe
  C:\Windows\System\TxclZSK.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\XIiCmzq.exe
  C:\Windows\System\XIiCmzq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\ReDmlIQ.exe
  C:\Windows\System\ReDmlIQ.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\EHWqTOa.exe
  C:\Windows\System\EHWqTOa.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\XYqxEEM.exe
  C:\Windows\System\XYqxEEM.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\EbkbWQr.exe
  C:\Windows\System\EbkbWQr.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\neSVIXu.exe
  C:\Windows\System\neSVIXu.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\SwmLJYL.exe
  C:\Windows\System\SwmLJYL.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\AMYXAmP.exe
  C:\Windows\System\AMYXAmP.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\eaMPDSh.exe
  C:\Windows\System\eaMPDSh.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\KXwGqfN.exe
  C:\Windows\System\KXwGqfN.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\JsYZNXf.exe
  C:\Windows\System\JsYZNXf.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\ECZFEhh.exe
  C:\Windows\System\ECZFEhh.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\tNbNRYw.exe
  C:\Windows\System\tNbNRYw.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\cdcDGVz.exe
  C:\Windows\System\cdcDGVz.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\IYmCXOk.exe
  C:\Windows\System\IYmCXOk.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\RvzWKFN.exe
  C:\Windows\System\RvzWKFN.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ZhyFeIR.exe
  C:\Windows\System\ZhyFeIR.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\XIskaDQ.exe
  C:\Windows\System\XIskaDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\fQLUglF.exe
  C:\Windows\System\fQLUglF.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\qifFFJa.exe
  C:\Windows\System\qifFFJa.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\OOLQdVK.exe
  C:\Windows\System\OOLQdVK.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\mTfNIrh.exe
  C:\Windows\System\mTfNIrh.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\aBOhhrp.exe
  C:\Windows\System\aBOhhrp.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\RuOuByR.exe
  C:\Windows\System\RuOuByR.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\qkkCnIp.exe
  C:\Windows\System\qkkCnIp.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\mxcDDFY.exe
  C:\Windows\System\mxcDDFY.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\fQvYVXg.exe
  C:\Windows\System\fQvYVXg.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\KXuSgxB.exe
  C:\Windows\System\KXuSgxB.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\OvknIyV.exe
  C:\Windows\System\OvknIyV.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\UPgOJmb.exe
  C:\Windows\System\UPgOJmb.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\LhAPQfQ.exe
  C:\Windows\System\LhAPQfQ.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\bDNBOSY.exe
  C:\Windows\System\bDNBOSY.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\LZyWkFw.exe
  C:\Windows\System\LZyWkFw.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\RqfjVGx.exe
  C:\Windows\System\RqfjVGx.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\YzMTcsZ.exe
  C:\Windows\System\YzMTcsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\PedKWzM.exe
  C:\Windows\System\PedKWzM.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\QtRrszR.exe
  C:\Windows\System\QtRrszR.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\fQdaVAm.exe
  C:\Windows\System\fQdaVAm.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\iDZHTJr.exe
  C:\Windows\System\iDZHTJr.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\PGxhWVp.exe
  C:\Windows\System\PGxhWVp.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\jpjRlba.exe
  C:\Windows\System\jpjRlba.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\NoNLkDa.exe
  C:\Windows\System\NoNLkDa.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\nwMLhHg.exe
  C:\Windows\System\nwMLhHg.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\zFzVVis.exe
  C:\Windows\System\zFzVVis.exe
  2⤵
  PID:3172
- C:\Windows\System\UOHdcqJ.exe
  C:\Windows\System\UOHdcqJ.exe
  2⤵
  PID:3216
- C:\Windows\System\GLUyrBj.exe
  C:\Windows\System\GLUyrBj.exe
  2⤵
  PID:3460
- C:\Windows\System\fYUkHFl.exe
  C:\Windows\System\fYUkHFl.exe
  2⤵
  PID:4440
- C:\Windows\System\SJwEEbu.exe
  C:\Windows\System\SJwEEbu.exe
  2⤵
  PID:2148
- C:\Windows\System\EKymuYA.exe
  C:\Windows\System\EKymuYA.exe
  2⤵
  PID:648
- C:\Windows\System\hoDWzTg.exe
  C:\Windows\System\hoDWzTg.exe
  2⤵
  PID:4012
- C:\Windows\System\DIwoISR.exe
  C:\Windows\System\DIwoISR.exe
  2⤵
  PID:4872
- C:\Windows\System\ngoTjLt.exe
  C:\Windows\System\ngoTjLt.exe
  2⤵
  PID:4444
- C:\Windows\System\frfVDZl.exe
  C:\Windows\System\frfVDZl.exe
  2⤵
  PID:4064
- C:\Windows\System\QWEqTCM.exe
  C:\Windows\System\QWEqTCM.exe
  2⤵
  PID:4568
- C:\Windows\System\awZTexK.exe
  C:\Windows\System\awZTexK.exe
  2⤵
  PID:2372
- C:\Windows\System\iekFduV.exe
  C:\Windows\System\iekFduV.exe
  2⤵
  PID:2056
- C:\Windows\System\bKHPDmz.exe
  C:\Windows\System\bKHPDmz.exe
  2⤵
  PID:5012
- C:\Windows\System\FkjDwhY.exe
  C:\Windows\System\FkjDwhY.exe
  2⤵
  PID:4240
- C:\Windows\System\cFtDIbg.exe
  C:\Windows\System\cFtDIbg.exe
  2⤵
  PID:3916
- C:\Windows\System\wXVDMZy.exe
  C:\Windows\System\wXVDMZy.exe
  2⤵
  PID:2968
- C:\Windows\System\wQuWdtI.exe
  C:\Windows\System\wQuWdtI.exe
  2⤵
  PID:3124
- C:\Windows\System\GesQGlO.exe
  C:\Windows\System\GesQGlO.exe
  2⤵
  PID:4508
- C:\Windows\System\jzFwZuE.exe
  C:\Windows\System\jzFwZuE.exe
  2⤵
  PID:1156
- C:\Windows\System\ZKLbFzv.exe
  C:\Windows\System\ZKLbFzv.exe
  2⤵
  PID:868
- C:\Windows\System\WUXlWgN.exe
  C:\Windows\System\WUXlWgN.exe
  2⤵
  PID:1288
- C:\Windows\System\vuYJZTv.exe
  C:\Windows\System\vuYJZTv.exe
  2⤵
  PID:5148
- C:\Windows\System\HLvVGuo.exe
  C:\Windows\System\HLvVGuo.exe
  2⤵
  PID:5176
- C:\Windows\System\ZNRytUv.exe
  C:\Windows\System\ZNRytUv.exe
  2⤵
  PID:5204
- C:\Windows\System\eyxuHBK.exe
  C:\Windows\System\eyxuHBK.exe
  2⤵
  PID:5232
- C:\Windows\System\yyTilNy.exe
  C:\Windows\System\yyTilNy.exe
  2⤵
  PID:5260
- C:\Windows\System\IDDLFcl.exe
  C:\Windows\System\IDDLFcl.exe
  2⤵
  PID:5288
- C:\Windows\System\ftxyRKV.exe
  C:\Windows\System\ftxyRKV.exe
  2⤵
  PID:5316
- C:\Windows\System\ruHJVnP.exe
  C:\Windows\System\ruHJVnP.exe
  2⤵
  PID:5344
- C:\Windows\System\AxshxSs.exe
  C:\Windows\System\AxshxSs.exe
  2⤵
  PID:5372
- C:\Windows\System\fJsWZDi.exe
  C:\Windows\System\fJsWZDi.exe
  2⤵
  PID:5400
- C:\Windows\System\azXaIqs.exe
  C:\Windows\System\azXaIqs.exe
  2⤵
  PID:5428
- C:\Windows\System\qPUDZLo.exe
  C:\Windows\System\qPUDZLo.exe
  2⤵
  PID:5456
- C:\Windows\System\LSGOSuC.exe
  C:\Windows\System\LSGOSuC.exe
  2⤵
  PID:5484
- C:\Windows\System\CnePHQn.exe
  C:\Windows\System\CnePHQn.exe
  2⤵
  PID:5512
- C:\Windows\System\MGdOqoY.exe
  C:\Windows\System\MGdOqoY.exe
  2⤵
  PID:5540
- C:\Windows\System\UCQrkMI.exe
  C:\Windows\System\UCQrkMI.exe
  2⤵
  PID:5568
- C:\Windows\System\GXszVGA.exe
  C:\Windows\System\GXszVGA.exe
  2⤵
  PID:5596
- C:\Windows\System\wSsTctq.exe
  C:\Windows\System\wSsTctq.exe
  2⤵
  PID:5624
- C:\Windows\System\ACkqlsK.exe
  C:\Windows\System\ACkqlsK.exe
  2⤵
  PID:5652
- C:\Windows\System\PVhMMaY.exe
  C:\Windows\System\PVhMMaY.exe
  2⤵
  PID:5676
- C:\Windows\System\wXJzLhJ.exe
  C:\Windows\System\wXJzLhJ.exe
  2⤵
  PID:5708
- C:\Windows\System\tMWRIns.exe
  C:\Windows\System\tMWRIns.exe
  2⤵
  PID:5732
- C:\Windows\System\KePMDVF.exe
  C:\Windows\System\KePMDVF.exe
  2⤵
  PID:5760
- C:\Windows\System\kTJJzYw.exe
  C:\Windows\System\kTJJzYw.exe
  2⤵
  PID:5792
- C:\Windows\System\PBpVTKv.exe
  C:\Windows\System\PBpVTKv.exe
  2⤵
  PID:5820
- C:\Windows\System\FHaQtJB.exe
  C:\Windows\System\FHaQtJB.exe
  2⤵
  PID:5848
- C:\Windows\System\ZEQnIPm.exe
  C:\Windows\System\ZEQnIPm.exe
  2⤵
  PID:5908
- C:\Windows\System\jCDwSOV.exe
  C:\Windows\System\jCDwSOV.exe
  2⤵
  PID:5948
- C:\Windows\System\ZnytWKo.exe
  C:\Windows\System\ZnytWKo.exe
  2⤵
  PID:6012
- C:\Windows\System\duWLuzP.exe
  C:\Windows\System\duWLuzP.exe
  2⤵
  PID:6048
- C:\Windows\System\cVQODlD.exe
  C:\Windows\System\cVQODlD.exe
  2⤵
  PID:6088
- C:\Windows\System\jLAWmNp.exe
  C:\Windows\System\jLAWmNp.exe
  2⤵
  PID:6112
- C:\Windows\System\OyAcgKI.exe
  C:\Windows\System\OyAcgKI.exe
  2⤵
  PID:6132
- C:\Windows\System\tqTUmNL.exe
  C:\Windows\System\tqTUmNL.exe
  2⤵
  PID:2436
- C:\Windows\System\fCHKCLn.exe
  C:\Windows\System\fCHKCLn.exe
  2⤵
  PID:1324
- C:\Windows\System\CiaaSjB.exe
  C:\Windows\System\CiaaSjB.exe
  2⤵
  PID:1608
- C:\Windows\System\WdirAPT.exe
  C:\Windows\System\WdirAPT.exe
  2⤵
  PID:2864
- C:\Windows\System\frFNjjR.exe
  C:\Windows\System\frFNjjR.exe
  2⤵
  PID:2128
- C:\Windows\System\bChhCFd.exe
  C:\Windows\System\bChhCFd.exe
  2⤵
  PID:5220
- C:\Windows\System\TiZBWZY.exe
  C:\Windows\System\TiZBWZY.exe
  2⤵
  PID:5272
- C:\Windows\System\vUFzwpb.exe
  C:\Windows\System\vUFzwpb.exe
  2⤵
  PID:5304
- C:\Windows\System\MeokKhE.exe
  C:\Windows\System\MeokKhE.exe
  2⤵
  PID:5388
- C:\Windows\System\hwKafva.exe
  C:\Windows\System\hwKafva.exe
  2⤵
  PID:5440
- C:\Windows\System\rUGWmgU.exe
  C:\Windows\System\rUGWmgU.exe
  2⤵
  PID:5476
- C:\Windows\System\HcgvKqA.exe
  C:\Windows\System\HcgvKqA.exe
  2⤵
  PID:5532
- C:\Windows\System\iVqKxqZ.exe
  C:\Windows\System\iVqKxqZ.exe
  2⤵
  PID:5560
- C:\Windows\System\odGgYwK.exe
  C:\Windows\System\odGgYwK.exe
  2⤵
  PID:5616
- C:\Windows\System\vWttBQh.exe
  C:\Windows\System\vWttBQh.exe
  2⤵
  PID:320
- C:\Windows\System\yjWQxXk.exe
  C:\Windows\System\yjWQxXk.exe
  2⤵
  PID:5668
- C:\Windows\System\BinEqKh.exe
  C:\Windows\System\BinEqKh.exe
  2⤵
  PID:5728
- C:\Windows\System\zAVLarK.exe
  C:\Windows\System\zAVLarK.exe
  2⤵
  PID:5756
- C:\Windows\System\DAtpGhM.exe
  C:\Windows\System\DAtpGhM.exe
  2⤵
  PID:2952
- C:\Windows\System\CbOwHKM.exe
  C:\Windows\System\CbOwHKM.exe
  2⤵
  PID:372
- C:\Windows\System\TXPGsTl.exe
  C:\Windows\System\TXPGsTl.exe
  2⤵
  PID:5076
- C:\Windows\System\ZhgFllY.exe
  C:\Windows\System\ZhgFllY.exe
  2⤵
  PID:5840
- C:\Windows\System\DdLsPzK.exe
  C:\Windows\System\DdLsPzK.exe
  2⤵
  PID:3640
- C:\Windows\System\rqpyGeC.exe
  C:\Windows\System\rqpyGeC.exe
  2⤵
  PID:4840
- C:\Windows\System\qaBuoEe.exe
  C:\Windows\System\qaBuoEe.exe
  2⤵
  PID:4636
- C:\Windows\System\kOXplre.exe
  C:\Windows\System\kOXplre.exe
  2⤵
  PID:4400
- C:\Windows\System\ySTwGxs.exe
  C:\Windows\System\ySTwGxs.exe
  2⤵
  PID:6020
- C:\Windows\System\htDUKRO.exe
  C:\Windows\System\htDUKRO.exe
  2⤵
  PID:1488
- C:\Windows\System\ticFsqN.exe
  C:\Windows\System\ticFsqN.exe
  2⤵
  PID:6080
- C:\Windows\System\zNvIbtL.exe
  C:\Windows\System\zNvIbtL.exe
  2⤵
  PID:6108
- C:\Windows\System\Toytmcc.exe
  C:\Windows\System\Toytmcc.exe
  2⤵
  PID:6124
- C:\Windows\System\PqXdsRT.exe
  C:\Windows\System\PqXdsRT.exe
  2⤵
  PID:396
- C:\Windows\System\WdMcfrx.exe
  C:\Windows\System\WdMcfrx.exe
  2⤵
  PID:4004
- C:\Windows\System\tqKFFRv.exe
  C:\Windows\System\tqKFFRv.exe
  2⤵
  PID:6008
- C:\Windows\System\TVaVlIe.exe
  C:\Windows\System\TVaVlIe.exe
  2⤵
  PID:384
- C:\Windows\System\JxrGIzQ.exe
  C:\Windows\System\JxrGIzQ.exe
  2⤵
  PID:5216
- C:\Windows\System\DYOlMrz.exe
  C:\Windows\System\DYOlMrz.exe
  2⤵
  PID:5280
- C:\Windows\System\tBfEHmU.exe
  C:\Windows\System\tBfEHmU.exe
  2⤵
  PID:5468
- C:\Windows\System\yPwtxyJ.exe
  C:\Windows\System\yPwtxyJ.exe
  2⤵
  PID:5580
- C:\Windows\System\HjFKmIU.exe
  C:\Windows\System\HjFKmIU.exe
  2⤵
  PID:1456
- C:\Windows\System\MlkCrbQ.exe
  C:\Windows\System\MlkCrbQ.exe
  2⤵
  PID:5752
- C:\Windows\System\lsAPMDU.exe
  C:\Windows\System\lsAPMDU.exe
  2⤵
  PID:5808
- C:\Windows\System\GUVFlae.exe
  C:\Windows\System\GUVFlae.exe
  2⤵
  PID:4408
- C:\Windows\System\OJHgMzG.exe
  C:\Windows\System\OJHgMzG.exe
  2⤵
  PID:4696
- C:\Windows\System\WGIqCAF.exe
  C:\Windows\System\WGIqCAF.exe
  2⤵
  PID:748
- C:\Windows\System\KybKnIe.exe
  C:\Windows\System\KybKnIe.exe
  2⤵
  PID:6000
- C:\Windows\System\HhVDhvo.exe
  C:\Windows\System\HhVDhvo.exe
  2⤵
  PID:6072
- C:\Windows\System\JSJcrHt.exe
  C:\Windows\System\JSJcrHt.exe
  2⤵
  PID:5872
- C:\Windows\System\IvZxoxJ.exe
  C:\Windows\System\IvZxoxJ.exe
  2⤵
  PID:5988
- C:\Windows\System\sakisCz.exe
  C:\Windows\System\sakisCz.exe
  2⤵
  PID:5416
- C:\Windows\System\nDmsvtA.exe
  C:\Windows\System\nDmsvtA.exe
  2⤵
  PID:5252
- C:\Windows\System\ChTMjbf.exe
  C:\Windows\System\ChTMjbf.exe
  2⤵
  PID:3292
- C:\Windows\System\Ykvfmqv.exe
  C:\Windows\System\Ykvfmqv.exe
  2⤵
  PID:5928
- C:\Windows\System\qctOBxv.exe
  C:\Windows\System\qctOBxv.exe
  2⤵
  PID:2012
- C:\Windows\System\HwkVXLj.exe
  C:\Windows\System\HwkVXLj.exe
  2⤵
  PID:6168
- C:\Windows\System\JhNuGzL.exe
  C:\Windows\System\JhNuGzL.exe
  2⤵
  PID:6188
- C:\Windows\System\PldXSQL.exe
  C:\Windows\System\PldXSQL.exe
  2⤵
  PID:6212
- C:\Windows\System\VtLqrYs.exe
  C:\Windows\System\VtLqrYs.exe
  2⤵
  PID:6240
- C:\Windows\System\bMyUhSU.exe
  C:\Windows\System\bMyUhSU.exe
  2⤵
  PID:6256
- C:\Windows\System\NpfDEWv.exe
  C:\Windows\System\NpfDEWv.exe
  2⤵
  PID:6280
- C:\Windows\System\zPahzmy.exe
  C:\Windows\System\zPahzmy.exe
  2⤵
  PID:6296
- C:\Windows\System\pJrPxpU.exe
  C:\Windows\System\pJrPxpU.exe
  2⤵
  PID:6316
- C:\Windows\System\IiNPOJC.exe
  C:\Windows\System\IiNPOJC.exe
  2⤵
  PID:6388
- C:\Windows\System\gTqMbtv.exe
  C:\Windows\System\gTqMbtv.exe
  2⤵
  PID:6404
- C:\Windows\System\FQKwVmz.exe
  C:\Windows\System\FQKwVmz.exe
  2⤵
  PID:6428
- C:\Windows\System\pIbQumf.exe
  C:\Windows\System\pIbQumf.exe
  2⤵
  PID:6444
- C:\Windows\System\qiqtNTO.exe
  C:\Windows\System\qiqtNTO.exe
  2⤵
  PID:6464
- C:\Windows\System\cNPDfAW.exe
  C:\Windows\System\cNPDfAW.exe
  2⤵
  PID:6484
- C:\Windows\System\hkyxaUr.exe
  C:\Windows\System\hkyxaUr.exe
  2⤵
  PID:6504
- C:\Windows\System\vdYVPCs.exe
  C:\Windows\System\vdYVPCs.exe
  2⤵
  PID:6528
- C:\Windows\System\tDcYDyi.exe
  C:\Windows\System\tDcYDyi.exe
  2⤵
  PID:6544
- C:\Windows\System\TJgNbOJ.exe
  C:\Windows\System\TJgNbOJ.exe
  2⤵
  PID:6576
- C:\Windows\System\YbFYwJW.exe
  C:\Windows\System\YbFYwJW.exe
  2⤵
  PID:6592
- C:\Windows\System\pEDtAqv.exe
  C:\Windows\System\pEDtAqv.exe
  2⤵
  PID:6616
- C:\Windows\System\sIpuSIB.exe
  C:\Windows\System\sIpuSIB.exe
  2⤵
  PID:6632
- C:\Windows\System\zfbvTsg.exe
  C:\Windows\System\zfbvTsg.exe
  2⤵
  PID:6696
- C:\Windows\System\SqBqmau.exe
  C:\Windows\System\SqBqmau.exe
  2⤵
  PID:6720
- C:\Windows\System\GXxwyGw.exe
  C:\Windows\System\GXxwyGw.exe
  2⤵
  PID:6736
- C:\Windows\System\gnDZUab.exe
  C:\Windows\System\gnDZUab.exe
  2⤵
  PID:6772
- C:\Windows\System\kfTIeCd.exe
  C:\Windows\System\kfTIeCd.exe
  2⤵
  PID:6792
- C:\Windows\System\nSCVtej.exe
  C:\Windows\System\nSCVtej.exe
  2⤵
  PID:6820
- C:\Windows\System\RtrdZpe.exe
  C:\Windows\System\RtrdZpe.exe
  2⤵
  PID:6840
- C:\Windows\System\nbKZnux.exe
  C:\Windows\System\nbKZnux.exe
  2⤵
  PID:6928
- C:\Windows\System\jODhkDD.exe
  C:\Windows\System\jODhkDD.exe
  2⤵
  PID:6944
- C:\Windows\System\RCkrGnM.exe
  C:\Windows\System\RCkrGnM.exe
  2⤵
  PID:6972
- C:\Windows\System\qrfNKVV.exe
  C:\Windows\System\qrfNKVV.exe
  2⤵
  PID:6988
- C:\Windows\System\luJTezR.exe
  C:\Windows\System\luJTezR.exe
  2⤵
  PID:7020
- C:\Windows\System\RtVrzFX.exe
  C:\Windows\System\RtVrzFX.exe
  2⤵
  PID:7064
- C:\Windows\System\nAQKmRx.exe
  C:\Windows\System\nAQKmRx.exe
  2⤵
  PID:7156
- C:\Windows\System\FGgFKTa.exe
  C:\Windows\System\FGgFKTa.exe
  2⤵
  PID:2796
- C:\Windows\System\czAKYqm.exe
  C:\Windows\System\czAKYqm.exe
  2⤵
  PID:1468
- C:\Windows\System\OziUqio.exe
  C:\Windows\System\OziUqio.exe
  2⤵
  PID:5640
- C:\Windows\System\MBgcacG.exe
  C:\Windows\System\MBgcacG.exe
  2⤵
  PID:6344
- C:\Windows\System\fTOMSzV.exe
  C:\Windows\System\fTOMSzV.exe
  2⤵
  PID:6248
- C:\Windows\System\MELbAvL.exe
  C:\Windows\System\MELbAvL.exe
  2⤵
  PID:6396
- C:\Windows\System\jbtbuRe.exe
  C:\Windows\System\jbtbuRe.exe
  2⤵
  PID:6540
- C:\Windows\System\veZGEhw.exe
  C:\Windows\System\veZGEhw.exe
  2⤵
  PID:6400
- C:\Windows\System\JsehVeO.exe
  C:\Windows\System\JsehVeO.exe
  2⤵
  PID:6564
- C:\Windows\System\DGDQBep.exe
  C:\Windows\System\DGDQBep.exe
  2⤵
  PID:6608
- C:\Windows\System\XOQioul.exe
  C:\Windows\System\XOQioul.exe
  2⤵
  PID:6728
- C:\Windows\System\vUPMLJJ.exe
  C:\Windows\System\vUPMLJJ.exe
  2⤵
  PID:6780
- C:\Windows\System\SDceend.exe
  C:\Windows\System\SDceend.exe
  2⤵
  PID:6884
- C:\Windows\System\uZeaVoT.exe
  C:\Windows\System\uZeaVoT.exe
  2⤵
  PID:6808
- C:\Windows\System\DGJtLsv.exe
  C:\Windows\System\DGJtLsv.exe
  2⤵
  PID:6940
- C:\Windows\System\bctPRpv.exe
  C:\Windows\System\bctPRpv.exe
  2⤵
  PID:7088
- C:\Windows\System\JiuTSaY.exe
  C:\Windows\System\JiuTSaY.exe
  2⤵
  PID:6968
- C:\Windows\System\VvWvDif.exe
  C:\Windows\System\VvWvDif.exe
  2⤵
  PID:7016
- C:\Windows\System\zEtGXxd.exe
  C:\Windows\System\zEtGXxd.exe
  2⤵
  PID:1220
- C:\Windows\System\KWMOIXU.exe
  C:\Windows\System\KWMOIXU.exe
  2⤵
  PID:6640
- C:\Windows\System\PWexpsl.exe
  C:\Windows\System\PWexpsl.exe
  2⤵
  PID:6492
- C:\Windows\System\sIIEpAX.exe
  C:\Windows\System\sIIEpAX.exe
  2⤵
  PID:6624
- C:\Windows\System\OidvvDB.exe
  C:\Windows\System\OidvvDB.exe
  2⤵
  PID:6784
- C:\Windows\System\PfCDupv.exe
  C:\Windows\System\PfCDupv.exe
  2⤵
  PID:7144
- C:\Windows\System\kneCeWc.exe
  C:\Windows\System\kneCeWc.exe
  2⤵
  PID:5892
- C:\Windows\System\yskAUge.exe
  C:\Windows\System\yskAUge.exe
  2⤵
  PID:6120
- C:\Windows\System\GCIRwOz.exe
  C:\Windows\System\GCIRwOz.exe
  2⤵
  PID:6588
- C:\Windows\System\UwWSQXO.exe
  C:\Windows\System\UwWSQXO.exe
  2⤵
  PID:6832
- C:\Windows\System\FprAYFT.exe
  C:\Windows\System\FprAYFT.exe
  2⤵
  PID:6676
- C:\Windows\System\YkWimoa.exe
  C:\Windows\System\YkWimoa.exe
  2⤵
  PID:6176
- C:\Windows\System\YWeAJia.exe
  C:\Windows\System\YWeAJia.exe
  2⤵
  PID:7196
- C:\Windows\System\fJxqgrI.exe
  C:\Windows\System\fJxqgrI.exe
  2⤵
  PID:7212
- C:\Windows\System\bsVPCge.exe
  C:\Windows\System\bsVPCge.exe
  2⤵
  PID:7240
- C:\Windows\System\CoZYBrt.exe
  C:\Windows\System\CoZYBrt.exe
  2⤵
  PID:7268
- C:\Windows\System\ceFlfDE.exe
  C:\Windows\System\ceFlfDE.exe
  2⤵
  PID:7324
- C:\Windows\System\jVMlbAd.exe
  C:\Windows\System\jVMlbAd.exe
  2⤵
  PID:7352
- C:\Windows\System\BhvvBCv.exe
  C:\Windows\System\BhvvBCv.exe
  2⤵
  PID:7376
- C:\Windows\System\GFbFyfA.exe
  C:\Windows\System\GFbFyfA.exe
  2⤵
  PID:7396
- C:\Windows\System\HQThhzb.exe
  C:\Windows\System\HQThhzb.exe
  2⤵
  PID:7420
- C:\Windows\System\goeMMAh.exe
  C:\Windows\System\goeMMAh.exe
  2⤵
  PID:7440
- C:\Windows\System\UWCnNoq.exe
  C:\Windows\System\UWCnNoq.exe
  2⤵
  PID:7476
- C:\Windows\System\uszzxhq.exe
  C:\Windows\System\uszzxhq.exe
  2⤵
  PID:7492
- C:\Windows\System\pIQXMFw.exe
  C:\Windows\System\pIQXMFw.exe
  2⤵
  PID:7520
- C:\Windows\System\LRKvgHm.exe
  C:\Windows\System\LRKvgHm.exe
  2⤵
  PID:7544
- C:\Windows\System\mTwtsXw.exe
  C:\Windows\System\mTwtsXw.exe
  2⤵
  PID:7580
- C:\Windows\System\npSwWFQ.exe
  C:\Windows\System\npSwWFQ.exe
  2⤵
  PID:7608
- C:\Windows\System\byhAmyW.exe
  C:\Windows\System\byhAmyW.exe
  2⤵
  PID:7628
- C:\Windows\System\ITptvEu.exe
  C:\Windows\System\ITptvEu.exe
  2⤵
  PID:7656
- C:\Windows\System\CkntENh.exe
  C:\Windows\System\CkntENh.exe
  2⤵
  PID:7672
- C:\Windows\System\VXkyykY.exe
  C:\Windows\System\VXkyykY.exe
  2⤵
  PID:7692
- C:\Windows\System\iofOgCF.exe
  C:\Windows\System\iofOgCF.exe
  2⤵
  PID:7732
- C:\Windows\System\HkCDdYj.exe
  C:\Windows\System\HkCDdYj.exe
  2⤵
  PID:7760
- C:\Windows\System\qXHbYZF.exe
  C:\Windows\System\qXHbYZF.exe
  2⤵
  PID:7784
- C:\Windows\System\doXjVLk.exe
  C:\Windows\System\doXjVLk.exe
  2⤵
  PID:7832
- C:\Windows\System\cYCZnPK.exe
  C:\Windows\System\cYCZnPK.exe
  2⤵
  PID:7892
- C:\Windows\System\kBBopLD.exe
  C:\Windows\System\kBBopLD.exe
  2⤵
  PID:7908
- C:\Windows\System\UqAhTqz.exe
  C:\Windows\System\UqAhTqz.exe
  2⤵
  PID:7944
- C:\Windows\System\JBEckfk.exe
  C:\Windows\System\JBEckfk.exe
  2⤵
  PID:7960
- C:\Windows\System\fxhqVod.exe
  C:\Windows\System\fxhqVod.exe
  2⤵
  PID:7988
- C:\Windows\System\EbiBfuA.exe
  C:\Windows\System\EbiBfuA.exe
  2⤵
  PID:8008
- C:\Windows\System\bnTAoZM.exe
  C:\Windows\System\bnTAoZM.exe
  2⤵
  PID:8036
- C:\Windows\System\kzifNKd.exe
  C:\Windows\System\kzifNKd.exe
  2⤵
  PID:8052
- C:\Windows\System\BIoynMQ.exe
  C:\Windows\System\BIoynMQ.exe
  2⤵
  PID:8104
- C:\Windows\System\TKTFEXj.exe
  C:\Windows\System\TKTFEXj.exe
  2⤵
  PID:8128
- C:\Windows\System\vmLfyiG.exe
  C:\Windows\System\vmLfyiG.exe
  2⤵
  PID:8156
- C:\Windows\System\sWdsKDZ.exe
  C:\Windows\System\sWdsKDZ.exe
  2⤵
  PID:8180
- C:\Windows\System\nzGgEzF.exe
  C:\Windows\System\nzGgEzF.exe
  2⤵
  PID:7184
- C:\Windows\System\FyDNgRT.exe
  C:\Windows\System\FyDNgRT.exe
  2⤵
  PID:7236
- C:\Windows\System\KPRcOWx.exe
  C:\Windows\System\KPRcOWx.exe
  2⤵
  PID:7280
- C:\Windows\System\PuXyxwD.exe
  C:\Windows\System\PuXyxwD.exe
  2⤵
  PID:7340
- C:\Windows\System\hxoHfoC.exe
  C:\Windows\System\hxoHfoC.exe
  2⤵
  PID:7404
- C:\Windows\System\ABbzajR.exe
  C:\Windows\System\ABbzajR.exe
  2⤵
  PID:7464
- C:\Windows\System\mynnnQK.exe
  C:\Windows\System\mynnnQK.exe
  2⤵
  PID:7556
- C:\Windows\System\rxguFSW.exe
  C:\Windows\System\rxguFSW.exe
  2⤵
  PID:7620
- C:\Windows\System\MmZCFlk.exe
  C:\Windows\System\MmZCFlk.exe
  2⤵
  PID:7688
- C:\Windows\System\lqqohtE.exe
  C:\Windows\System\lqqohtE.exe
  2⤵
  PID:7752
- C:\Windows\System\bQWDmtJ.exe
  C:\Windows\System\bQWDmtJ.exe
  2⤵
  PID:7864
- C:\Windows\System\HzTxgIp.exe
  C:\Windows\System\HzTxgIp.exe
  2⤵
  PID:7920
- C:\Windows\System\cpQtrnu.exe
  C:\Windows\System\cpQtrnu.exe
  2⤵
  PID:8016
- C:\Windows\System\uZlatjs.exe
  C:\Windows\System\uZlatjs.exe
  2⤵
  PID:8076
- C:\Windows\System\rVyQwDo.exe
  C:\Windows\System\rVyQwDo.exe
  2⤵
  PID:8120
- C:\Windows\System\QxMReqB.exe
  C:\Windows\System\QxMReqB.exe
  2⤵
  PID:8144
- C:\Windows\System\kZqkDcd.exe
  C:\Windows\System\kZqkDcd.exe
  2⤵
  PID:6704
- C:\Windows\System\AiLwyQr.exe
  C:\Windows\System\AiLwyQr.exe
  2⤵
  PID:7308
- C:\Windows\System\jQkQstX.exe
  C:\Windows\System\jQkQstX.exe
  2⤵
  PID:7436
- C:\Windows\System\CfZvsIu.exe
  C:\Windows\System\CfZvsIu.exe
  2⤵
  PID:7572
- C:\Windows\System\ADfHbGC.exe
  C:\Windows\System\ADfHbGC.exe
  2⤵
  PID:7824
- C:\Windows\System\yhnpAPS.exe
  C:\Windows\System\yhnpAPS.exe
  2⤵
  PID:7952
- C:\Windows\System\GtKtbsA.exe
  C:\Windows\System\GtKtbsA.exe
  2⤵
  PID:8100
- C:\Windows\System\wLzPeMz.exe
  C:\Windows\System\wLzPeMz.exe
  2⤵
  PID:7220
- C:\Windows\System\SCmuTxd.exe
  C:\Windows\System\SCmuTxd.exe
  2⤵
  PID:7384
- C:\Windows\System\OgYvMvB.exe
  C:\Windows\System\OgYvMvB.exe
  2⤵
  PID:7980
- C:\Windows\System\clABVyN.exe
  C:\Windows\System\clABVyN.exe
  2⤵
  PID:8208
- C:\Windows\System\NCVGQsd.exe
  C:\Windows\System\NCVGQsd.exe
  2⤵
  PID:8236
- C:\Windows\System\cMWbObK.exe
  C:\Windows\System\cMWbObK.exe
  2⤵
  PID:8256
- C:\Windows\System\nDApTcD.exe
  C:\Windows\System\nDApTcD.exe
  2⤵
  PID:8280
- C:\Windows\System\lCtZjiQ.exe
  C:\Windows\System\lCtZjiQ.exe
  2⤵
  PID:8332
- C:\Windows\System\sqYnPpj.exe
  C:\Windows\System\sqYnPpj.exe
  2⤵
  PID:8348
- C:\Windows\System\fyyeIdv.exe
  C:\Windows\System\fyyeIdv.exe
  2⤵
  PID:8368
- C:\Windows\System\oncPukU.exe
  C:\Windows\System\oncPukU.exe
  2⤵
  PID:8396
- C:\Windows\System\AuGrFPg.exe
  C:\Windows\System\AuGrFPg.exe
  2⤵
  PID:8420
- C:\Windows\System\iIfxVnJ.exe
  C:\Windows\System\iIfxVnJ.exe
  2⤵
  PID:8440
- C:\Windows\System\XSZTZzP.exe
  C:\Windows\System\XSZTZzP.exe
  2⤵
  PID:8468
- C:\Windows\System\zmlYViV.exe
  C:\Windows\System\zmlYViV.exe
  2⤵
  PID:8512
- C:\Windows\System\wUmzXki.exe
  C:\Windows\System\wUmzXki.exe
  2⤵
  PID:8552
- C:\Windows\System\tNBlSrg.exe
  C:\Windows\System\tNBlSrg.exe
  2⤵
  PID:8572
- C:\Windows\System\WJNHVOY.exe
  C:\Windows\System\WJNHVOY.exe
  2⤵
  PID:8592
- C:\Windows\System\HfUTJtQ.exe
  C:\Windows\System\HfUTJtQ.exe
  2⤵
  PID:8624
- C:\Windows\System\wrYEThv.exe
  C:\Windows\System\wrYEThv.exe
  2⤵
  PID:8648
- C:\Windows\System\jzCNtHn.exe
  C:\Windows\System\jzCNtHn.exe
  2⤵
  PID:8668
- C:\Windows\System\ZscVLQU.exe
  C:\Windows\System\ZscVLQU.exe
  2⤵
  PID:8704
- C:\Windows\System\upKIvht.exe
  C:\Windows\System\upKIvht.exe
  2⤵
  PID:8724
- C:\Windows\System\IxRHjtz.exe
  C:\Windows\System\IxRHjtz.exe
  2⤵
  PID:8744
- C:\Windows\System\RkUVQVF.exe
  C:\Windows\System\RkUVQVF.exe
  2⤵
  PID:8764
- C:\Windows\System\ABnmrZd.exe
  C:\Windows\System\ABnmrZd.exe
  2⤵
  PID:8804
- C:\Windows\System\pLqCsZc.exe
  C:\Windows\System\pLqCsZc.exe
  2⤵
  PID:8868
- C:\Windows\System\WXJmcoL.exe
  C:\Windows\System\WXJmcoL.exe
  2⤵
  PID:8900
- C:\Windows\System\IWZTKyi.exe
  C:\Windows\System\IWZTKyi.exe
  2⤵
  PID:8916
- C:\Windows\System\QtzUmzi.exe
  C:\Windows\System\QtzUmzi.exe
  2⤵
  PID:8944
- C:\Windows\System\wGJgXZO.exe
  C:\Windows\System\wGJgXZO.exe
  2⤵
  PID:8968
- C:\Windows\System\RYnCguE.exe
  C:\Windows\System\RYnCguE.exe
  2⤵
  PID:8988
- C:\Windows\System\jhHzOtq.exe
  C:\Windows\System\jhHzOtq.exe
  2⤵
  PID:9012
- C:\Windows\System\vlPmwCg.exe
  C:\Windows\System\vlPmwCg.exe
  2⤵
  PID:9036
- C:\Windows\System\QoPpLrD.exe
  C:\Windows\System\QoPpLrD.exe
  2⤵
  PID:9076
- C:\Windows\System\LenrPeZ.exe
  C:\Windows\System\LenrPeZ.exe
  2⤵
  PID:9108
- C:\Windows\System\kZYdKHA.exe
  C:\Windows\System\kZYdKHA.exe
  2⤵
  PID:9140
- C:\Windows\System\WogbOVi.exe
  C:\Windows\System\WogbOVi.exe
  2⤵
  PID:9164
- C:\Windows\System\WWbTAdb.exe
  C:\Windows\System\WWbTAdb.exe
  2⤵
  PID:9180
- C:\Windows\System\awgOBkO.exe
  C:\Windows\System\awgOBkO.exe
  2⤵
  PID:8200
- C:\Windows\System\wYjNuRP.exe
  C:\Windows\System\wYjNuRP.exe
  2⤵
  PID:8264
- C:\Windows\System\zGKHnxz.exe
  C:\Windows\System\zGKHnxz.exe
  2⤵
  PID:8224
- C:\Windows\System\OGkPJIY.exe
  C:\Windows\System\OGkPJIY.exe
  2⤵
  PID:1796
- C:\Windows\System\VKhAfxr.exe
  C:\Windows\System\VKhAfxr.exe
  2⤵
  PID:8404
- C:\Windows\System\fgMDWIb.exe
  C:\Windows\System\fgMDWIb.exe
  2⤵
  PID:8388
- C:\Windows\System\XviBbiy.exe
  C:\Windows\System\XviBbiy.exe
  2⤵
  PID:8476
- C:\Windows\System\UbUJeOQ.exe
  C:\Windows\System\UbUJeOQ.exe
  2⤵
  PID:8584
- C:\Windows\System\JxfjZeu.exe
  C:\Windows\System\JxfjZeu.exe
  2⤵
  PID:8620
- C:\Windows\System\BDJUfmB.exe
  C:\Windows\System\BDJUfmB.exe
  2⤵
  PID:8732
- C:\Windows\System\UxSyTVw.exe
  C:\Windows\System\UxSyTVw.exe
  2⤵
  PID:8756
- C:\Windows\System\rgfaqsa.exe
  C:\Windows\System\rgfaqsa.exe
  2⤵
  PID:8864
- C:\Windows\System\evMEXLK.exe
  C:\Windows\System\evMEXLK.exe
  2⤵
  PID:8880
- C:\Windows\System\eWCJLfY.exe
  C:\Windows\System\eWCJLfY.exe
  2⤵
  PID:8936
- C:\Windows\System\qBsXaNK.exe
  C:\Windows\System\qBsXaNK.exe
  2⤵
  PID:9084
- C:\Windows\System\YUyWSBc.exe
  C:\Windows\System\YUyWSBc.exe
  2⤵
  PID:9136
- C:\Windows\System\xcdelbE.exe
  C:\Windows\System\xcdelbE.exe
  2⤵
  PID:8172
- C:\Windows\System\RWtuuPd.exe
  C:\Windows\System\RWtuuPd.exe
  2⤵
  PID:9208
- C:\Windows\System\fEIJMrM.exe
  C:\Windows\System\fEIJMrM.exe
  2⤵
  PID:8364
- C:\Windows\System\PPbkGZe.exe
  C:\Windows\System\PPbkGZe.exe
  2⤵
  PID:8680
- C:\Windows\System\GQPbUne.exe
  C:\Windows\System\GQPbUne.exe
  2⤵
  PID:8700
- C:\Windows\System\VXUbrLS.exe
  C:\Windows\System\VXUbrLS.exe
  2⤵
  PID:8852
- C:\Windows\System\fQohPvr.exe
  C:\Windows\System\fQohPvr.exe
  2⤵
  PID:8940
- C:\Windows\System\zdxGEBM.exe
  C:\Windows\System\zdxGEBM.exe
  2⤵
  PID:9160
- C:\Windows\System\ZzcBIZh.exe
  C:\Windows\System\ZzcBIZh.exe
  2⤵
  PID:8048
- C:\Windows\System\lZRiJsd.exe
  C:\Windows\System\lZRiJsd.exe
  2⤵
  PID:8636
- C:\Windows\System\dkACORJ.exe
  C:\Windows\System\dkACORJ.exe
  2⤵
  PID:8980
- C:\Windows\System\dGbGAeJ.exe
  C:\Windows\System\dGbGAeJ.exe
  2⤵
  PID:9220
- C:\Windows\System\JDOWTHt.exe
  C:\Windows\System\JDOWTHt.exe
  2⤵
  PID:9316
- C:\Windows\System\PsHCMTN.exe
  C:\Windows\System\PsHCMTN.exe
  2⤵
  PID:9332
- C:\Windows\System\WSctbcl.exe
  C:\Windows\System\WSctbcl.exe
  2⤵
  PID:9348
- C:\Windows\System\BQIUDsU.exe
  C:\Windows\System\BQIUDsU.exe
  2⤵
  PID:9364
- C:\Windows\System\FOcNkri.exe
  C:\Windows\System\FOcNkri.exe
  2⤵
  PID:9380
- C:\Windows\System\xUoWBTQ.exe
  C:\Windows\System\xUoWBTQ.exe
  2⤵
  PID:9480
- C:\Windows\System\QMUDhMQ.exe
  C:\Windows\System\QMUDhMQ.exe
  2⤵
  PID:9496
- C:\Windows\System\ObqOsXD.exe
  C:\Windows\System\ObqOsXD.exe
  2⤵
  PID:9512
- C:\Windows\System\uyybPhz.exe
  C:\Windows\System\uyybPhz.exe
  2⤵
  PID:9528
- C:\Windows\System\GJynzPb.exe
  C:\Windows\System\GJynzPb.exe
  2⤵
  PID:9544
- C:\Windows\System\xoOLVeH.exe
  C:\Windows\System\xoOLVeH.exe
  2⤵
  PID:9564
- C:\Windows\System\YIsfQBz.exe
  C:\Windows\System\YIsfQBz.exe
  2⤵
  PID:9624
- C:\Windows\System\ZwZSZTu.exe
  C:\Windows\System\ZwZSZTu.exe
  2⤵
  PID:9696
- C:\Windows\System\vciLptY.exe
  C:\Windows\System\vciLptY.exe
  2⤵
  PID:9740
- C:\Windows\System\dZuKoMy.exe
  C:\Windows\System\dZuKoMy.exe
  2⤵
  PID:9764
- C:\Windows\System\IhYwqBy.exe
  C:\Windows\System\IhYwqBy.exe
  2⤵
  PID:9780
- C:\Windows\System\BevfvXv.exe
  C:\Windows\System\BevfvXv.exe
  2⤵
  PID:9816
- C:\Windows\System\UWAJyDh.exe
  C:\Windows\System\UWAJyDh.exe
  2⤵
  PID:9864
- C:\Windows\System\PaGYHRh.exe
  C:\Windows\System\PaGYHRh.exe
  2⤵
  PID:9892
- C:\Windows\System\cueYtqu.exe
  C:\Windows\System\cueYtqu.exe
  2⤵
  PID:9928
- C:\Windows\System\ffEihBJ.exe
  C:\Windows\System\ffEihBJ.exe
  2⤵
  PID:9948
- C:\Windows\System\sgPouOp.exe
  C:\Windows\System\sgPouOp.exe
  2⤵
  PID:9964
- C:\Windows\System\pMKVuxj.exe
  C:\Windows\System\pMKVuxj.exe
  2⤵
  PID:9984
- C:\Windows\System\hGPKSgO.exe
  C:\Windows\System\hGPKSgO.exe
  2⤵
  PID:10024
- C:\Windows\System\xRscxIA.exe
  C:\Windows\System\xRscxIA.exe
  2⤵
  PID:10048
- C:\Windows\System\bIlYygv.exe
  C:\Windows\System\bIlYygv.exe
  2⤵
  PID:10076
- C:\Windows\System\SWGxRFf.exe
  C:\Windows\System\SWGxRFf.exe
  2⤵
  PID:10096
- C:\Windows\System\XacvNbv.exe
  C:\Windows\System\XacvNbv.exe
  2⤵
  PID:10120
- C:\Windows\System\eutZIhh.exe
  C:\Windows\System\eutZIhh.exe
  2⤵
  PID:10140
- C:\Windows\System\MsVWCMl.exe
  C:\Windows\System\MsVWCMl.exe
  2⤵
  PID:10168
- C:\Windows\System\tlFaUUl.exe
  C:\Windows\System\tlFaUUl.exe
  2⤵
  PID:10184
- C:\Windows\System\dJdOmHT.exe
  C:\Windows\System\dJdOmHT.exe
  2⤵
  PID:10212
- C:\Windows\System\WsPOLAc.exe
  C:\Windows\System\WsPOLAc.exe
  2⤵
  PID:10232
- C:\Windows\System\BvttrzX.exe
  C:\Windows\System\BvttrzX.exe
  2⤵
  PID:8548
- C:\Windows\System\clrZtIs.exe
  C:\Windows\System\clrZtIs.exe
  2⤵
  PID:9288
- C:\Windows\System\wALydRW.exe
  C:\Windows\System\wALydRW.exe
  2⤵
  PID:9244
- C:\Windows\System\itHbDgK.exe
  C:\Windows\System\itHbDgK.exe
  2⤵
  PID:9412
- C:\Windows\System\nJkevLf.exe
  C:\Windows\System\nJkevLf.exe
  2⤵
  PID:9252
- C:\Windows\System\WIWybkT.exe
  C:\Windows\System\WIWybkT.exe
  2⤵
  PID:9436
- C:\Windows\System\pAEXIKx.exe
  C:\Windows\System\pAEXIKx.exe
  2⤵
  PID:9464
- C:\Windows\System\egdYtVT.exe
  C:\Windows\System\egdYtVT.exe
  2⤵
  PID:9408
- C:\Windows\System\ciwyJrG.exe
  C:\Windows\System\ciwyJrG.exe
  2⤵
  PID:9492
- C:\Windows\System\PKKoPCe.exe
  C:\Windows\System\PKKoPCe.exe
  2⤵
  PID:9620
- C:\Windows\System\zQSODVZ.exe
  C:\Windows\System\zQSODVZ.exe
  2⤵
  PID:9732
- C:\Windows\System\gAUAeCK.exe
  C:\Windows\System\gAUAeCK.exe
  2⤵
  PID:9788
- C:\Windows\System\HAjiaDy.exe
  C:\Windows\System\HAjiaDy.exe
  2⤵
  PID:9808
- C:\Windows\System\zabBDVH.exe
  C:\Windows\System\zabBDVH.exe
  2⤵
  PID:9844
- C:\Windows\System\zbSaKCF.exe
  C:\Windows\System\zbSaKCF.exe
  2⤵
  PID:9916
- C:\Windows\System\JyGZiam.exe
  C:\Windows\System\JyGZiam.exe
  2⤵
  PID:9596
- C:\Windows\System\Zlnvwpe.exe
  C:\Windows\System\Zlnvwpe.exe
  2⤵
  PID:10036
- C:\Windows\System\dCySgpK.exe
  C:\Windows\System\dCySgpK.exe
  2⤵
  PID:8632
- C:\Windows\System\BmbJQhK.exe
  C:\Windows\System\BmbJQhK.exe
  2⤵
  PID:8784
- C:\Windows\System\sAKCheM.exe
  C:\Windows\System\sAKCheM.exe
  2⤵
  PID:9452
- C:\Windows\System\WVXPIpM.exe
  C:\Windows\System\WVXPIpM.exe
  2⤵
  PID:9276
- C:\Windows\System\avSZyXV.exe
  C:\Windows\System\avSZyXV.exe
  2⤵
  PID:9488
- C:\Windows\System\bVmNqLC.exe
  C:\Windows\System\bVmNqLC.exe
  2⤵
  PID:9828
- C:\Windows\System\RElNaVk.exe
  C:\Windows\System\RElNaVk.exe
  2⤵
  PID:10004
- C:\Windows\System\GUxhYYG.exe
  C:\Windows\System\GUxhYYG.exe
  2⤵
  PID:9880
- C:\Windows\System\fbmINTs.exe
  C:\Windows\System\fbmINTs.exe
  2⤵
  PID:10068
- C:\Windows\System\kdinxHn.exe
  C:\Windows\System\kdinxHn.exe
  2⤵
  PID:10204
- C:\Windows\System\BVBGDFm.exe
  C:\Windows\System\BVBGDFm.exe
  2⤵
  PID:9444
- C:\Windows\System\GFHsdhK.exe
  C:\Windows\System\GFHsdhK.exe
  2⤵
  PID:9600
- C:\Windows\System\bxuWbuI.exe
  C:\Windows\System\bxuWbuI.exe
  2⤵
  PID:9960
- C:\Windows\System\trpmjrg.exe
  C:\Windows\System\trpmjrg.exe
  2⤵
  PID:9236
- C:\Windows\System\uIsXBRz.exe
  C:\Windows\System\uIsXBRz.exe
  2⤵
  PID:10260
- C:\Windows\System\POepFIQ.exe
  C:\Windows\System\POepFIQ.exe
  2⤵
  PID:10296
- C:\Windows\System\EZIfHrd.exe
  C:\Windows\System\EZIfHrd.exe
  2⤵
  PID:10316
- C:\Windows\System\jMgeNaE.exe
  C:\Windows\System\jMgeNaE.exe
  2⤵
  PID:10336
- C:\Windows\System\eCwbzik.exe
  C:\Windows\System\eCwbzik.exe
  2⤵
  PID:10384
- C:\Windows\System\mQzFFSM.exe
  C:\Windows\System\mQzFFSM.exe
  2⤵
  PID:10412
- C:\Windows\System\lxyokTc.exe
  C:\Windows\System\lxyokTc.exe
  2⤵
  PID:10432
- C:\Windows\System\uOqzZwe.exe
  C:\Windows\System\uOqzZwe.exe
  2⤵
  PID:10468
- C:\Windows\System\fFBuVHA.exe
  C:\Windows\System\fFBuVHA.exe
  2⤵
  PID:10508
- C:\Windows\System\UeXPEFR.exe
  C:\Windows\System\UeXPEFR.exe
  2⤵
  PID:10528
- C:\Windows\System\PkJZATj.exe
  C:\Windows\System\PkJZATj.exe
  2⤵
  PID:10560
- C:\Windows\System\RQMVDZf.exe
  C:\Windows\System\RQMVDZf.exe
  2⤵
  PID:10596
- C:\Windows\System\fgSCJwe.exe
  C:\Windows\System\fgSCJwe.exe
  2⤵
  PID:10616
- C:\Windows\System\cmbQoIq.exe
  C:\Windows\System\cmbQoIq.exe
  2⤵
  PID:10640
- C:\Windows\System\UzbhYjS.exe
  C:\Windows\System\UzbhYjS.exe
  2⤵
  PID:10684
- C:\Windows\System\eVfWhYV.exe
  C:\Windows\System\eVfWhYV.exe
  2⤵
  PID:10708
- C:\Windows\System\qXXdwHW.exe
  C:\Windows\System\qXXdwHW.exe
  2⤵
  PID:10728
- C:\Windows\System\myISzGM.exe
  C:\Windows\System\myISzGM.exe
  2⤵
  PID:10764
- C:\Windows\System\HlBIzpL.exe
  C:\Windows\System\HlBIzpL.exe
  2⤵
  PID:10784
- C:\Windows\System\UeXzMPs.exe
  C:\Windows\System\UeXzMPs.exe
  2⤵
  PID:10816
- C:\Windows\System\bdazzPE.exe
  C:\Windows\System\bdazzPE.exe
  2⤵
  PID:10836
- C:\Windows\System\vDnKSQj.exe
  C:\Windows\System\vDnKSQj.exe
  2⤵
  PID:10852
- C:\Windows\System\qJabPJH.exe
  C:\Windows\System\qJabPJH.exe
  2⤵
  PID:10880
- C:\Windows\System\xaXwsWb.exe
  C:\Windows\System\xaXwsWb.exe
  2⤵
  PID:10920
- C:\Windows\System\ftPSLRz.exe
  C:\Windows\System\ftPSLRz.exe
  2⤵
  PID:10944
- C:\Windows\System\AfLvVMB.exe
  C:\Windows\System\AfLvVMB.exe
  2⤵
  PID:10964
- C:\Windows\System\cJwDnPI.exe
  C:\Windows\System\cJwDnPI.exe
  2⤵
  PID:11008
- C:\Windows\System\SVYpRap.exe
  C:\Windows\System\SVYpRap.exe
  2⤵
  PID:11028
- C:\Windows\System\ZhsBzaS.exe
  C:\Windows\System\ZhsBzaS.exe
  2⤵
  PID:11064
- C:\Windows\System\DyPcvPT.exe
  C:\Windows\System\DyPcvPT.exe
  2⤵
  PID:11084
- C:\Windows\System\KrQeRbd.exe
  C:\Windows\System\KrQeRbd.exe
  2⤵
  PID:11116
- C:\Windows\System\LoyZxqS.exe
  C:\Windows\System\LoyZxqS.exe
  2⤵
  PID:11184
- C:\Windows\System\gQjdNPq.exe
  C:\Windows\System\gQjdNPq.exe
  2⤵
  PID:11204
- C:\Windows\System\HuYSaGT.exe
  C:\Windows\System\HuYSaGT.exe
  2⤵
  PID:11224
- C:\Windows\System\jmEdqzx.exe
  C:\Windows\System\jmEdqzx.exe
  2⤵
  PID:11248
- C:\Windows\System\aFnLXYq.exe
  C:\Windows\System\aFnLXYq.exe
  2⤵
  PID:9944
- C:\Windows\System\IIlNEaW.exe
  C:\Windows\System\IIlNEaW.exe
  2⤵
  PID:10292
- C:\Windows\System\FQKCdCJ.exe
  C:\Windows\System\FQKCdCJ.exe
  2⤵
  PID:10396
- C:\Windows\System\osaJgby.exe
  C:\Windows\System\osaJgby.exe
  2⤵
  PID:10392
- C:\Windows\System\RCtsPvz.exe
  C:\Windows\System\RCtsPvz.exe
  2⤵
  PID:10476
- C:\Windows\System\LQQnMCW.exe
  C:\Windows\System\LQQnMCW.exe
  2⤵
  PID:10524
- C:\Windows\System\GCeCcQq.exe
  C:\Windows\System\GCeCcQq.exe
  2⤵
  PID:10636
- C:\Windows\System\MZgcZhK.exe
  C:\Windows\System\MZgcZhK.exe
  2⤵
  PID:10660
- C:\Windows\System\ZXXmYRA.exe
  C:\Windows\System\ZXXmYRA.exe
  2⤵
  PID:10720
- C:\Windows\System\NdcneJm.exe
  C:\Windows\System\NdcneJm.exe
  2⤵
  PID:10824
- C:\Windows\System\YXAnKQV.exe
  C:\Windows\System\YXAnKQV.exe
  2⤵
  PID:10888
- C:\Windows\System\ZdoXzaw.exe
  C:\Windows\System\ZdoXzaw.exe
  2⤵
  PID:10872
- C:\Windows\System\TCTcpGD.exe
  C:\Windows\System\TCTcpGD.exe
  2⤵
  PID:11016
- C:\Windows\System\DSENKZI.exe
  C:\Windows\System\DSENKZI.exe
  2⤵
  PID:11056
- C:\Windows\System\RRvrAtN.exe
  C:\Windows\System\RRvrAtN.exe
  2⤵
  PID:11108
- C:\Windows\System\izbTdQa.exe
  C:\Windows\System\izbTdQa.exe
  2⤵
  PID:11180
- C:\Windows\System\lPwMTxC.exe
  C:\Windows\System\lPwMTxC.exe
  2⤵
  PID:11212
- C:\Windows\System\BBJgYDc.exe
  C:\Windows\System\BBJgYDc.exe
  2⤵
  PID:10288
- C:\Windows\System\KbofmXZ.exe
  C:\Windows\System\KbofmXZ.exe
  2⤵
  PID:10332
- C:\Windows\System\MfAKRHE.exe
  C:\Windows\System\MfAKRHE.exe
  2⤵
  PID:10556
- C:\Windows\System\sLrQkRt.exe
  C:\Windows\System\sLrQkRt.exe
  2⤵
  PID:10580
- C:\Windows\System\mCcTssI.exe
  C:\Windows\System\mCcTssI.exe
  2⤵
  PID:10676
- C:\Windows\System\flMFVYK.exe
  C:\Windows\System\flMFVYK.exe
  2⤵
  PID:10956
- C:\Windows\System\BNfxaph.exe
  C:\Windows\System\BNfxaph.exe
  2⤵
  PID:11132
- C:\Windows\System\YfUPjbB.exe
  C:\Windows\System\YfUPjbB.exe
  2⤵
  PID:10284
- C:\Windows\System\yhXCeYL.exe
  C:\Windows\System\yhXCeYL.exe
  2⤵
  PID:10672
- C:\Windows\System\pwyabft.exe
  C:\Windows\System\pwyabft.exe
  2⤵
  PID:11172
- C:\Windows\System\kkxmALg.exe
  C:\Windows\System\kkxmALg.exe
  2⤵
  PID:11220
- C:\Windows\System\auhckzw.exe
  C:\Windows\System\auhckzw.exe
  2⤵
  PID:10612
- C:\Windows\System\VLWnhEY.exe
  C:\Windows\System\VLWnhEY.exe
  2⤵
  PID:11300
- C:\Windows\System\YVAZUso.exe
  C:\Windows\System\YVAZUso.exe
  2⤵
  PID:11332
- C:\Windows\System\QoicyIF.exe
  C:\Windows\System\QoicyIF.exe
  2⤵
  PID:11352
- C:\Windows\System\sLozvsd.exe
  C:\Windows\System\sLozvsd.exe
  2⤵
  PID:11380
- C:\Windows\System\gLauSAD.exe
  C:\Windows\System\gLauSAD.exe
  2⤵
  PID:11396
- C:\Windows\System\GGDHltZ.exe
  C:\Windows\System\GGDHltZ.exe
  2⤵
  PID:11436
- C:\Windows\System\IxgEPGF.exe
  C:\Windows\System\IxgEPGF.exe
  2⤵
  PID:11468
- C:\Windows\System\WroNWAe.exe
  C:\Windows\System\WroNWAe.exe
  2⤵
  PID:11496
- C:\Windows\System\HnRtFiU.exe
  C:\Windows\System\HnRtFiU.exe
  2⤵
  PID:11516
- C:\Windows\System\OvpIBZP.exe
  C:\Windows\System\OvpIBZP.exe
  2⤵
  PID:11540
- C:\Windows\System\LLCpmXT.exe
  C:\Windows\System\LLCpmXT.exe
  2⤵
  PID:11560
- C:\Windows\System\kugsfOR.exe
  C:\Windows\System\kugsfOR.exe
  2⤵
  PID:11588
- C:\Windows\System\LEJcUIK.exe
  C:\Windows\System\LEJcUIK.exe
  2⤵
  PID:11608
- C:\Windows\System\VLtJdYC.exe
  C:\Windows\System\VLtJdYC.exe
  2⤵
  PID:11636
- C:\Windows\System\ykcUBHY.exe
  C:\Windows\System\ykcUBHY.exe
  2⤵
  PID:11656
- C:\Windows\System\egjHsWA.exe
  C:\Windows\System\egjHsWA.exe
  2⤵
  PID:11680
- C:\Windows\System\xzEziOv.exe
  C:\Windows\System\xzEziOv.exe
  2⤵
  PID:11704
- C:\Windows\System\FDTYzzq.exe
  C:\Windows\System\FDTYzzq.exe
  2⤵
  PID:11720
- C:\Windows\System\stHuaDR.exe
  C:\Windows\System\stHuaDR.exe
  2⤵
  PID:11740
- C:\Windows\System\sUoVnBt.exe
  C:\Windows\System\sUoVnBt.exe
  2⤵
  PID:11756
- C:\Windows\System\MMemEgC.exe
  C:\Windows\System\MMemEgC.exe
  2⤵
  PID:11780
- C:\Windows\System\gsjVrLi.exe
  C:\Windows\System\gsjVrLi.exe
  2⤵
  PID:11816
- C:\Windows\System\dpiNtqV.exe
  C:\Windows\System\dpiNtqV.exe
  2⤵
  PID:11852
- C:\Windows\System\DnZgMfY.exe
  C:\Windows\System\DnZgMfY.exe
  2⤵
  PID:11876
- C:\Windows\System\cwywimc.exe
  C:\Windows\System\cwywimc.exe
  2⤵
  PID:11892
- C:\Windows\System\KnYHbTH.exe
  C:\Windows\System\KnYHbTH.exe
  2⤵
  PID:11952
- C:\Windows\System\ksDjLCm.exe
  C:\Windows\System\ksDjLCm.exe
  2⤵
  PID:12032
- C:\Windows\System\XGbwNhW.exe
  C:\Windows\System\XGbwNhW.exe
  2⤵
  PID:12048
- C:\Windows\System\sVJXVCT.exe
  C:\Windows\System\sVJXVCT.exe
  2⤵
  PID:12068
- C:\Windows\System\rqqGZPz.exe
  C:\Windows\System\rqqGZPz.exe
  2⤵
  PID:12084
- C:\Windows\System\zkWCcri.exe
  C:\Windows\System\zkWCcri.exe
  2⤵
  PID:12108
- C:\Windows\System\jSRiOzO.exe
  C:\Windows\System\jSRiOzO.exe
  2⤵
  PID:12124
- C:\Windows\System\tHHjbKZ.exe
  C:\Windows\System\tHHjbKZ.exe
  2⤵
  PID:12144
- C:\Windows\System\qpMRNTn.exe
  C:\Windows\System\qpMRNTn.exe
  2⤵
  PID:12164
- C:\Windows\System\nkrODvr.exe
  C:\Windows\System\nkrODvr.exe
  2⤵
  PID:12216
- C:\Windows\System\iFrBelI.exe
  C:\Windows\System\iFrBelI.exe
  2⤵
  PID:12248
- C:\Windows\System\mDQRZQv.exe
  C:\Windows\System\mDQRZQv.exe
  2⤵
  PID:10372
- C:\Windows\System\faIqBGO.exe
  C:\Windows\System\faIqBGO.exe
  2⤵
  PID:11340
- C:\Windows\System\FrOXqPW.exe
  C:\Windows\System\FrOXqPW.exe
  2⤵
  PID:11392
- C:\Windows\System\ehAwVSg.exe
  C:\Windows\System\ehAwVSg.exe
  2⤵
  PID:11480
- C:\Windows\System\bnYBpvq.exe
  C:\Windows\System\bnYBpvq.exe
  2⤵
  PID:11512
- C:\Windows\System\pyOICEC.exe
  C:\Windows\System\pyOICEC.exe
  2⤵
  PID:11604
- C:\Windows\System\KGczDaS.exe
  C:\Windows\System\KGczDaS.exe
  2⤵
  PID:11572
- C:\Windows\System\SNhGXqC.exe
  C:\Windows\System\SNhGXqC.exe
  2⤵
  PID:11668
- C:\Windows\System\LuCghuS.exe
  C:\Windows\System\LuCghuS.exe
  2⤵
  PID:11748
- C:\Windows\System\bFeUPLa.exe
  C:\Windows\System\bFeUPLa.exe
  2⤵
  PID:11796
- C:\Windows\System\CgaeNsE.exe
  C:\Windows\System\CgaeNsE.exe
  2⤵
  PID:11868
- C:\Windows\System\ViDXnxK.exe
  C:\Windows\System\ViDXnxK.exe
  2⤵
  PID:11884
- C:\Windows\System\MyGlSis.exe
  C:\Windows\System\MyGlSis.exe
  2⤵
  PID:12004
- C:\Windows\System\DKUIIUg.exe
  C:\Windows\System\DKUIIUg.exe
  2⤵
  PID:12080
- C:\Windows\System\ThVGZhy.exe
  C:\Windows\System\ThVGZhy.exe
  2⤵
  PID:12184
- C:\Windows\System\JPxSEZk.exe
  C:\Windows\System\JPxSEZk.exe
  2⤵
  PID:12228
- C:\Windows\System\XGmoizd.exe
  C:\Windows\System\XGmoizd.exe
  2⤵
  PID:1620
- C:\Windows\System\RcuTGqw.exe
  C:\Windows\System\RcuTGqw.exe
  2⤵
  PID:11324
- C:\Windows\System\ZnauiUt.exe
  C:\Windows\System\ZnauiUt.exe
  2⤵
  PID:11416
- C:\Windows\System\WOuZalB.exe
  C:\Windows\System\WOuZalB.exe
  2⤵
  PID:11508
- C:\Windows\System\DerhUfS.exe
  C:\Windows\System\DerhUfS.exe
  2⤵
  PID:11524
- C:\Windows\System\xkOeATq.exe
  C:\Windows\System\xkOeATq.exe
  2⤵
  PID:4088
- C:\Windows\System\rhhYvGO.exe
  C:\Windows\System\rhhYvGO.exe
  2⤵
  PID:11848
- C:\Windows\System\nnOTrCN.exe
  C:\Windows\System\nnOTrCN.exe
  2⤵
  PID:12064
- C:\Windows\System\EloHANw.exe
  C:\Windows\System\EloHANw.exe
  2⤵
  PID:12100
- C:\Windows\System\QGwwtdJ.exe
  C:\Windows\System\QGwwtdJ.exe
  2⤵
  PID:11268
- C:\Windows\System\weHVbhj.exe
  C:\Windows\System\weHVbhj.exe
  2⤵
  PID:11624
- C:\Windows\System\gRvLlik.exe
  C:\Windows\System\gRvLlik.exe
  2⤵
  PID:12120
- C:\Windows\System\oaMbmjm.exe
  C:\Windows\System\oaMbmjm.exe
  2⤵
  PID:12044
- C:\Windows\System\OpQrejY.exe
  C:\Windows\System\OpQrejY.exe
  2⤵
  PID:12296
- C:\Windows\System\tYaWsMF.exe
  C:\Windows\System\tYaWsMF.exe
  2⤵
  PID:12336
- C:\Windows\System\QYUlXCI.exe
  C:\Windows\System\QYUlXCI.exe
  2⤵
  PID:12364
- C:\Windows\System\zErvERh.exe
  C:\Windows\System\zErvERh.exe
  2⤵
  PID:12388
- C:\Windows\System\wknZbNY.exe
  C:\Windows\System\wknZbNY.exe
  2⤵
  PID:12424
- C:\Windows\System\PvfIsSR.exe
  C:\Windows\System\PvfIsSR.exe
  2⤵
  PID:12444
- C:\Windows\System\gURJObe.exe
  C:\Windows\System\gURJObe.exe
  2⤵
  PID:12484
- C:\Windows\System\HvRAmWp.exe
  C:\Windows\System\HvRAmWp.exe
  2⤵
  PID:12512
- C:\Windows\System\eFyyoch.exe
  C:\Windows\System\eFyyoch.exe
  2⤵
  PID:12544
- C:\Windows\System\PINGQOH.exe
  C:\Windows\System\PINGQOH.exe
  2⤵
  PID:12564
- C:\Windows\System\jsMOxbO.exe
  C:\Windows\System\jsMOxbO.exe
  2⤵
  PID:12604
- C:\Windows\System\LVOXrzq.exe
  C:\Windows\System\LVOXrzq.exe
  2⤵
  PID:12632
- C:\Windows\System\giSuOcl.exe
  C:\Windows\System\giSuOcl.exe
  2⤵
  PID:12680
- C:\Windows\System\voCyTrQ.exe
  C:\Windows\System\voCyTrQ.exe
  2⤵
  PID:12696
- C:\Windows\System\etWoOSH.exe
  C:\Windows\System\etWoOSH.exe
  2⤵
  PID:12720
- C:\Windows\System\oyYZyvK.exe
  C:\Windows\System\oyYZyvK.exe
  2⤵
  PID:12740
- C:\Windows\System\xUPoqQV.exe
  C:\Windows\System\xUPoqQV.exe
  2⤵
  PID:12760
- C:\Windows\System\KNuiogn.exe
  C:\Windows\System\KNuiogn.exe
  2⤵
  PID:12796
- C:\Windows\System\DBdnYYs.exe
  C:\Windows\System\DBdnYYs.exe
  2⤵
  PID:12844
- C:\Windows\System\mXoCnjZ.exe
  C:\Windows\System\mXoCnjZ.exe
  2⤵
  PID:12876
- C:\Windows\System\NUXSdqU.exe
  C:\Windows\System\NUXSdqU.exe
  2⤵
  PID:12896
- C:\Windows\System\QUzTsHF.exe
  C:\Windows\System\QUzTsHF.exe
  2⤵
  PID:12924
- C:\Windows\System\qsRmzmi.exe
  C:\Windows\System\qsRmzmi.exe
  2⤵
  PID:12948
- C:\Windows\System\ketGaAn.exe
  C:\Windows\System\ketGaAn.exe
  2⤵
  PID:12964
- C:\Windows\System\JbWpoxd.exe
  C:\Windows\System\JbWpoxd.exe
  2⤵
  PID:12980
- C:\Windows\System\hHZcoln.exe
  C:\Windows\System\hHZcoln.exe
  2⤵
  PID:13008
- C:\Windows\System\UaLKrmh.exe
  C:\Windows\System\UaLKrmh.exe
  2⤵
  PID:13032
- C:\Windows\System\lZNfugM.exe
  C:\Windows\System\lZNfugM.exe
  2⤵
  PID:13052
- C:\Windows\System\hdxUQsN.exe
  C:\Windows\System\hdxUQsN.exe
  2⤵
  PID:13068
- C:\Windows\System\bDoVHrK.exe
  C:\Windows\System\bDoVHrK.exe
  2⤵
  PID:13120
- C:\Windows\System\AeGwLPG.exe
  C:\Windows\System\AeGwLPG.exe
  2⤵
  PID:13188
- C:\Windows\System\aAvwXRj.exe
  C:\Windows\System\aAvwXRj.exe
  2⤵
  PID:13232
- C:\Windows\System\XhfSjrj.exe
  C:\Windows\System\XhfSjrj.exe
  2⤵
  PID:13256
- C:\Windows\System\tSUhyXJ.exe
  C:\Windows\System\tSUhyXJ.exe
  2⤵
  PID:13272
- C:\Windows\System\uQvKSOx.exe
  C:\Windows\System\uQvKSOx.exe
  2⤵
  PID:13308
- C:\Windows\System\umCPwUr.exe
  C:\Windows\System\umCPwUr.exe
  2⤵
  PID:12040
- C:\Windows\System\vbuaZeU.exe
  C:\Windows\System\vbuaZeU.exe
  2⤵
  PID:3420
- C:\Windows\System\CkSUFIF.exe
  C:\Windows\System\CkSUFIF.exe
  2⤵
  PID:12312
- C:\Windows\System\EsKcvwC.exe
  C:\Windows\System\EsKcvwC.exe
  2⤵
  PID:12352
- C:\Windows\System\iQwMSlN.exe
  C:\Windows\System\iQwMSlN.exe
  2⤵
  PID:12416
- C:\Windows\System\JWAjDqq.exe
  C:\Windows\System\JWAjDqq.exe
  2⤵
  PID:12436
- C:\Windows\System\RROoMfE.exe
  C:\Windows\System\RROoMfE.exe
  2⤵
  PID:12956
- C:\Windows\System\pfTTrwR.exe
  C:\Windows\System\pfTTrwR.exe
  2⤵
  PID:12972
- C:\Windows\System\dHRsBhP.exe
  C:\Windows\System\dHRsBhP.exe
  2⤵
  PID:2088
- C:\Windows\System\dkgNIuR.exe
  C:\Windows\System\dkgNIuR.exe
  2⤵
  PID:12556
- C:\Windows\System\rmFZyIw.exe
  C:\Windows\System\rmFZyIw.exe
  2⤵
  PID:11444
- C:\Windows\System\GjmGrVS.exe
  C:\Windows\System\GjmGrVS.exe
  2⤵
  PID:2748
- C:\Windows\System\NLBQJIH.exe
  C:\Windows\System\NLBQJIH.exe
  2⤵
  PID:12776
- C:\Windows\System\hdkqiMb.exe
  C:\Windows\System\hdkqiMb.exe
  2⤵
  PID:12728
- C:\Windows\System\wmDkLJT.exe
  C:\Windows\System\wmDkLJT.exe
  2⤵
  PID:13076
- C:\Windows\System\AoUYPov.exe
  C:\Windows\System\AoUYPov.exe
  2⤵
  PID:4984
- C:\Windows\System\krzLLUk.exe
  C:\Windows\System\krzLLUk.exe
  2⤵
  PID:4204
- C:\Windows\System\VKUlyVG.exe
  C:\Windows\System\VKUlyVG.exe
  2⤵
  PID:1164
- C:\Windows\System\QIdpXxi.exe
  C:\Windows\System\QIdpXxi.exe
  2⤵
  PID:1884
- C:\Windows\System\bFMOeej.exe
  C:\Windows\System\bFMOeej.exe
  2⤵
  PID:4328
- C:\Windows\System\kYmswsS.exe
  C:\Windows\System\kYmswsS.exe
  2⤵
  PID:13144
- C:\Windows\System\KfnHfQG.exe
  C:\Windows\System\KfnHfQG.exe
  2⤵
  PID:5420
- C:\Windows\System\MDhxRMJ.exe
  C:\Windows\System\MDhxRMJ.exe
  2⤵
  PID:540
- C:\Windows\System\GSBPgyv.exe
  C:\Windows\System\GSBPgyv.exe
  2⤵
  PID:6096
- C:\Windows\System\FpTeshz.exe
  C:\Windows\System\FpTeshz.exe
  2⤵
  PID:13268
- C:\Windows\System\GcyTvWI.exe
  C:\Windows\System\GcyTvWI.exe
  2⤵
  PID:5192
- C:\Windows\System\xZrXmcv.exe
  C:\Windows\System\xZrXmcv.exe
  2⤵
  PID:12400
- C:\Windows\System\feqcrbc.exe
  C:\Windows\System\feqcrbc.exe
  2⤵
  PID:12316
- C:\Windows\System\rELGoSV.exe
  C:\Windows\System\rELGoSV.exe
  2⤵
  PID:6040
- C:\Windows\System\lCabcdA.exe
  C:\Windows\System\lCabcdA.exe
  2⤵
  PID:12472
- C:\Windows\System\XqjBper.exe
  C:\Windows\System\XqjBper.exe
  2⤵
  PID:2264
- C:\Windows\System\iSAVmbn.exe
  C:\Windows\System\iSAVmbn.exe
  2⤵
  PID:5332
- C:\Windows\System\qxUrxhe.exe
  C:\Windows\System\qxUrxhe.exe
  2⤵
  PID:3376
- C:\Windows\System\Tjqrmxs.exe
  C:\Windows\System\Tjqrmxs.exe
  2⤵
  PID:6288
- C:\Windows\System\JyyRamb.exe
  C:\Windows\System\JyyRamb.exe
  2⤵
  PID:4256
- C:\Windows\System\wQDXLUc.exe
  C:\Windows\System\wQDXLUc.exe
  2⤵
  PID:5436
- C:\Windows\System\KSjFIOQ.exe
  C:\Windows\System\KSjFIOQ.exe
  2⤵
  PID:4404
- C:\Windows\System\UuxIkDX.exe
  C:\Windows\System\UuxIkDX.exe
  2⤵
  PID:13040
- C:\Windows\System\rQCWgry.exe
  C:\Windows\System\rQCWgry.exe
  2⤵
  PID:7296
- C:\Windows\System\tXNKMZy.exe
  C:\Windows\System\tXNKMZy.exe
  2⤵
  PID:1708
- C:\Windows\System\sBDKsng.exe
  C:\Windows\System\sBDKsng.exe
  2⤵
  PID:6456
- C:\Windows\System\cDKiWtP.exe
  C:\Windows\System\cDKiWtP.exe
  2⤵
  PID:12656
- C:\Windows\System\imSMCro.exe
  C:\Windows\System\imSMCro.exe
  2⤵
  PID:5920
- C:\Windows\System\aEBoVAo.exe
  C:\Windows\System\aEBoVAo.exe
  2⤵
  PID:4924
- C:\Windows\System\weXcJiQ.exe
  C:\Windows\System\weXcJiQ.exe
  2⤵
  PID:12888
- C:\Windows\System\hmBXdQl.exe
  C:\Windows\System\hmBXdQl.exe
  2⤵
  PID:13064
- C:\Windows\System\pkOmBGO.exe
  C:\Windows\System\pkOmBGO.exe
  2⤵
  PID:796
- C:\Windows\System\TKaGTFm.exe
  C:\Windows\System\TKaGTFm.exe
  2⤵
  PID:1372
- C:\Windows\System\UzRdzCA.exe
  C:\Windows\System\UzRdzCA.exe
  2⤵
  PID:12704
- C:\Windows\System\jItUOrG.exe
  C:\Windows\System\jItUOrG.exe
  2⤵
  PID:7180
- C:\Windows\System\VJRcSUl.exe
  C:\Windows\System\VJRcSUl.exe
  2⤵
  PID:4864
- C:\Windows\System\nKjKRGt.exe
  C:\Windows\System\nKjKRGt.exe
  2⤵
  PID:8356
- C:\Windows\System\ywSVxVB.exe
  C:\Windows\System\ywSVxVB.exe
  2⤵
  PID:4792
- C:\Windows\System\BldOfht.exe
  C:\Windows\System\BldOfht.exe
  2⤵
  PID:2228
- C:\Windows\System\ygnamqV.exe
  C:\Windows\System\ygnamqV.exe
  2⤵
  PID:13280
- C:\Windows\System\ZyhMYRg.exe
  C:\Windows\System\ZyhMYRg.exe
  2⤵
  PID:7452
- C:\Windows\System\yzUYyNS.exe
  C:\Windows\System\yzUYyNS.exe
  2⤵
  PID:4432
- C:\Windows\System\fpEMArm.exe
  C:\Windows\System\fpEMArm.exe
  2⤵
  PID:6140
- C:\Windows\System\wGccaJp.exe
  C:\Windows\System\wGccaJp.exe
  2⤵
  PID:1216
- C:\Windows\System\hMxzvNX.exe
  C:\Windows\System\hMxzvNX.exe
  2⤵
  PID:8676
- C:\Windows\System\gpUTQhU.exe
  C:\Windows\System\gpUTQhU.exe
  2⤵
  PID:5364
- C:\Windows\System\nCIzfhc.exe
  C:\Windows\System\nCIzfhc.exe
  2⤵
  PID:2204
- C:\Windows\System\XinsHRU.exe
  C:\Windows\System\XinsHRU.exe
  2⤵
  PID:8024
- C:\Windows\System\dyBVeVl.exe
  C:\Windows\System\dyBVeVl.exe
  2⤵
  PID:6748
- C:\Windows\System\LwKMQMx.exe
  C:\Windows\System\LwKMQMx.exe
  2⤵
  PID:7264
- C:\Windows\System\NMbsnfb.exe
  C:\Windows\System\NMbsnfb.exe
  2⤵
  PID:8032
- C:\Windows\System\anCxmNF.exe
  C:\Windows\System\anCxmNF.exe
  2⤵
  PID:12712
- C:\Windows\System\TUTkUPR.exe
  C:\Windows\System\TUTkUPR.exe
  2⤵
  PID:6868
- C:\Windows\System\OckGQSR.exe
  C:\Windows\System\OckGQSR.exe
  2⤵
  PID:4272
- C:\Windows\System\YQnDHmL.exe
  C:\Windows\System\YQnDHmL.exe
  2⤵
  PID:9096
- C:\Windows\System\iqBEfMo.exe
  C:\Windows\System\iqBEfMo.exe
  2⤵
  PID:1500
- C:\Windows\System\KFGmzoX.exe
  C:\Windows\System\KFGmzoX.exe
  2⤵
  PID:4160
- C:\Windows\System\KLawdna.exe
  C:\Windows\System\KLawdna.exe
  2⤵
  PID:9192
- C:\Windows\System\TDRQUpF.exe
  C:\Windows\System\TDRQUpF.exe
  2⤵
  PID:4972
- C:\Windows\System\TUUecUv.exe
  C:\Windows\System\TUUecUv.exe
  2⤵
  PID:3120
- C:\Windows\System\KYwuxtO.exe
  C:\Windows\System\KYwuxtO.exe
  2⤵
  PID:4968
- C:\Windows\System\zUPNBcI.exe
  C:\Windows\System\zUPNBcI.exe
  2⤵
  PID:8840
- C:\Windows\System\XrAfOOd.exe
  C:\Windows\System\XrAfOOd.exe
  2⤵
  PID:7052
- C:\Windows\System\HYbzniq.exe
  C:\Windows\System\HYbzniq.exe
  2⤵
  PID:7876
- C:\Windows\System\VBdYYUJ.exe
  C:\Windows\System\VBdYYUJ.exe
  2⤵
  PID:988
- C:\Windows\System\YcLaxhq.exe
  C:\Windows\System\YcLaxhq.exe
  2⤵
  PID:4212
- C:\Windows\System\UTJmsHu.exe
  C:\Windows\System\UTJmsHu.exe
  2⤵
  PID:3024
- C:\Windows\System\gUkGJMt.exe
  C:\Windows\System\gUkGJMt.exe
  2⤵
  PID:2028
- C:\Windows\System\hUxXytU.exe
  C:\Windows\System\hUxXytU.exe
  2⤵
  PID:12816
- C:\Windows\System\jCkHgnp.exe
  C:\Windows\System\jCkHgnp.exe
  2⤵
  PID:3212
- C:\Windows\System\iZlTTtv.exe
  C:\Windows\System\iZlTTtv.exe
  2⤵
  PID:9020
- C:\Windows\System\nkxrUZV.exe
  C:\Windows\System\nkxrUZV.exe
  2⤵
  PID:9052
- C:\Windows\System\KYOubbc.exe
  C:\Windows\System\KYOubbc.exe
  2⤵
  PID:2936
- C:\Windows\System\WQPMXJo.exe
  C:\Windows\System\WQPMXJo.exe
  2⤵
  PID:2888
- C:\Windows\System\GeuLLau.exe
  C:\Windows\System\GeuLLau.exe
  2⤵
  PID:9792
- C:\Windows\System\ChnIoXk.exe
  C:\Windows\System\ChnIoXk.exe
  2⤵
  PID:1396
- C:\Windows\System\mJmNLaR.exe
  C:\Windows\System\mJmNLaR.exe
  2⤵
  PID:9900
- C:\Windows\System\dhSQyaJ.exe
  C:\Windows\System\dhSQyaJ.exe
  2⤵
  PID:4348
- C:\Windows\System\ICMzoEF.exe
  C:\Windows\System\ICMzoEF.exe
  2⤵
  PID:3256
- C:\Windows\System\YOWHwGw.exe
  C:\Windows\System\YOWHwGw.exe
  2⤵
  PID:2468
- C:\Windows\System\zYKmQNf.exe
  C:\Windows\System\zYKmQNf.exe
  2⤵
  PID:3884
- C:\Windows\System\uSBLUHQ.exe
  C:\Windows\System\uSBLUHQ.exe
  2⤵
  PID:5240
- C:\Windows\System\dDifVck.exe
  C:\Windows\System\dDifVck.exe
  2⤵
  PID:5380
- C:\Windows\System\DxFAUks.exe
  C:\Windows\System\DxFAUks.exe
  2⤵
  PID:5536
- C:\Windows\System\spYEqKH.exe
  C:\Windows\System\spYEqKH.exe
  2⤵
  PID:10664
- C:\Windows\System\PrmlxNV.exe
  C:\Windows\System\PrmlxNV.exe
  2⤵
  PID:5716
- C:\Windows\System\pFhynnv.exe
  C:\Windows\System\pFhynnv.exe
  2⤵
  PID:2496
- C:\Windows\System\HwITauL.exe
  C:\Windows\System\HwITauL.exe
  2⤵
  PID:212
- C:\Windows\System\XrpTcvU.exe
  C:\Windows\System\XrpTcvU.exe
  2⤵
  PID:5352
- C:\Windows\System\IscOMjb.exe
  C:\Windows\System\IscOMjb.exe
  2⤵
  PID:1004
- C:\Windows\System\BqptWCm.exe
  C:\Windows\System\BqptWCm.exe
  2⤵
  PID:9116
- C:\Windows\System\maWvYFs.exe
  C:\Windows\System\maWvYFs.exe
  2⤵
  PID:10996
- C:\Windows\System\dkXqkml.exe
  C:\Windows\System\dkXqkml.exe
  2⤵
  PID:4996
- C:\Windows\System\fJZqjVX.exe
  C:\Windows\System\fJZqjVX.exe
  2⤵
  PID:5648
- C:\Windows\System\ijARYpY.exe
  C:\Windows\System\ijARYpY.exe
  2⤵
  PID:3704
- C:\Windows\System\mSkARwP.exe
  C:\Windows\System\mSkARwP.exe
  2⤵
  PID:9104
- C:\Windows\System\NAbndFT.exe
  C:\Windows\System\NAbndFT.exe
  2⤵
  PID:2904
- C:\Windows\System\xKckqxw.exe
  C:\Windows\System\xKckqxw.exe
  2⤵
  PID:8532
- C:\Windows\System\YoTOURL.exe
  C:\Windows\System\YoTOURL.exe
  2⤵
  PID:8252
- C:\Windows\System\aeQhOdW.exe
  C:\Windows\System\aeQhOdW.exe
  2⤵
  PID:12376
- C:\Windows\System\IXWOzrG.exe
  C:\Windows\System\IXWOzrG.exe
  2⤵
  PID:2328
- C:\Windows\System\nZHSmQP.exe
  C:\Windows\System\nZHSmQP.exe
  2⤵
  PID:1768
- C:\Windows\System\CyLdWoX.exe
  C:\Windows\System\CyLdWoX.exe
  2⤵
  PID:6908
- C:\Windows\System\RPnBmQu.exe
  C:\Windows\System\RPnBmQu.exe
  2⤵
  PID:12468
- C:\Windows\System\AIOLlHy.exe
  C:\Windows\System\AIOLlHy.exe
  2⤵
  PID:8540
- C:\Windows\System\CLKEWpG.exe
  C:\Windows\System\CLKEWpG.exe
  2⤵
  PID:12500
- C:\Windows\System\yxjUwpx.exe
  C:\Windows\System\yxjUwpx.exe
  2⤵
  PID:1328
- C:\Windows\System\BQcuKvT.exe
  C:\Windows\System\BQcuKvT.exe
  2⤵
  PID:11804
- C:\Windows\System\IPiLeXz.exe
  C:\Windows\System\IPiLeXz.exe
  2⤵
  PID:736
- C:\Windows\System\hxyuzIF.exe
  C:\Windows\System\hxyuzIF.exe
  2⤵
  PID:12620
- C:\Windows\System\QpQeagv.exe
  C:\Windows\System\QpQeagv.exe
  2⤵
  PID:8616
- C:\Windows\System\gFBROSc.exe
  C:\Windows\System\gFBROSc.exe
  2⤵
  PID:10864
- C:\Windows\System\YKdPAdj.exe
  C:\Windows\System\YKdPAdj.exe
  2⤵
  PID:5564
- C:\Windows\System\NUZCAEp.exe
  C:\Windows\System\NUZCAEp.exe
  2⤵
  PID:3880
- C:\Windows\System\opZIViI.exe
  C:\Windows\System\opZIViI.exe
  2⤵
  PID:2452
- C:\Windows\System\MJISmmd.exe
  C:\Windows\System\MJISmmd.exe
  2⤵
  PID:4868
- C:\Windows\System\hBHwFWq.exe
  C:\Windows\System\hBHwFWq.exe
  2⤵
  PID:12808
- C:\Windows\System\iPFOwPh.exe
  C:\Windows\System\iPFOwPh.exe
  2⤵
  PID:5856
- C:\Windows\System\BqcFGXq.exe
  C:\Windows\System\BqcFGXq.exe
  2⤵
  PID:11164
- C:\Windows\System\xaXEWjS.exe
  C:\Windows\System\xaXEWjS.exe
  2⤵
  PID:2628
- C:\Windows\System\IAGiIzR.exe
  C:\Windows\System\IAGiIzR.exe
  2⤵
  PID:7888
- C:\Windows\System\ItoOhCI.exe
  C:\Windows\System\ItoOhCI.exe
  2⤵
  PID:7928
- C:\Windows\System\kdvZFaE.exe
  C:\Windows\System\kdvZFaE.exe
  2⤵
  PID:5356
- C:\Windows\System\JDVzPnB.exe
  C:\Windows\System\JDVzPnB.exe
  2⤵
  PID:11140
- C:\Windows\System\ChfztTw.exe
  C:\Windows\System\ChfztTw.exe
  2⤵
  PID:2900
- C:\Windows\System\MgBEmbz.exe
  C:\Windows\System\MgBEmbz.exe
  2⤵
  PID:11260
- C:\Windows\System\OFxDTMH.exe
  C:\Windows\System\OFxDTMH.exe
  2⤵
  PID:3384
- C:\Windows\System\ZFYUMZc.exe
  C:\Windows\System\ZFYUMZc.exe
  2⤵
  PID:1112
- C:\Windows\System\YHobHzh.exe
  C:\Windows\System\YHobHzh.exe
  2⤵
  PID:2596
- C:\Windows\System\wyPfXVR.exe
  C:\Windows\System\wyPfXVR.exe
  2⤵
  PID:9908
- C:\Windows\System\ZCXenhW.exe
  C:\Windows\System\ZCXenhW.exe
  2⤵
  PID:2276
- C:\Windows\System\bFZcEvg.exe
  C:\Windows\System\bFZcEvg.exe
  2⤵
  PID:4132
- C:\Windows\System\lKwyQxm.exe
  C:\Windows\System\lKwyQxm.exe
  2⤵
  PID:5384
- C:\Windows\System\xMqsINz.exe
  C:\Windows\System\xMqsINz.exe
  2⤵
  PID:10440
- C:\Windows\System\wcZwMqA.exe
  C:\Windows\System\wcZwMqA.exe
  2⤵
  PID:10368
- C:\Windows\System\sSFPoAL.exe
  C:\Windows\System\sSFPoAL.exe
  2⤵
  PID:1944
- C:\Windows\System\SDVaoqe.exe
  C:\Windows\System\SDVaoqe.exe
  2⤵
  PID:4448
- C:\Windows\System\VLYBfKu.exe
  C:\Windows\System\VLYBfKu.exe
  2⤵
  PID:6060
- C:\Windows\System\oCrHzcz.exe
  C:\Windows\System\oCrHzcz.exe
  2⤵
  PID:5748
- C:\Windows\System\vaBfhKV.exe
  C:\Windows\System\vaBfhKV.exe
  2⤵
  PID:5816
- C:\Windows\System\JZSTGml.exe
  C:\Windows\System\JZSTGml.exe
  2⤵
  PID:6328
- C:\Windows\System\WzikJSs.exe
  C:\Windows\System\WzikJSs.exe
  2⤵
  PID:11168
- C:\Windows\System\kZMrGZd.exe
  C:\Windows\System\kZMrGZd.exe
  2⤵
  PID:10272
- C:\Windows\System\iClQCUz.exe
  C:\Windows\System\iClQCUz.exe
  2⤵
  PID:6572
- C:\Windows\System\CQlEhVd.exe
  C:\Windows\System\CQlEhVd.exe
  2⤵
  PID:5088
- C:\Windows\System\ALkLYxx.exe
  C:\Windows\System\ALkLYxx.exe
  2⤵
  PID:10740
- C:\Windows\System\ZiQgJlV.exe
  C:\Windows\System\ZiQgJlV.exe
  2⤵
  PID:10424
- C:\Windows\System\OqhGAyM.exe
  C:\Windows\System\OqhGAyM.exe
  2⤵
  PID:6860
- C:\Windows\System\ROtBHZN.exe
  C:\Windows\System\ROtBHZN.exe
  2⤵
  PID:2556
- C:\Windows\System\QMvYkyL.exe
  C:\Windows\System\QMvYkyL.exe
  2⤵
  PID:12384
- C:\Windows\System\JSuAzom.exe
  C:\Windows\System\JSuAzom.exe
  2⤵
  PID:7000
- C:\Windows\System\oEmEGhP.exe
  C:\Windows\System\oEmEGhP.exe
  2⤵
  PID:6828
- C:\Windows\System\WqzdxFL.exe
  C:\Windows\System\WqzdxFL.exe
  2⤵
  PID:3324
- C:\Windows\System\CapADhK.exe
  C:\Windows\System\CapADhK.exe
  2⤵
  PID:5936
- C:\Windows\System\yybjVkx.exe
  C:\Windows\System\yybjVkx.exe
  2⤵
  PID:4800
- C:\Windows\System\lHBTEcZ.exe
  C:\Windows\System\lHBTEcZ.exe
  2⤵
  PID:1816
- C:\Windows\System\FcdslIn.exe
  C:\Windows\System\FcdslIn.exe
  2⤵
  PID:6460
- C:\Windows\System\JUDilAy.exe
  C:\Windows\System\JUDilAy.exe
  2⤵
  PID:12616
- C:\Windows\System\JuiMIws.exe
  C:\Windows\System\JuiMIws.exe
  2⤵
  PID:6500
- C:\Windows\System\JwXxkIM.exe
  C:\Windows\System\JwXxkIM.exe
  2⤵
  PID:6440
- C:\Windows\System\kaenyki.exe
  C:\Windows\System\kaenyki.exe
  2⤵
  PID:5744
- C:\Windows\System\zaGIkJk.exe
  C:\Windows\System\zaGIkJk.exe
  2⤵
  PID:5060
- C:\Windows\System\xRykcyP.exe
  C:\Windows\System\xRykcyP.exe
  2⤵
  PID:3448
- C:\Windows\System\ZlspkbY.exe
  C:\Windows\System\ZlspkbY.exe
  2⤵
  PID:6384
- C:\Windows\System\aVLuAWd.exe
  C:\Windows\System\aVLuAWd.exe
  2⤵
  PID:928
- C:\Windows\System\RcvpIkF.exe
  C:\Windows\System\RcvpIkF.exe
  2⤵
  PID:6272
- C:\Windows\System\YBybbYv.exe
  C:\Windows\System\YBybbYv.exe
  2⤵
  PID:6652
- C:\Windows\System\iRgNBMq.exe
  C:\Windows\System\iRgNBMq.exe
  2⤵
  PID:10908
- C:\Windows\System\ulJDcYq.exe
  C:\Windows\System\ulJDcYq.exe
  2⤵
  PID:6556
- C:\Windows\System\QjSFLro.exe
  C:\Windows\System\QjSFLro.exe
  2⤵
  PID:6680
- C:\Windows\System\xStdLKn.exe
  C:\Windows\System\xStdLKn.exe
  2⤵
  PID:1568
- C:\Windows\System\zyjSioz.exe
  C:\Windows\System\zyjSioz.exe
  2⤵
  PID:6684
- C:\Windows\System\bnrGmnu.exe
  C:\Windows\System\bnrGmnu.exe
  2⤵
  PID:7516
- C:\Windows\System\myOHNSy.exe
  C:\Windows\System\myOHNSy.exe
  2⤵
  PID:7336
- C:\Windows\System\hkmbLza.exe
  C:\Windows\System\hkmbLza.exe
  2⤵
  PID:7652
- C:\Windows\System\zitBQpI.exe
  C:\Windows\System\zitBQpI.exe
  2⤵
  PID:6668
- C:\Windows\System\vefErtJ.exe
  C:\Windows\System\vefErtJ.exe
  2⤵
  PID:3784
- C:\Windows\System\UjtkTzZ.exe
  C:\Windows\System\UjtkTzZ.exe
  2⤵
  PID:5032
- C:\Windows\System\npqVOKk.exe
  C:\Windows\System\npqVOKk.exe
  2⤵
  PID:2560
- C:\Windows\System\nRJTIRd.exe
  C:\Windows\System\nRJTIRd.exe
  2⤵
  PID:7164
- C:\Windows\System\zlZoaTB.exe
  C:\Windows\System\zlZoaTB.exe
  2⤵
  PID:7372
- C:\Windows\System\Xweublt.exe
  C:\Windows\System\Xweublt.exe
  2⤵
  PID:9200
- C:\Windows\System\hIpKHgO.exe
  C:\Windows\System\hIpKHgO.exe
  2⤵
  PID:5876
- C:\Windows\System\FkjCCCM.exe
  C:\Windows\System\FkjCCCM.exe
  2⤵
  PID:5268
- C:\Windows\System\cOFIsdP.exe
  C:\Windows\System\cOFIsdP.exe
  2⤵
  PID:8004
- C:\Windows\System\zxxreqZ.exe
  C:\Windows\System\zxxreqZ.exe
  2⤵
  PID:6516
- C:\Windows\System\BsIywpD.exe
  C:\Windows\System\BsIywpD.exe
  2⤵
  PID:12552
- C:\Windows\System\bLEfFeL.exe
  C:\Windows\System\bLEfFeL.exe
  2⤵
  PID:5944
- C:\Windows\System\ovWzHKD.exe
  C:\Windows\System\ovWzHKD.exe
  2⤵
  PID:6920
- C:\Windows\System\qLjKsIa.exe
  C:\Windows\System\qLjKsIa.exe
  2⤵
  PID:8292
- C:\Windows\System\wpDSvjU.exe
  C:\Windows\System\wpDSvjU.exe
  2⤵
  PID:8520
- C:\Windows\System\CcHyTus.exe
  C:\Windows\System\CcHyTus.exe
  2⤵
  PID:8560
- C:\Windows\System\XcisDwd.exe
  C:\Windows\System\XcisDwd.exe
  2⤵
  PID:8848
- C:\Windows\System\pAVunZC.exe
  C:\Windows\System\pAVunZC.exe
  2⤵
  PID:8964
- C:\Windows\System\NzxocfS.exe
  C:\Windows\System\NzxocfS.exe
  2⤵
  PID:8788
- C:\Windows\System\FZcgjLp.exe
  C:\Windows\System\FZcgjLp.exe
  2⤵
  PID:13020
- C:\Windows\System\acalSpj.exe
  C:\Windows\System\acalSpj.exe
  2⤵
  PID:6420
- C:\Windows\System\UBUWoIH.exe
  C:\Windows\System\UBUWoIH.exe
  2⤵
  PID:7596
- C:\Windows\System\bUpOnUf.exe
  C:\Windows\System\bUpOnUf.exe
  2⤵
  PID:12668
- C:\Windows\System\ZwaGpRc.exe
  C:\Windows\System\ZwaGpRc.exe
  2⤵
  PID:8564
- C:\Windows\System\jHYGUzv.exe
  C:\Windows\System\jHYGUzv.exe
  2⤵
  PID:9004
- C:\Windows\System\LnNMidF.exe
  C:\Windows\System\LnNMidF.exe
  2⤵
  PID:6476
- C:\Windows\System\hgjIRAl.exe
  C:\Windows\System\hgjIRAl.exe
  2⤵
  PID:7796
- C:\Windows\System\zdKybpz.exe
  C:\Windows\System\zdKybpz.exe
  2⤵
  PID:9196
- C:\Windows\System\vmWWKmD.exe
  C:\Windows\System\vmWWKmD.exe
  2⤵
  PID:8740
- C:\Windows\System\GniGAgd.exe
  C:\Windows\System\GniGAgd.exe
  2⤵
  PID:6660
- C:\Windows\System\YuOxQFU.exe
  C:\Windows\System\YuOxQFU.exe
  2⤵
  PID:9268
- C:\Windows\System\XFUoQte.exe
  C:\Windows\System\XFUoQte.exe
  2⤵
  PID:8288
- C:\Windows\System\nQIMCyu.exe
  C:\Windows\System\nQIMCyu.exe
  2⤵
  PID:9580
- C:\Windows\System\xxWSzyN.exe
  C:\Windows\System\xxWSzyN.exe
  2⤵
  PID:8488
- C:\Windows\System\YuxLvWz.exe
  C:\Windows\System\YuxLvWz.exe
  2⤵
  PID:1012
- C:\Windows\System\AVxQall.exe
  C:\Windows\System\AVxQall.exe
  2⤵
  PID:9656
- C:\Windows\System\rtwrdXB.exe
  C:\Windows\System\rtwrdXB.exe
  2⤵
  PID:9648
- C:\Windows\System\TupHubx.exe
  C:\Windows\System\TupHubx.exe
  2⤵
  PID:9856
- C:\Windows\System\KlIJqmt.exe
  C:\Windows\System\KlIJqmt.exe
  2⤵
  PID:9872
- C:\Windows\System\kZSFsFS.exe
  C:\Windows\System\kZSFsFS.exe
  2⤵
  PID:4852
- C:\Windows\System\JTylRXR.exe
  C:\Windows\System\JTylRXR.exe
  2⤵
  PID:11984
- C:\Windows\System\NrXPdRl.exe
  C:\Windows\System\NrXPdRl.exe
  2⤵
  PID:10164
- C:\Windows\System\efipgyg.exe
  C:\Windows\System\efipgyg.exe
  2⤵
  PID:9296
- C:\Windows\System\soWfwVa.exe
  C:\Windows\System\soWfwVa.exe
  2⤵
  PID:10008
- C:\Windows\System\loLAtGi.exe
  C:\Windows\System\loLAtGi.exe
  2⤵
  PID:9092
- C:\Windows\System\SqMtOda.exe
  C:\Windows\System\SqMtOda.exe
  2⤵
  PID:9068
- C:\Windows\System\GeQIcbL.exe
  C:\Windows\System\GeQIcbL.exe
  2⤵
  PID:9560
- C:\Windows\System\UkAjeEQ.exe
  C:\Windows\System\UkAjeEQ.exe
  2⤵
  PID:1644
- C:\Windows\System\ckCAEvZ.exe
  C:\Windows\System\ckCAEvZ.exe
  2⤵
  PID:9936
- C:\Windows\System\OGLkYtt.exe
  C:\Windows\System\OGLkYtt.exe
  2⤵
  PID:7728
- C:\Windows\System\peMPegQ.exe
  C:\Windows\System\peMPegQ.exe
  2⤵
  PID:10160
- C:\Windows\System\WwzCnWG.exe
  C:\Windows\System\WwzCnWG.exe
  2⤵
  PID:7664
- C:\Windows\System\bLBefXo.exe
  C:\Windows\System\bLBefXo.exe
  2⤵
  PID:11144
- C:\Windows\System\FlHvJRz.exe
  C:\Windows\System\FlHvJRz.exe
  2⤵
  PID:9536
- C:\Windows\System\VKUYIEM.exe
  C:\Windows\System\VKUYIEM.exe
  2⤵
  PID:10244
- C:\Windows\System\DTlenuN.exe
  C:\Windows\System\DTlenuN.exe
  2⤵
  PID:9736
- C:\Windows\System\udoArxw.exe
  C:\Windows\System\udoArxw.exe
  2⤵
  PID:6864
- C:\Windows\System\GGAuWHg.exe
  C:\Windows\System\GGAuWHg.exe
  2⤵
  PID:7844
- C:\Windows\System\UShqxNV.exe
  C:\Windows\System\UShqxNV.exe
  2⤵
  PID:10324
- C:\Windows\System\LbeEiZr.exe
  C:\Windows\System\LbeEiZr.exe
  2⤵
  PID:8836
- C:\Windows\System\jGWlFZk.exe
  C:\Windows\System\jGWlFZk.exe
  2⤵
  PID:6768
- C:\Windows\System\CVxOEIb.exe
  C:\Windows\System\CVxOEIb.exe
  2⤵
  PID:8812
- C:\Windows\System\BvnPcKu.exe
  C:\Windows\System\BvnPcKu.exe
  2⤵
  PID:12452
- C:\Windows\System\OfPytda.exe
  C:\Windows\System\OfPytda.exe
  2⤵
  PID:9304
- C:\Windows\System\JHcTtQw.exe
  C:\Windows\System\JHcTtQw.exe
  2⤵
  PID:10892
- C:\Windows\System\zPNcBrY.exe
  C:\Windows\System\zPNcBrY.exe
  2⤵
  PID:11092
- C:\Windows\System\HtHHdQi.exe
  C:\Windows\System\HtHHdQi.exe
  2⤵
  PID:8996
- C:\Windows\System\ZqMSLfy.exe
  C:\Windows\System\ZqMSLfy.exe
  2⤵
  PID:10900
- C:\Windows\System\eAVoFdD.exe
  C:\Windows\System\eAVoFdD.exe
  2⤵
  PID:4976
- C:\Windows\System\PqCdPYN.exe
  C:\Windows\System\PqCdPYN.exe
  2⤵
  PID:9392
- C:\Windows\System\vBcCsvc.exe
  C:\Windows\System\vBcCsvc.exe
  2⤵
  PID:6380
- C:\Windows\System\pxQVNPZ.exe
  C:\Windows\System\pxQVNPZ.exe
  2⤵
  PID:8092
- C:\Windows\System\KdqiUvm.exe
  C:\Windows\System\KdqiUvm.exe
  2⤵
  PID:10224
- C:\Windows\System\GGcZdLl.exe
  C:\Windows\System\GGcZdLl.exe
  2⤵
  PID:5924
- C:\Windows\System\nyJAKut.exe
  C:\Windows\System\nyJAKut.exe
  2⤵
  PID:8416
- C:\Windows\System\rpeGMNq.exe
  C:\Windows\System\rpeGMNq.exe
  2⤵
  PID:9552
- C:\Windows\System\lwjreaG.exe
  C:\Windows\System\lwjreaG.exe
  2⤵
  PID:10748
- C:\Windows\System\CAHDhtv.exe
  C:\Windows\System\CAHDhtv.exe
  2⤵
  PID:7604
- C:\Windows\System\soxXrwv.exe
  C:\Windows\System\soxXrwv.exe
  2⤵
  PID:9772
- C:\Windows\System\zeHQkJg.exe
  C:\Windows\System\zeHQkJg.exe
  2⤵
  PID:11096
- C:\Windows\System\RSGkcZf.exe
  C:\Windows\System\RSGkcZf.exe
  2⤵
  PID:9888
- C:\Windows\System\yCAXiEO.exe
  C:\Windows\System\yCAXiEO.exe
  2⤵
  PID:10668
- C:\Windows\System\KscaSOI.exe
  C:\Windows\System\KscaSOI.exe
  2⤵
  PID:11280
- C:\Windows\System\FjDXjSb.exe
  C:\Windows\System\FjDXjSb.exe
  2⤵
  PID:10488
- C:\Windows\System\oiIbvKL.exe
  C:\Windows\System\oiIbvKL.exe
  2⤵
  PID:10796
- C:\Windows\System\JbpHceE.exe
  C:\Windows\System\JbpHceE.exe
  2⤵
  PID:11492
- C:\Windows\System\FFhSehP.exe
  C:\Windows\System\FFhSehP.exe
  2⤵
  PID:11676
- C:\Windows\System\OKExzfZ.exe
  C:\Windows\System\OKExzfZ.exe
  2⤵
  PID:11932
- C:\Windows\System\GpShXfO.exe
  C:\Windows\System\GpShXfO.exe
  2⤵
  PID:11576
- C:\Windows\System\BSDLKdX.exe
  C:\Windows\System\BSDLKdX.exe
  2⤵
  PID:11904
- C:\Windows\System\nrtdqhe.exe
  C:\Windows\System\nrtdqhe.exe
  2⤵
  PID:6156
- C:\Windows\System\QPegxge.exe
  C:\Windows\System\QPegxge.exe
  2⤵
  PID:10252
- C:\Windows\System\VzLpsft.exe
  C:\Windows\System\VzLpsft.exe
  2⤵
  PID:10020
- C:\Windows\System\RIZqGGn.exe
  C:\Windows\System\RIZqGGn.exe
  2⤵
  PID:8328
- C:\Windows\System\LEePpnE.exe
  C:\Windows\System\LEePpnE.exe
  2⤵
  PID:10604
- C:\Windows\System\ckYGjkk.exe
  C:\Windows\System\ckYGjkk.exe
  2⤵
  PID:9644
- C:\Windows\System\KeTXubY.exe
  C:\Windows\System\KeTXubY.exe
  2⤵
  PID:2156
- C:\Windows\System\ayyKLBP.exe
  C:\Windows\System\ayyKLBP.exe
  2⤵
  PID:11940
- C:\Windows\System\gqnUXRP.exe
  C:\Windows\System\gqnUXRP.exe
  2⤵
  PID:11320
- C:\Windows\System\NZQcNze.exe
  C:\Windows\System\NZQcNze.exe
  2⤵
  PID:10868
- C:\Windows\System\SYMidOJ.exe
  C:\Windows\System\SYMidOJ.exe
  2⤵
  PID:11900
- C:\Windows\System\MhjBobt.exe
  C:\Windows\System\MhjBobt.exe
  2⤵
  PID:10148
- C:\Windows\System\VCJQtnV.exe
  C:\Windows\System\VCJQtnV.exe
  2⤵
  PID:8844
- C:\Windows\System\xSPagbp.exe
  C:\Windows\System\xSPagbp.exe
  2⤵
  PID:11272
- C:\Windows\System\jpzfpwZ.exe
  C:\Windows\System\jpzfpwZ.exe
  2⤵
  PID:12096
- C:\Windows\System\IbjfxTn.exe
  C:\Windows\System\IbjfxTn.exe
  2⤵
  PID:11568
- C:\Windows\System\hXuYFmZ.exe
  C:\Windows\System\hXuYFmZ.exe
  2⤵
  PID:10992
- C:\Windows\System\BzupoWT.exe
  C:\Windows\System\BzupoWT.exe
  2⤵
  PID:11776
- C:\Windows\System\JHGtIBI.exe
  C:\Windows\System\JHGtIBI.exe
  2⤵
  PID:11548
- C:\Windows\System\tSsLkxU.exe
  C:\Windows\System\tSsLkxU.exe
  2⤵
  PID:11840
- C:\Windows\System\hLePcIO.exe
  C:\Windows\System\hLePcIO.exe
  2⤵
  PID:12304
- C:\Windows\System\rNfhauv.exe
  C:\Windows\System\rNfhauv.exe
  2⤵
  PID:12404
- C:\Windows\System\qfsTjaZ.exe
  C:\Windows\System\qfsTjaZ.exe
  2⤵
  PID:12572
- C:\Windows\System\RNgUdGM.exe
  C:\Windows\System\RNgUdGM.exe
  2⤵
  PID:12232
- C:\Windows\System\aWooxQc.exe
  C:\Windows\System\aWooxQc.exe
  2⤵
  PID:10780
- C:\Windows\System\VhkanpF.exe
  C:\Windows\System\VhkanpF.exe
  2⤵
  PID:10692
- C:\Windows\System\JtonVBl.exe
  C:\Windows\System\JtonVBl.exe
  2⤵
  PID:13104
- C:\Windows\System\fImDbVf.exe
  C:\Windows\System\fImDbVf.exe
  2⤵
  PID:4140
- C:\Windows\System\PxhMRzP.exe
  C:\Windows\System\PxhMRzP.exe
  2⤵
  PID:13152
- C:\Windows\System\xxUnudA.exe
  C:\Windows\System\xxUnudA.exe
  2⤵
  PID:13164
- C:\Windows\System\IVmdWmf.exe
  C:\Windows\System\IVmdWmf.exe
  2⤵
  PID:13016
- C:\Windows\System\kFOMEMk.exe
  C:\Windows\System\kFOMEMk.exe
  2⤵
  PID:10572
- C:\Windows\System\sexDkBZ.exe
  C:\Windows\System\sexDkBZ.exe
  2⤵
  PID:10464
- C:\Windows\System\SxHCDqJ.exe
  C:\Windows\System\SxHCDqJ.exe
  2⤵
  PID:11764
- C:\Windows\System\TVhluxZ.exe
  C:\Windows\System\TVhluxZ.exe
  2⤵
  PID:13296
- C:\Windows\System\HVEHnmB.exe
  C:\Windows\System\HVEHnmB.exe
  2⤵
  PID:12752
- C:\Windows\System\ndPJKVy.exe
  C:\Windows\System\ndPJKVy.exe
  2⤵
  PID:11420
- C:\Windows\System\FHZUDzU.exe
  C:\Windows\System\FHZUDzU.exe
  2⤵
  PID:6224
- C:\Windows\System\ReIVUTV.exe
  C:\Windows\System\ReIVUTV.exe
  2⤵
  PID:13060
- C:\Windows\System\GmXcRMm.exe
  C:\Windows\System\GmXcRMm.exe
  2⤵
  PID:11976
- C:\Windows\System\roaJGQM.exe
  C:\Windows\System\roaJGQM.exe
  2⤵
  PID:13080
- C:\Windows\System\oRXHVlg.exe
  C:\Windows\System\oRXHVlg.exe
  2⤵
  PID:10344
- C:\Windows\System\EXFhaBM.exe
  C:\Windows\System\EXFhaBM.exe
  2⤵
  PID:11968
- C:\Windows\System\VDUWztP.exe
  C:\Windows\System\VDUWztP.exe
  2⤵
  PID:13156
- C:\Windows\System\LPTQtOi.exe
  C:\Windows\System\LPTQtOi.exe
  2⤵
  PID:11712
- C:\Windows\System\eNKIOCh.exe
  C:\Windows\System\eNKIOCh.exe
  2⤵
  PID:11616
- C:\Windows\System\HTbKBUf.exe
  C:\Windows\System\HTbKBUf.exe
  2⤵
  PID:11960
- C:\Windows\System\tqkDBdp.exe
  C:\Windows\System\tqkDBdp.exe
  2⤵
  PID:1360
- C:\Windows\System\MMIjeMq.exe
  C:\Windows\System\MMIjeMq.exe
  2⤵
  PID:11716
- C:\Windows\System\hREQGza.exe
  C:\Windows\System\hREQGza.exe
  2⤵
  PID:8276
- C:\Windows\System\zxNoHkU.exe
  C:\Windows\System\zxNoHkU.exe
  2⤵
  PID:8600
- C:\Windows\System\FzemXCt.exe
  C:\Windows\System\FzemXCt.exe
  2⤵
  PID:13084
- C:\Windows\System\igWDcen.exe
  C:\Windows\System\igWDcen.exe
  2⤵
  PID:12588
- C:\Windows\System\EsArvly.exe
  C:\Windows\System\EsArvly.exe
  2⤵
  PID:10876
- C:\Windows\System\YSCjUCC.exe
  C:\Windows\System\YSCjUCC.exe
  2⤵
  PID:11924
- C:\Windows\System\EnkwCQV.exe
  C:\Windows\System\EnkwCQV.exe
  2⤵
  PID:10452
- C:\Windows\System\HooIjny.exe
  C:\Windows\System\HooIjny.exe
  2⤵
  PID:12528
- C:\Windows\System\fuIsiUG.exe
  C:\Windows\System\fuIsiUG.exe
  2⤵
  PID:12324
- C:\Windows\System\tsczxRW.exe
  C:\Windows\System\tsczxRW.exe
  2⤵
  PID:13336
- C:\Windows\System\IGqHEMK.exe
  C:\Windows\System\IGqHEMK.exe
  2⤵
  PID:13368
- C:\Windows\System\ctHGFys.exe
  C:\Windows\System\ctHGFys.exe
  2⤵
  PID:13396
- C:\Windows\System\TAAcgjB.exe
  C:\Windows\System\TAAcgjB.exe
  2⤵
  PID:13424
- C:\Windows\System\PxAbSop.exe
  C:\Windows\System\PxAbSop.exe
  2⤵
  PID:13452
- C:\Windows\System\HdaAErc.exe
  C:\Windows\System\HdaAErc.exe
  2⤵
  PID:13480
- C:\Windows\System\gRwnwcS.exe
  C:\Windows\System\gRwnwcS.exe
  2⤵
  PID:13508
- C:\Windows\System\gBdhXWH.exe
  C:\Windows\System\gBdhXWH.exe
  2⤵
  PID:13536
- C:\Windows\System\igdNwNC.exe
  C:\Windows\System\igdNwNC.exe
  2⤵
  PID:13564
- C:\Windows\System\KHHZBsu.exe
  C:\Windows\System\KHHZBsu.exe
  2⤵
  PID:13592
- C:\Windows\System\QRSauKd.exe
  C:\Windows\System\QRSauKd.exe
  2⤵
  PID:13620
- C:\Windows\System\NKVMRFF.exe
  C:\Windows\System\NKVMRFF.exe
  2⤵
  PID:13648
- C:\Windows\System\DulEHjj.exe
  C:\Windows\System\DulEHjj.exe
  2⤵
  PID:13676
- C:\Windows\System\wDyCaVF.exe
  C:\Windows\System\wDyCaVF.exe
  2⤵
  PID:13704
- C:\Windows\System\glnQhBf.exe
  C:\Windows\System\glnQhBf.exe
  2⤵
  PID:13732
- C:\Windows\System\TLSvUkB.exe
  C:\Windows\System\TLSvUkB.exe
  2⤵
  PID:13760
- C:\Windows\System\tvBaXSw.exe
  C:\Windows\System\tvBaXSw.exe
  2⤵
  PID:13792
- C:\Windows\System\jaXhSzJ.exe
  C:\Windows\System\jaXhSzJ.exe
  2⤵
  PID:13820
- C:\Windows\System\KhJKkMe.exe
  C:\Windows\System\KhJKkMe.exe
  2⤵
  PID:13848
- C:\Windows\System\BOWoSCa.exe
  C:\Windows\System\BOWoSCa.exe
  2⤵
  PID:13876
- C:\Windows\System\mVblSBm.exe
  C:\Windows\System\mVblSBm.exe
  2⤵
  PID:13904
- C:\Windows\System\IKfQTaY.exe
  C:\Windows\System\IKfQTaY.exe
  2⤵
  PID:13932
- C:\Windows\System\FvnnIfK.exe
  C:\Windows\System\FvnnIfK.exe
  2⤵
  PID:13960
- C:\Windows\System\cvAaxqS.exe
  C:\Windows\System\cvAaxqS.exe
  2⤵
  PID:13988
- C:\Windows\System\xOqSwme.exe
  C:\Windows\System\xOqSwme.exe
  2⤵
  PID:14016
- C:\Windows\System\mPbEOOi.exe
  C:\Windows\System\mPbEOOi.exe
  2⤵
  PID:14044
- C:\Windows\System\XmCAlyf.exe
  C:\Windows\System\XmCAlyf.exe
  2⤵
  PID:14072
- C:\Windows\System\OZSgYVJ.exe
  C:\Windows\System\OZSgYVJ.exe
  2⤵
  PID:14100
- C:\Windows\System\PoRNNki.exe
  C:\Windows\System\PoRNNki.exe
  2⤵
  PID:14232
- C:\Windows\System\RkbGVxL.exe
  C:\Windows\System\RkbGVxL.exe
  2⤵
  PID:14248
- C:\Windows\System\rmctrCH.exe
  C:\Windows\System\rmctrCH.exe
  2⤵
  PID:14264
- C:\Windows\System\SDdtmMJ.exe
  C:\Windows\System\SDdtmMJ.exe
  2⤵
  PID:14280
- C:\Windows\System\yOMZgZu.exe
  C:\Windows\System\yOMZgZu.exe
  2⤵
  PID:14296
- C:\Windows\System\kBkbBgL.exe
  C:\Windows\System\kBkbBgL.exe
  2⤵
  PID:14312
- C:\Windows\System\ohpriSm.exe
  C:\Windows\System\ohpriSm.exe
  2⤵
  PID:14328
- C:\Windows\System\KaMtMpF.exe
  C:\Windows\System\KaMtMpF.exe
  2⤵
  PID:13316
- C:\Windows\System\YczASyv.exe
  C:\Windows\System\YczASyv.exe
  2⤵
  PID:13356
- C:\Windows\System\WUWjrTH.exe
  C:\Windows\System\WUWjrTH.exe
  2⤵
  PID:13412
- C:\Windows\System\jSuKGeE.exe
  C:\Windows\System\jSuKGeE.exe
  2⤵
  PID:13468
- C:\Windows\System\qIUJTqg.exe
  C:\Windows\System\qIUJTqg.exe
  2⤵
  PID:13516
- C:\Windows\System\zcyONjC.exe
  C:\Windows\System\zcyONjC.exe
  2⤵
  PID:13600
- C:\Windows\System\zvmQZPx.exe
  C:\Windows\System\zvmQZPx.exe
  2⤵
  PID:13692
- C:\Windows\System\eIOCfzc.exe
  C:\Windows\System\eIOCfzc.exe
  2⤵
  PID:13800
- C:\Windows\System\QTBykDU.exe
  C:\Windows\System\QTBykDU.exe
  2⤵
  PID:13928
- C:\Windows\System\zuQSPNK.exe
  C:\Windows\System\zuQSPNK.exe
  2⤵
  PID:14024
- C:\Windows\System\utawTAQ.exe
  C:\Windows\System\utawTAQ.exe
  2⤵
  PID:14228
- C:\Windows\System\PHaZRtB.exe
  C:\Windows\System\PHaZRtB.exe
  2⤵
  PID:14184
- C:\Windows\System\KKJckqX.exe
  C:\Windows\System\KKJckqX.exe
  2⤵
  PID:13376
- C:\Windows\System\zFzbNyB.exe
  C:\Windows\System\zFzbNyB.exe
  2⤵
  PID:14156
- C:\Windows\System\BYWyjvy.exe
  C:\Windows\System\BYWyjvy.exe
  2⤵
  PID:14276
- C:\Windows\System\aatBily.exe
  C:\Windows\System\aatBily.exe
  2⤵
  PID:3160
- C:\Windows\System\WBJVxek.exe
  C:\Windows\System\WBJVxek.exe
  2⤵
  PID:14220
- C:\Windows\System\BNvMRNc.exe
  C:\Windows\System\BNvMRNc.exe
  2⤵
  PID:10460
- C:\Windows\System\MhlSBSv.exe
  C:\Windows\System\MhlSBSv.exe
  2⤵
  PID:13816
- C:\Windows\System\qGHbYYS.exe
  C:\Windows\System\qGHbYYS.exe
  2⤵
  PID:13844
- C:\Windows\System\JSsAgqD.exe
  C:\Windows\System\JSsAgqD.exe
  2⤵
  PID:14052
- C:\Windows\System\NNoOrMR.exe
  C:\Windows\System\NNoOrMR.exe
  2⤵
  PID:14124
- C:\Windows\System\ZDtQkGz.exe
  C:\Windows\System\ZDtQkGz.exe
  2⤵
  PID:14256
- C:\Windows\System\ydKWAnJ.exe
  C:\Windows\System\ydKWAnJ.exe
  2⤵
  PID:14172
- C:\Windows\System\RiGagrD.exe
  C:\Windows\System\RiGagrD.exe
  2⤵
  PID:13672
- C:\Windows\System\ugBEtOy.exe
  C:\Windows\System\ugBEtOy.exe
  2⤵
  PID:13884
- C:\Windows\System\VseGZCH.exe
  C:\Windows\System\VseGZCH.exe
  2⤵
  PID:13392
- C:\Windows\System\XopoJpX.exe
  C:\Windows\System\XopoJpX.exe
  2⤵
  PID:13720
- C:\Windows\System\TrhEavX.exe
  C:\Windows\System\TrhEavX.exe
  2⤵
  PID:14120
- C:\Windows\System\jpVXOCt.exe
  C:\Windows\System\jpVXOCt.exe
  2⤵
  PID:13636
- C:\Windows\System\KcFCwdW.exe
  C:\Windows\System\KcFCwdW.exe
  2⤵
  PID:14348
- C:\Windows\System\iexHsPe.exe
  C:\Windows\System\iexHsPe.exe
  2⤵
  PID:14364
- C:\Windows\System\ddcRqMA.exe
  C:\Windows\System\ddcRqMA.exe
  2⤵
  PID:14392
- C:\Windows\System\KytfesS.exe
  C:\Windows\System\KytfesS.exe
  2⤵
  PID:14420
- C:\Windows\System\FzihlTE.exe
  C:\Windows\System\FzihlTE.exe
  2⤵
  PID:14452
- C:\Windows\System\SKkKpgV.exe
  C:\Windows\System\SKkKpgV.exe
  2⤵
  PID:14488
- C:\Windows\System\FifEmgQ.exe
  C:\Windows\System\FifEmgQ.exe
  2⤵
  PID:14516
- C:\Windows\System\EcICuRa.exe
  C:\Windows\System\EcICuRa.exe
  2⤵
  PID:14544
- C:\Windows\System\kwArENe.exe
  C:\Windows\System\kwArENe.exe
  2⤵
  PID:14572
- C:\Windows\System\vnohEAr.exe
  C:\Windows\System\vnohEAr.exe
  2⤵
  PID:14600
- C:\Windows\System\qDkmYMd.exe
  C:\Windows\System\qDkmYMd.exe
  2⤵
  PID:14628
- C:\Windows\System\mXRUkrz.exe
  C:\Windows\System\mXRUkrz.exe
  2⤵
  PID:14656
- C:\Windows\System\Jsofroi.exe
  C:\Windows\System\Jsofroi.exe
  2⤵
  PID:14684
- C:\Windows\System\rLTaVXt.exe
  C:\Windows\System\rLTaVXt.exe
  2⤵
  PID:14712
- C:\Windows\System\YmrJCmV.exe
  C:\Windows\System\YmrJCmV.exe
  2⤵
  PID:14740
- C:\Windows\System\ztjSzwS.exe
  C:\Windows\System\ztjSzwS.exe
  2⤵
  PID:14768
- C:\Windows\System\jJWMoGq.exe
  C:\Windows\System\jJWMoGq.exe
  2⤵
  PID:14796
- C:\Windows\System\ytZWzZZ.exe
  C:\Windows\System\ytZWzZZ.exe
  2⤵
  PID:14828
- C:\Windows\System\lOWiWjH.exe
  C:\Windows\System\lOWiWjH.exe
  2⤵
  PID:14856
- C:\Windows\System\wzjRyCU.exe
  C:\Windows\System\wzjRyCU.exe
  2⤵
  PID:14876
- C:\Windows\System\bKslbYQ.exe
  C:\Windows\System\bKslbYQ.exe
  2⤵
  PID:14904
- C:\Windows\System\UaNrhCq.exe
  C:\Windows\System\UaNrhCq.exe
  2⤵
  PID:14944
- C:\Windows\System\lxmKFmV.exe
  C:\Windows\System\lxmKFmV.exe
  2⤵
  PID:14972
- C:\Windows\System\FIIcbhT.exe
  C:\Windows\System\FIIcbhT.exe
  2⤵
  PID:15000
- C:\Windows\System\GDtbnKx.exe
  C:\Windows\System\GDtbnKx.exe
  2⤵
  PID:15028
- C:\Windows\System\iGJkJuR.exe
  C:\Windows\System\iGJkJuR.exe
  2⤵
  PID:15056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qthdatfn.l43.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMYXAmP.exe

Filesize
1.6MB

MD5
ee966191966611ec580f7c895a1065b4

SHA1
6add2bb54db24689f9122c4b3354095477098fa7

SHA256
c466d604dcc4de3a58fdcd55daf179de668d327c9208f025d422f05f854c2453

SHA512
389c195f8b7224a32604ff8d79724fd201cbadaba9de5cdb0e604f06136a036fb8b1a030995cfdef045efc7860224f28ca3d49951a6c61680a3f948b2626b6d4

Download Submit
C:\Windows\System\ECZFEhh.exe

Filesize
1.6MB

MD5
ea2146ab62302158d92b2d71a615b4a3

SHA1
76a1222d43db1eb0d6be9a4821c6c8f54cc7b5e2

SHA256
0354e5b0ee5923b0d4dda4007f5153df3cc8acc1c697e59403f6d0d186ebc185

SHA512
1a4eda34d78ea1b20bfd58d9675298ee81a1eb23e343c581ed5d37b14cbf31e39648658a5885ad183bb3f4530f63b9aec21ba04c11df916ba16a7ca6127854a5

Download Submit
C:\Windows\System\EHWqTOa.exe

Filesize
1.6MB

MD5
914722165f62bb64e5c547903aec2c9e

SHA1
a3675c172e42f06db807e144081de742f5c5fc37

SHA256
b7ab10e25b831ff04ea179c3a6c64713d1648b8878c5dcb9fec4a9ae4eb14755

SHA512
2ab22acfd43bf021f4856f391d58dd2c5f4aaac752bb7d1f40d750462c162730bd1dc3067ac0e9599c1e75f45c8db59013f7460eebd43f8dd10aabf5555a6b8f

Download Submit
C:\Windows\System\EbkbWQr.exe

Filesize
1.6MB

MD5
891f6852425a66994771a7ee07e01930

SHA1
fbc0cf9c0a6b61bc948446d5df1dcbb4b6c0a3fa

SHA256
dc7d79e7b948734088add8b6c18c91529af040289161fa8142a0fb7e6f14d585

SHA512
548d9bda0a1f1858ad682a795bcd37e7397aa4070fd786d2378e5927683f8baae61ea8bd42035dc4f09970d91924604e9ef737e0f1b32db360c130f5c3efabf5

Download Submit
C:\Windows\System\FQVAFLU.exe

Filesize
1.6MB

MD5
0ee78d552849367c7cb06dc77064d9cd

SHA1
b9992c73e330b375fe15789a76e47ecbc152903d

SHA256
d9a21d2e297cf38dd3f45331c9bd945bfc416c93daa1012fb50134cca6a39878

SHA512
8f6ab30adb4f99623f812520086fea452bf578b8bcd7ba4bb0549802f06ce874a650c5a53ff8ea4c7fd86c0aa3764cce27e3fb3309ace6622a323ab1901fddde

Download Submit
C:\Windows\System\JsYZNXf.exe

Filesize
1.6MB

MD5
0c09ebd804cfdad53c488f0ddff7b9b6

SHA1
78df923e2e74c484b4f66c03bd53638d067b149f

SHA256
fa08a5787edfe7f5ff0f4f0ae1aaaebd5418b812ae2849d1574975383a1db0b2

SHA512
0eb2efdf0e9b55477974bb7e71b56385c83fc1266ffece1fb94eee2a827c355bac624b4892f8a139e63628389158ff4266a2de54b9477253a1d93ba31faf45a9

Download Submit
C:\Windows\System\KCCmWHK.exe

Filesize
1.6MB

MD5
e100a7ad11092e37a30e7785870f6e65

SHA1
cb21cb8ab7ec0ea8c350a4ae8ab1e22e1613e1e8

SHA256
7a6e0da6bac3abb9215fa7ea10d0f3b91e5259f6663fd0235e2758796f44ef80

SHA512
f28421330770c5593d83a36de47ac54f1030a5102269f20a1a748c4234f77a7a0e9bbd10e9c7d3dcb69b2b75ab3fd95d7ecea548412bfba28d268f14c68a4fc5

Download Submit
C:\Windows\System\KXwGqfN.exe

Filesize
1.6MB

MD5
51fbbe066ee2d3dde9db09936d8d659f

SHA1
522b9e9a79067dfa6610ff7989c994edbce1ca2c

SHA256
51869445651e0f69b76d6b516e8cd0f3477d9812c922221aaf731432751204a6

SHA512
541eeedba4321996b0b957db546e56e5ad4ecab49aa427238d763c684269a5931aa6e4213f8dc7d50f7b545c502a482d5bfd22ba9f955a11190f1ef3745fece4

Download Submit
C:\Windows\System\KobkNXt.exe

Filesize
1.6MB

MD5
6e1763cf9ab6b5fed5c77eaf0785e803

SHA1
c5add5718fc1326c30f897faac6ba93dd0842419

SHA256
981aa9ff5bc294ea5769a56126d5934051f2f0530de3bf5a21fb3074b8dd8d0c

SHA512
ef5a8aafe7f0d545c9352119517f753c50e5230f6d9ccc5f58064b55e911188fa9c7d13407dcc0c221d34782e2b8cefe3364e8e22375efe76a0cf7d49aac85d5

Download Submit
C:\Windows\System\OYoilyj.exe

Filesize
1.6MB

MD5
6a45043d296d3b3a7e880f1862df4230

SHA1
16d4884519b124bbd4fd82f0cb08ab71908bdcaa

SHA256
3a5a2d0500f971499bc81d6ff06ba996bcc0cc4bf83e1c4641555d171af70594

SHA512
b65daecb80cd954eea8d64b99e4543bf23c1858903f9b1a5a688e668a02fdd3ee2bcf660475affb777622a0f887ddb381d722121903087e5a6797a613f4bc2bd

Download Submit
C:\Windows\System\PKZjoXz.exe

Filesize
1.6MB

MD5
8d12f084d57068c42289941995354d68

SHA1
1cbb87cb439705658e01d5960f690868be1df982

SHA256
a42d80cea6014d0d7868357792c3ebc71d2086315a18387077a49daa03a13320

SHA512
b2ec16cc52c7dd3dfac7b7d488a84cda5ea4d90ef1973b9d6848e65fd15de9069bb6b2c7ded704fb6321374b072a770496c05b8f9ed1ac3e30e5af8764306956

Download Submit
C:\Windows\System\ReDmlIQ.exe

Filesize
1.6MB

MD5
676be779cc5725f4237bedbbbb7fdc8e

SHA1
4e6d5258b3a41d824e1d4508379331d00597932e

SHA256
140cf5110eb6a7b4da96d79989b49dfef8195e8b5c77680ca3b35906d49eafc2

SHA512
903d3fe79e757d588f95bb46c964170e7585830ded393c6aba004ea2d842ad906331f734bbbc6c32f4ccf757b6ddfcd3cf685dd88776851e12a9ea8c80ce5c6d

Download Submit
C:\Windows\System\Srodqgv.exe

Filesize
1.6MB

MD5
c07eab872bee6b38cb58a17fc6a19db6

SHA1
92fdf20977c1d22185b76bb3bc9c23df6bbb23ef

SHA256
0594890e72017d9f97b13e6790d2ff377e37c610744b70f64ec87fb4618a93b5

SHA512
b002c2944d73465e65ba2442fdf7e5f516f541867cd0c2fd055132be522139ec2af28d8f4f9c674135a625f707cff7bc03443c74ab76f8b92af7f9d31978b359

Download Submit
C:\Windows\System\SwmLJYL.exe

Filesize
1.6MB

MD5
db9d349f3ae0f81edee613b941b19b45

SHA1
1b8d44b3927f09e3bcda9ab9cdcedf385c0e8129

SHA256
4cda2b4ff554f1532ee3bf72b055e1b9f72ccbec95fdc05e0d786c5a20efc967

SHA512
3022d44a625fde3261c10ebc6b76c85d4ebbac1dbf3d5e7e8761036ef974d8cd2528ef3150fda6e57a6ac70c6108bfaafed3094acd9792bf74409f3364384dc0

Download Submit
C:\Windows\System\TxclZSK.exe

Filesize
1.6MB

MD5
31fa0d67f7a96fea744c22c4ed6ec2c0

SHA1
b667aca0eb906b3fcedfd7f1a63e0834ce636564

SHA256
f443b5742c432a171307911942eb2121ef0fced39599e6c2685ad0729380a9b4

SHA512
973ae8cab1ede97e1aaf75f0942f70d6b5cb7e20b13d57a6c6ae6b8063d34a5270f4d3fa53a88c5ddf70ec3e78d163c4c1eb5fc295c43cb9ec3176f16d452ae7

Download Submit
C:\Windows\System\VPSFKaT.exe

Filesize
1.6MB

MD5
a6b27369d6f4dfafafad3abf02e6c2e1

SHA1
af17982f6f76d6cf51b742fbe512628166138839

SHA256
1b089a9f95618196791a08161dd67e2ea2630a5ea639c9ab6e1751a9248114d3

SHA512
1222c8f1b61df30df2a87eee839e0b02f6b907853a17fd85ad7fc2a5d9de60616e32ec02e0f7b8e2bd5c1f291ec3421acff60345fae275e8956aea9dae323dce

Download Submit
C:\Windows\System\XIiCmzq.exe

Filesize
1.6MB

MD5
950abbce54631edcbc8666316c6ecf9d

SHA1
920206fdf65574d383de3d40a97504d7bf6985d3

SHA256
01e4b5df6530d04c7e2ab65a4a55c78bb89243d3aa852626a0f83a7d8c6d9df8

SHA512
d4247fb42b2e2869c24cfff145469c4de5f810ebe7b8ce2174d4c0bfc596ec630b7797458563fc29e56b0bb86e80c0fad7520a304f80ab34647511ed49ca66d0

Download Submit
C:\Windows\System\XYqxEEM.exe

Filesize
1.6MB

MD5
2b07dec87d06bad84b4a18deef9f8336

SHA1
2d2d8d2de61e8819fed31dc475f615ca85afd7aa

SHA256
811b94d860ebdcec82f584d95a01ec1450466ab325b064071e131c7f3b3af9ac

SHA512
ade2addfce7a950e776cba6aedbe3888b4e16a21ed6aaca32670d771e1c69ce81654a4b57517b553b95fc2a75ce2e9992259e6f092284c5b626fe6f7f138b875

Download Submit
C:\Windows\System\ZVKFkms.exe

Filesize
1.6MB

MD5
c1527259b8a4dffa5b98d874130ff9b8

SHA1
0866d4abd71b49d5b99a30e48cd427a6ef67060c

SHA256
1369e13200ca7fa51b5a625827ca8d463cd24685fc92c872ec06251b8c44669f

SHA512
4063a24ab89bb396ec3e5147b36a819fde26663a9bfda2ff70314abc09ba34805b75915b52043f6bc5cb56fdf9511ebabd329f1433049f13e2c8c65887acf389

Download Submit
C:\Windows\System\aFIUwVA.exe

Filesize
1.6MB

MD5
0d8117e19bd071058d6b6b3b6a2dd36b

SHA1
84bee782370ea02e34011c71f9b4bc0d65e002ad

SHA256
1f1a5eaf065ea55505ac44ab0515024c00576ca893bdbd66cec6be6ba56da383

SHA512
a99eb45f9fe5fd05d90f2ca550fc7ab2aebb54f5d34c115266b72fb3607b378dacd7cd61940d6f22c644343837b4532dc48d4b5d32608b69556e762203c02dec

Download Submit
C:\Windows\System\dMOjdns.exe

Filesize
1.6MB

MD5
c6c7acda8c55a62bb43bb4d41af52c1e

SHA1
a69b636e2d81902de98195cfbd739c2944d440d4

SHA256
86469922baf1bef38fdf96dcae481e00172068f0672c9ca0419a59b4f5e31556

SHA512
b4e3c591dc12c8379622fb6386a41151b9d1490dfa1d6ff1677b4274bbcf7d75e430d177334fcba65aa16d82f2c48ee913c12e88e0584d580795d9c0eb60c90a

Download Submit
C:\Windows\System\eZtGKvn.exe

Filesize
1.6MB

MD5
0716ee2db1ca48b1569bdd035d64f0e9

SHA1
6c51d34354221559d648b2d9998983a2776b7f46

SHA256
1e06187f30982e5e06ff5a19ee0337e00a95d1ac8cf37a7c706255c25a53f88e

SHA512
157ab40ce1c8be656fd510cdd88994a0a024efd17807654ad24a302d47ba67edce505fbc77e87cb80982a0907d68594168fb10613eec7a562d3b60ac4115c50d

Download Submit
C:\Windows\System\eaMPDSh.exe

Filesize
1.6MB

MD5
d563ae44411edbab18e16135dde5da95

SHA1
3c28cf46873f9837d339e92e9dc6a67bbecd7006

SHA256
aa4d7729063bde4c4eef399ec0503202cb60fcd00c18941e2a9da72be8700aca

SHA512
066888943a6c0cbef9e0a17e5799eb771e08f45220a3803cd3d072eb4fee27eb366334b80c12b8e7abc4f2cc648ec8cb489eb5ac8a7a87e6b0d01a4da78a80c1

Download Submit
C:\Windows\System\fCUnoth.exe

Filesize
1.6MB

MD5
d9f44e3eed730b1bd1d20b9f290a2341

SHA1
00a050f81aec89890b804b07a05a88ab6f04aa28

SHA256
49194f4235e7be9f062aaa37dd71ad6b0dd73a35099799bad2ca95ddb2356e9d

SHA512
fc838f21d52141c17a3425c3d805cc7b0550c6cf307a4d1ff00ec40a6a61f894ada608529b112d33a85f1b526b6a9b26812b1e25e32e3ede142b9c6bedcc2340

Download Submit
C:\Windows\System\fOlMnnl.exe

Filesize
1.6MB

MD5
731d064a4141315a2303902f31dfb55c

SHA1
b8978cb21d8ca5ae6ec59ade437fc65b803f5a4d

SHA256
26c75f098f2d3301a21ddcc56787d04b9a1e3258aecced25b406bb4a6c7973c2

SHA512
e38509ad8d78ee355fae11ad797945eefbb58a2cced062599d5ef9228c9fc54d7cc04e8f23f89de72de8a784426b4438bab954cfe5d34e183aef570747797cbb

Download Submit
C:\Windows\System\gTwlTTw.exe

Filesize
1.6MB

MD5
7207d6d3e03e8aa05a972109fd39d28e

SHA1
77a8e23e9f9538b222a568bb688e44e866660da9

SHA256
4c5fcff56d37764ce9961a63d6867b6aca31fe8b211cd413a7973bd7c1c3de72

SHA512
920675d19311983125ea4c9b514f76eb7fb879c697b5f470500d6b1229c382be2e8fc8013038525caf9d7428f5b7603c9c67538ac16ab59776879fa7129aa6f6

Download Submit
C:\Windows\System\jBpgDlR.exe

Filesize
1.6MB

MD5
7b38207094bdff844ccb875a28cb0917

SHA1
e33827e8d46d768a00dc9857aeb7ab26de9555fb

SHA256
a83c240a1807e328d31c1a2b1770eaf44d59d39e64076e6b7a7fc1c801e87031

SHA512
295c4e1b733b366d0cd0cceba74c9fcd3713420490b4faf43029f1d57f956dde2c4bee666a80e65a0c8cf1f55ad03344043c9ace839cdb2c439f86ad4576b45a

Download Submit
C:\Windows\System\jqBLmbw.exe

Filesize
1.6MB

MD5
19fad45847588bb0b86d9f87b83e26e1

SHA1
a1e5365eccfeb6b7935242ac1f06cabfcd110276

SHA256
bbb55a87e480bcf201c9dcdec283282354ecf44b6957b3ba5abbc105e68f9dc7

SHA512
1d87556e89a6b5388da0e2174bc05ce64e2e7f2160bf11379a44898e2d7647fa10a7e1b011427c30b189abeafdbf41b76f409f8b139eaff3850a7b429760eef3

Download Submit
C:\Windows\System\neSVIXu.exe

Filesize
1.6MB

MD5
d23814b6cd5d574a36a3bc4fe9ac6cee

SHA1
1f6ee02b2b1d4620c61f8cf760816efbba804ffd

SHA256
3b5041c22a0801b0546b5ef3b5a343663678a361c5fa5103655228510c3e563d

SHA512
5edf56fdd27583b484a501bba8042b1486233c27d555981d249328afbdaa33fd4e9f3e4815758999b4cc6c2d3ec39dd71c3e32c94c3c642cc68a76cceda87b6d

Download Submit
C:\Windows\System\ptdzKTy.exe

Filesize
18B

MD5
4b5a11723752ffb4c861adb4cba62a56

SHA1
f820f10f788dc874d4b2fdd2d1341fe9a6504510

SHA256
e57515306393be5ef48d932e90783187173ef4b2335b3e914b9ac8e86457c05b

SHA512
56faf6ef07346be20d115960dbb288ff6aeb16e0dcea1d488f6f55c0eb120f03546486586841fe6722b1c1b4a4e10cf182ca062817ed2f0ed481ef4be91aa2da

Download Submit
C:\Windows\System\sQVzuSX.exe

Filesize
1.6MB

MD5
648081f0bee317490feb3ef81852e725

SHA1
850d27e6d436a58b7e175a43dfc1cf5c75327558

SHA256
af834b122d021923ce3337ce525ad6422c4336b39efe385d937adc9a2cabba68

SHA512
87364f7997ceef94211058b0d3fc186a811f59b9892540062ebefa589f632e7d9c645c5e631cac54d32f85eea02f1cd8ec716a6fd43d9ee47fa4b14294b51a1a

Download Submit
C:\Windows\System\telNhFH.exe

Filesize
1.6MB

MD5
88605132ee9f22b93b1f7c66418809cc

SHA1
8ec4d6bbe69e029a68682a9ca93b43602e1a0ebd

SHA256
50a4ffad38717961cf61cca1f2efd7b157f44e0e51a1c731d4e67d5fca0f233a

SHA512
6b1d700d875128ebd46f4b54de4b2321681ffbf08dad3ae95e1c05aa6cbbde11724949d24bfef705c45a77b550e256cd23c33220c920212655c92678688cd774

Download Submit
C:\Windows\System\uygmASD.exe

Filesize
8B

MD5
81398e1de3555e92fba3484cc3247c66

SHA1
1795bf2f69133b34ba6d312dc83ac951ee6a2eaa

SHA256
aeb8f50427004d636af26a677cdd7c325f3441df8c991df9e0407610a79f3bba

SHA512
fce05245dae47ae7df0de55238dcd2209fda60a9b115d1a9c5ae4ba15efedf3bf5459c20e938aa1e89bf51840c3a38287ad7d2831cf17cdc0458b5e72809d1ab

Download Submit
C:\Windows\System\yNdRttQ.exe

Filesize
1.6MB

MD5
b4f6a608e32b5ebc874f2a3cdc8608d9

SHA1
252d1ab1d1e33ff82532f35c541b643e9be3678d

SHA256
3aded5e5e2950a52ee65b3d445d0a8992399e44b2d4f4c1be5be0ad230a3522b

SHA512
e37986ea81f4282d431db23fdbd324c2f2c837e88a200805f238a88fe4955866c7a7961c864fb0cd0774e9a7d36b37e2a4468095b41cf7b5f7b4dc41eeb2f1e2

Download Submit
C:\Windows\System\zcOfguH.exe

Filesize
1.6MB

MD5
792abcb18c8b3a0748b1793a2987970a

SHA1
41baf5416daabfe6fbcd408b2118499fb9b57b27

SHA256
5788da43b0079ee0c02317365adb48579c646731a04f5ab27c9b3f8da022fcde

SHA512
51cd66373f3b7870a6889515a95cab231129875611691059c91f4ec8d28cc9a22d4e8347ba3306753154aa7e29b3300beb496a9548deea3eb5055e5ba7653459

Download Submit
memory/428-424-0x00007FF60ACF0000-0x00007FF60B0E2000-memory.dmp

Filesize
3.9MB

Download
memory/428-7589-0x00007FF60ACF0000-0x00007FF60B0E2000-memory.dmp

Filesize
3.9MB

Download
memory/720-445-0x00007FF63F300000-0x00007FF63F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-421-0x00007FF7FBA70000-0x00007FF7FBE62000-memory.dmp

Filesize
3.9MB

Download
memory/1028-440-0x00007FF71F0C0000-0x00007FF71F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-7663-0x00007FF71F0C0000-0x00007FF71F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1100-63-0x00007FF712D80000-0x00007FF713172000-memory.dmp

Filesize
3.9MB

Download
memory/1100-6121-0x00007FF712D80000-0x00007FF713172000-memory.dmp

Filesize
3.9MB

Download
memory/1100-8002-0x00007FF712D80000-0x00007FF713172000-memory.dmp

Filesize
3.9MB

Download
memory/1388-435-0x00007FF652720000-0x00007FF652B12000-memory.dmp

Filesize
3.9MB

Download
memory/1480-428-0x00007FF6BBBB0000-0x00007FF6BBFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1484-7683-0x00007FF62BA00000-0x00007FF62BDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1484-443-0x00007FF62BA00000-0x00007FF62BDF2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-1-0x000002A7A5AD0000-0x000002A7A5AE0000-memory.dmp

Filesize
64KB

Download
memory/1624-1247-0x00007FF78B3B0000-0x00007FF78B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-0-0x00007FF78B3B0000-0x00007FF78B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-436-0x00007FF611810000-0x00007FF611C02000-memory.dmp

Filesize
3.9MB

Download
memory/2092-420-0x00007FF748E60000-0x00007FF749252000-memory.dmp

Filesize
3.9MB

Download
memory/2092-7565-0x00007FF748E60000-0x00007FF749252000-memory.dmp

Filesize
3.9MB

Download
memory/2132-434-0x00007FF6995F0000-0x00007FF6999E2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-5247-0x00007FF7F1EC0000-0x00007FF7F22B2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-56-0x00007FF7F1EC0000-0x00007FF7F22B2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-1249-0x00007FF6520E0000-0x00007FF6524D2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-7-0x00007FF6520E0000-0x00007FF6524D2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-17-0x00007FF701980000-0x00007FF701D72000-memory.dmp

Filesize
3.9MB

Download
memory/3004-419-0x00007FF65B780000-0x00007FF65BB72000-memory.dmp

Filesize
3.9MB

Download
memory/3104-437-0x00007FF7E1C50000-0x00007FF7E2042000-memory.dmp

Filesize
3.9MB

Download
memory/3112-47-0x00007FF7657C0000-0x00007FF765BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-29-0x00007FF7581E0000-0x00007FF7585D2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-37-0x000001E2EF910000-0x000001E2EF932000-memory.dmp

Filesize
136KB

Download
memory/3912-8-0x000001E2EF9D0000-0x000001E2EF9E0000-memory.dmp

Filesize
64KB

Download
memory/3912-9-0x00007FF9A4673000-0x00007FF9A4675000-memory.dmp

Filesize
8KB

Download
memory/4072-423-0x00007FF693DA0000-0x00007FF694192000-memory.dmp

Filesize
3.9MB

Download
memory/4312-41-0x00007FF7A9790000-0x00007FF7A9B82000-memory.dmp

Filesize
3.9MB

Download
memory/4528-7703-0x00007FF643610000-0x00007FF643A02000-memory.dmp

Filesize
3.9MB

Download
memory/4528-444-0x00007FF643610000-0x00007FF643A02000-memory.dmp

Filesize
3.9MB

Download
memory/4576-67-0x00007FF609CA0000-0x00007FF60A092000-memory.dmp

Filesize
3.9MB

Download
memory/4704-422-0x00007FF6BABF0000-0x00007FF6BAFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-52-0x00007FF6BFAC0000-0x00007FF6BFEB2000-memory.dmp

Filesize
3.9MB

Download