xmrig | 2854b6db98f9cd13d60e641ef83a97466822874f2970cdde4d5ed0b18ff951f1

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
Size

2.7MB
MD5

21fc1f8fdd204f67a213aaacd3c70460
SHA1

30e1af5a07f308409869a109ff3d2551c97652fd
SHA256

2854b6db98f9cd13d60e641ef83a97466822874f2970cdde4d5ed0b18ff951f1
SHA512

f406758cc46ee87e98991a4389d3e1183ddfd10092b115438988eb2276b6025f3878d0cd2ac139d48f946dc01c1dd68c90eab928ca2a239562b023c4f2116f7c
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2afp:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/2916-1-0x000000013F840000-0x000000013FC36000-memory.dmp	xmrig
behavioral1/files/0x002f000000015cfd-7.dat	xmrig
behavioral1/files/0x000e00000001226c-6.dat	xmrig
behavioral1/files/0x000a000000015d20-17.dat	xmrig
behavioral1/memory/2752-20-0x000000013FA80000-0x000000013FE76000-memory.dmp	xmrig
behavioral1/memory/3064-21-0x000000013F540000-0x000000013F936000-memory.dmp	xmrig
behavioral1/files/0x000f000000003683-35.dat	xmrig
behavioral1/files/0x0007000000015f54-46.dat	xmrig
behavioral1/files/0x00090000000160f3-53.dat	xmrig
behavioral1/files/0x0006000000016d3b-65.dat	xmrig
behavioral1/files/0x0006000000016d4c-74.dat	xmrig
behavioral1/files/0x0006000000016d44-70.dat	xmrig
behavioral1/files/0x0006000000016d70-94.dat	xmrig
behavioral1/files/0x0006000000016da0-105.dat	xmrig
behavioral1/memory/2616-110-0x000000013FE70000-0x0000000140266000-memory.dmp	xmrig
behavioral1/memory/2772-108-0x000000013F0D0000-0x000000013F4C6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016dc8-121.dat	xmrig
behavioral1/memory/2536-123-0x000000013F460000-0x000000013F856000-memory.dmp	xmrig
behavioral1/memory/2916-126-0x0000000003600000-0x00000000039F6000-memory.dmp	xmrig
behavioral1/memory/2732-130-0x000000013F920000-0x000000013FD16000-memory.dmp	xmrig
behavioral1/memory/2744-132-0x000000013FA20000-0x000000013FE16000-memory.dmp	xmrig
behavioral1/files/0x00060000000173b4-150.dat	xmrig
behavioral1/files/0x00060000000173d6-159.dat	xmrig
behavioral1/files/0x00060000000175e8-168.dat	xmrig
behavioral1/files/0x000600000001720f-187.dat	xmrig
behavioral1/files/0x00060000000175f4-171.dat	xmrig
behavioral1/files/0x0005000000018711-191.dat	xmrig
behavioral1/files/0x0005000000018701-178.dat	xmrig
behavioral1/files/0x0006000000017568-161.dat	xmrig
behavioral1/files/0x00060000000173d3-153.dat	xmrig
behavioral1/files/0x0006000000016dd1-140.dat	xmrig
behavioral1/files/0x0006000000016db2-138.dat	xmrig
behavioral1/files/0x000500000001870d-184.dat	xmrig
behavioral1/memory/2556-120-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2916-119-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2492-118-0x000000013FE50000-0x0000000140246000-memory.dmp	xmrig
behavioral1/memory/2532-116-0x000000013FE80000-0x0000000140276000-memory.dmp	xmrig
behavioral1/files/0x00050000000186ff-176.dat	xmrig
behavioral1/files/0x00060000000171ba-143.dat	xmrig
behavioral1/memory/2916-131-0x0000000003600000-0x00000000039F6000-memory.dmp	xmrig
behavioral1/memory/2152-125-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d78-100.dat	xmrig
behavioral1/files/0x0006000000016d6c-90.dat	xmrig
behavioral1/files/0x0006000000016d68-85.dat	xmrig
behavioral1/files/0x0006000000016d55-80.dat	xmrig
behavioral1/files/0x0007000000016cde-60.dat	xmrig
behavioral1/files/0x0007000000015fd4-51.dat	xmrig
behavioral1/files/0x0008000000015de5-40.dat	xmrig
behavioral1/files/0x0008000000015d42-31.dat	xmrig
behavioral1/memory/2620-29-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/memory/2916-2355-0x000000013F840000-0x000000013FC36000-memory.dmp	xmrig
behavioral1/memory/3064-4478-0x000000013F540000-0x000000013F936000-memory.dmp	xmrig
behavioral1/memory/2532-4476-0x000000013FE80000-0x0000000140276000-memory.dmp	xmrig
behavioral1/memory/2772-4488-0x000000013F0D0000-0x000000013F4C6000-memory.dmp	xmrig
behavioral1/memory/2536-4523-0x000000013F460000-0x000000013F856000-memory.dmp	xmrig
behavioral1/memory/2732-4525-0x000000013F920000-0x000000013FD16000-memory.dmp	xmrig
behavioral1/memory/2752-4563-0x000000013FA80000-0x000000013FE76000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3064	xewNAMr.exe
2620	vaDubZY.exe
2752	jlVQZmd.exe
2772	kpbJauh.exe
2616	IWJCXgz.exe
2532	Ftorlvr.exe
2492	TXIayRf.exe
2556	cAjkhwP.exe
2536	ENAXoKn.exe
2152	UuSzANc.exe
2732	aUkLMwi.exe
2744	iXtWVTI.exe
2816	ODzAaKC.exe
2848	RAQDPfO.exe
1584	kCdrRjF.exe
1988	cautPnR.exe
1260	qcHtYYC.exe
2188	wrhHAYB.exe
1316	YZkXCPK.exe
2044	mMSQbAl.exe
1268	vymOpXX.exe
2316	VpIxmNe.exe
1928	uAiDoLT.exe
772	IxBqMwc.exe
2280	kisSwff.exe
1140	jAHVQEf.exe
1940	iqaOOkK.exe
2896	mImWFnU.exe
684	tGmhdlk.exe
1404	hxKdezB.exe
1552	clFhQqX.exe
2348	nXyPBVf.exe
1104	CCuFDtm.exe
1704	yLzLCev.exe
2884	EnVgTeu.exe
1796	jYwSWuf.exe
2076	MGMDOnB.exe
380	OtfiaCu.exe
944	iCIuYAM.exe
700	oiZHfYz.exe
1948	jBxymWr.exe
2104	VEUyKpB.exe
3060	NxzaWNE.exe
1408	HvkIAPX.exe
1208	mCMjUXd.exe
2368	kmtoUSn.exe
624	mTPNYcK.exe
2796	lOhaKWc.exe
1672	qVUDEOI.exe
2572	eqihOrA.exe
1528	eWWeVyf.exe
2632	BBGcNib.exe
2000	rmDOjUz.exe
2764	JsJsmCi.exe
2652	imPEQtg.exe
2472	BUUNijF.exe
3000	IvFinza.exe
1556	DiiOuZa.exe
2724	wVmYfAP.exe
2836	htcCeOP.exe
1848	ZdUorpo.exe
1360	NlixtVu.exe
1244	sGAXgCw.exe
592	boPTDFd.exe

Loads dropped DLL 64 IoCs

pid	Process
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-1-0x000000013F840000-0x000000013FC36000-memory.dmp	upx
behavioral1/files/0x002f000000015cfd-7.dat	upx
behavioral1/files/0x000e00000001226c-6.dat	upx
behavioral1/files/0x000a000000015d20-17.dat	upx
behavioral1/memory/2752-20-0x000000013FA80000-0x000000013FE76000-memory.dmp	upx
behavioral1/memory/3064-21-0x000000013F540000-0x000000013F936000-memory.dmp	upx
behavioral1/files/0x000f000000003683-35.dat	upx
behavioral1/files/0x0007000000015f54-46.dat	upx
behavioral1/files/0x00090000000160f3-53.dat	upx
behavioral1/files/0x0006000000016d3b-65.dat	upx
behavioral1/files/0x0006000000016d4c-74.dat	upx
behavioral1/files/0x0006000000016d44-70.dat	upx
behavioral1/files/0x0006000000016d70-94.dat	upx
behavioral1/files/0x0006000000016da0-105.dat	upx
behavioral1/memory/2616-110-0x000000013FE70000-0x0000000140266000-memory.dmp	upx
behavioral1/memory/2772-108-0x000000013F0D0000-0x000000013F4C6000-memory.dmp	upx
behavioral1/files/0x0006000000016dc8-121.dat	upx
behavioral1/memory/2536-123-0x000000013F460000-0x000000013F856000-memory.dmp	upx
behavioral1/memory/2732-130-0x000000013F920000-0x000000013FD16000-memory.dmp	upx
behavioral1/memory/2744-132-0x000000013FA20000-0x000000013FE16000-memory.dmp	upx
behavioral1/files/0x00060000000173b4-150.dat	upx
behavioral1/files/0x00060000000173d6-159.dat	upx
behavioral1/files/0x00060000000175e8-168.dat	upx
behavioral1/files/0x000600000001720f-187.dat	upx
behavioral1/files/0x00060000000175f4-171.dat	upx
behavioral1/files/0x0005000000018711-191.dat	upx
behavioral1/files/0x0005000000018701-178.dat	upx
behavioral1/files/0x0006000000017568-161.dat	upx
behavioral1/files/0x00060000000173d3-153.dat	upx
behavioral1/files/0x0006000000016dd1-140.dat	upx
behavioral1/files/0x0006000000016db2-138.dat	upx
behavioral1/files/0x000500000001870d-184.dat	upx
behavioral1/memory/2556-120-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2492-118-0x000000013FE50000-0x0000000140246000-memory.dmp	upx
behavioral1/memory/2532-116-0x000000013FE80000-0x0000000140276000-memory.dmp	upx
behavioral1/files/0x00050000000186ff-176.dat	upx
behavioral1/files/0x00060000000171ba-143.dat	upx
behavioral1/memory/2152-125-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x0006000000016d78-100.dat	upx
behavioral1/files/0x0006000000016d6c-90.dat	upx
behavioral1/files/0x0006000000016d68-85.dat	upx
behavioral1/files/0x0006000000016d55-80.dat	upx
behavioral1/files/0x0007000000016cde-60.dat	upx
behavioral1/files/0x0007000000015fd4-51.dat	upx
behavioral1/files/0x0008000000015de5-40.dat	upx
behavioral1/files/0x0008000000015d42-31.dat	upx
behavioral1/memory/2620-29-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/memory/2916-2355-0x000000013F840000-0x000000013FC36000-memory.dmp	upx
behavioral1/memory/3064-4478-0x000000013F540000-0x000000013F936000-memory.dmp	upx
behavioral1/memory/2532-4476-0x000000013FE80000-0x0000000140276000-memory.dmp	upx
behavioral1/memory/2772-4488-0x000000013F0D0000-0x000000013F4C6000-memory.dmp	upx
behavioral1/memory/2536-4523-0x000000013F460000-0x000000013F856000-memory.dmp	upx
behavioral1/memory/2732-4525-0x000000013F920000-0x000000013FD16000-memory.dmp	upx
behavioral1/memory/2752-4563-0x000000013FA80000-0x000000013FE76000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MaAMoDb.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\xYtXALO.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\jrQhcsk.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\adkmSyx.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\iDiGqSj.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\ekNXByl.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\bEgqtiS.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\VxCOLKa.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\zdzQBHU.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\BtyNkRC.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\zePxeLv.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\MWxyPzh.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\MeFPijT.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\PhyExDk.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\GnrWflh.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\SzPRkDs.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\SaadVfp.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\TJJmwcQ.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\RYNeUEY.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\FEwLoPI.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\TimLKoU.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\fWOJhop.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\pScXoeC.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\ENfQLam.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\vtCQflk.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\vGlQHno.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\oxYMRll.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\vUjYuae.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\kzLWsWL.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\igUArdl.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\LByfLXb.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\vfDNDYO.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\StEJYEP.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\zzMdvQK.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\BuzpIJs.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\kpbJauh.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\CkjHiup.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\pnquLIV.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\SToKuHs.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\BJhvRWq.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\ZBlqAhe.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\jLcLiGD.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\pcWyzUL.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\XpzsjUs.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\NUOXDzV.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\vCsAiza.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\qpznxpE.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\RSbCmJQ.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\ySrumId.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\BgwTDCt.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\nKAEFne.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\DqjDIAu.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\jImHFlb.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\earduQY.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\qOMEUwb.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\HAqsiGE.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\uUQiuew.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\iuYyTXB.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\FIHBCRD.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\iWDAmTR.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\xYhMXkP.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\CPQurLq.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\Ajmatta.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
File created	C:\Windows\System\WVrMTVq.exe	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
Token: SeDebugPrivilege	3004	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3004	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 3004	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 3004	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 3064	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 3064	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 3064	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 2620	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	31
PID 2916 wrote to memory of 2620	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	31
PID 2916 wrote to memory of 2620	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	31
PID 2916 wrote to memory of 2752	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 2752	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 2752	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 2772	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 2772	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 2772	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 2616	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	34
PID 2916 wrote to memory of 2616	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	34
PID 2916 wrote to memory of 2616	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	34
PID 2916 wrote to memory of 2532	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	35
PID 2916 wrote to memory of 2532	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	35
PID 2916 wrote to memory of 2532	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	35
PID 2916 wrote to memory of 2492	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	36
PID 2916 wrote to memory of 2492	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	36
PID 2916 wrote to memory of 2492	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	36
PID 2916 wrote to memory of 2556	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	37
PID 2916 wrote to memory of 2556	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	37
PID 2916 wrote to memory of 2556	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	37
PID 2916 wrote to memory of 2536	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	38
PID 2916 wrote to memory of 2536	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	38
PID 2916 wrote to memory of 2536	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	38
PID 2916 wrote to memory of 2152	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2152	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2152	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2732	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2732	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2732	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2744	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	41
PID 2916 wrote to memory of 2744	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	41
PID 2916 wrote to memory of 2744	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	41
PID 2916 wrote to memory of 2816	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	42
PID 2916 wrote to memory of 2816	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	42
PID 2916 wrote to memory of 2816	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	42
PID 2916 wrote to memory of 2848	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	43
PID 2916 wrote to memory of 2848	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	43
PID 2916 wrote to memory of 2848	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	43
PID 2916 wrote to memory of 1584	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	44
PID 2916 wrote to memory of 1584	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	44
PID 2916 wrote to memory of 1584	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	44
PID 2916 wrote to memory of 1988	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	45
PID 2916 wrote to memory of 1988	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	45
PID 2916 wrote to memory of 1988	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	45
PID 2916 wrote to memory of 1260	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	46
PID 2916 wrote to memory of 1260	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	46
PID 2916 wrote to memory of 1260	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	46
PID 2916 wrote to memory of 2188	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	47
PID 2916 wrote to memory of 2188	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	47
PID 2916 wrote to memory of 2188	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	47
PID 2916 wrote to memory of 1316	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	48
PID 2916 wrote to memory of 1316	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	48
PID 2916 wrote to memory of 1316	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	48
PID 2916 wrote to memory of 1268	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	49
PID 2916 wrote to memory of 1268	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	49
PID 2916 wrote to memory of 1268	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	49
PID 2916 wrote to memory of 2044	2916	21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\21fc1f8fdd204f67a213aaacd3c70460_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System\xewNAMr.exe
  C:\Windows\System\xewNAMr.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\vaDubZY.exe
  C:\Windows\System\vaDubZY.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\jlVQZmd.exe
  C:\Windows\System\jlVQZmd.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\kpbJauh.exe
  C:\Windows\System\kpbJauh.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\IWJCXgz.exe
  C:\Windows\System\IWJCXgz.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\Ftorlvr.exe
  C:\Windows\System\Ftorlvr.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\TXIayRf.exe
  C:\Windows\System\TXIayRf.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\cAjkhwP.exe
  C:\Windows\System\cAjkhwP.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\ENAXoKn.exe
  C:\Windows\System\ENAXoKn.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\UuSzANc.exe
  C:\Windows\System\UuSzANc.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\aUkLMwi.exe
  C:\Windows\System\aUkLMwi.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\iXtWVTI.exe
  C:\Windows\System\iXtWVTI.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ODzAaKC.exe
  C:\Windows\System\ODzAaKC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\RAQDPfO.exe
  C:\Windows\System\RAQDPfO.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\kCdrRjF.exe
  C:\Windows\System\kCdrRjF.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\cautPnR.exe
  C:\Windows\System\cautPnR.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\qcHtYYC.exe
  C:\Windows\System\qcHtYYC.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\wrhHAYB.exe
  C:\Windows\System\wrhHAYB.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\YZkXCPK.exe
  C:\Windows\System\YZkXCPK.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\vymOpXX.exe
  C:\Windows\System\vymOpXX.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\mMSQbAl.exe
  C:\Windows\System\mMSQbAl.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\VpIxmNe.exe
  C:\Windows\System\VpIxmNe.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\uAiDoLT.exe
  C:\Windows\System\uAiDoLT.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\tGmhdlk.exe
  C:\Windows\System\tGmhdlk.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\IxBqMwc.exe
  C:\Windows\System\IxBqMwc.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\hxKdezB.exe
  C:\Windows\System\hxKdezB.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\kisSwff.exe
  C:\Windows\System\kisSwff.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\clFhQqX.exe
  C:\Windows\System\clFhQqX.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\jAHVQEf.exe
  C:\Windows\System\jAHVQEf.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\nXyPBVf.exe
  C:\Windows\System\nXyPBVf.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\iqaOOkK.exe
  C:\Windows\System\iqaOOkK.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\CCuFDtm.exe
  C:\Windows\System\CCuFDtm.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\mImWFnU.exe
  C:\Windows\System\mImWFnU.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\yLzLCev.exe
  C:\Windows\System\yLzLCev.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\EnVgTeu.exe
  C:\Windows\System\EnVgTeu.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\jYwSWuf.exe
  C:\Windows\System\jYwSWuf.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\MGMDOnB.exe
  C:\Windows\System\MGMDOnB.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\OtfiaCu.exe
  C:\Windows\System\OtfiaCu.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\iCIuYAM.exe
  C:\Windows\System\iCIuYAM.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\VEUyKpB.exe
  C:\Windows\System\VEUyKpB.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\oiZHfYz.exe
  C:\Windows\System\oiZHfYz.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\mCMjUXd.exe
  C:\Windows\System\mCMjUXd.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\jBxymWr.exe
  C:\Windows\System\jBxymWr.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\kmtoUSn.exe
  C:\Windows\System\kmtoUSn.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\NxzaWNE.exe
  C:\Windows\System\NxzaWNE.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\mTPNYcK.exe
  C:\Windows\System\mTPNYcK.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\HvkIAPX.exe
  C:\Windows\System\HvkIAPX.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\lOhaKWc.exe
  C:\Windows\System\lOhaKWc.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\qVUDEOI.exe
  C:\Windows\System\qVUDEOI.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\eqihOrA.exe
  C:\Windows\System\eqihOrA.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\eWWeVyf.exe
  C:\Windows\System\eWWeVyf.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\BBGcNib.exe
  C:\Windows\System\BBGcNib.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\rmDOjUz.exe
  C:\Windows\System\rmDOjUz.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\JsJsmCi.exe
  C:\Windows\System\JsJsmCi.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\imPEQtg.exe
  C:\Windows\System\imPEQtg.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\BUUNijF.exe
  C:\Windows\System\BUUNijF.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\IvFinza.exe
  C:\Windows\System\IvFinza.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\DiiOuZa.exe
  C:\Windows\System\DiiOuZa.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\wVmYfAP.exe
  C:\Windows\System\wVmYfAP.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\htcCeOP.exe
  C:\Windows\System\htcCeOP.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\ZdUorpo.exe
  C:\Windows\System\ZdUorpo.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\NlixtVu.exe
  C:\Windows\System\NlixtVu.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\sGAXgCw.exe
  C:\Windows\System\sGAXgCw.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\boPTDFd.exe
  C:\Windows\System\boPTDFd.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\RRXJYVl.exe
  C:\Windows\System\RRXJYVl.exe
  2⤵
  PID:2456
- C:\Windows\System\kyxLYMK.exe
  C:\Windows\System\kyxLYMK.exe
  2⤵
  PID:1484
- C:\Windows\System\BDUZdbi.exe
  C:\Windows\System\BDUZdbi.exe
  2⤵
  PID:448
- C:\Windows\System\hWyxeDU.exe
  C:\Windows\System\hWyxeDU.exe
  2⤵
  PID:844
- C:\Windows\System\zPJHYiV.exe
  C:\Windows\System\zPJHYiV.exe
  2⤵
  PID:788
- C:\Windows\System\KUIqLSF.exe
  C:\Windows\System\KUIqLSF.exe
  2⤵
  PID:1396
- C:\Windows\System\eTSDpkj.exe
  C:\Windows\System\eTSDpkj.exe
  2⤵
  PID:2272
- C:\Windows\System\oMiqhcc.exe
  C:\Windows\System\oMiqhcc.exe
  2⤵
  PID:1176
- C:\Windows\System\XDlnDZD.exe
  C:\Windows\System\XDlnDZD.exe
  2⤵
  PID:776
- C:\Windows\System\VlSZVWX.exe
  C:\Windows\System\VlSZVWX.exe
  2⤵
  PID:316
- C:\Windows\System\FETwEbN.exe
  C:\Windows\System\FETwEbN.exe
  2⤵
  PID:2356
- C:\Windows\System\wvSrhyT.exe
  C:\Windows\System\wvSrhyT.exe
  2⤵
  PID:2372
- C:\Windows\System\kpWDDNO.exe
  C:\Windows\System\kpWDDNO.exe
  2⤵
  PID:2252
- C:\Windows\System\ruscCUh.exe
  C:\Windows\System\ruscCUh.exe
  2⤵
  PID:2668
- C:\Windows\System\ApotFbK.exe
  C:\Windows\System\ApotFbK.exe
  2⤵
  PID:2404
- C:\Windows\System\zePxeLv.exe
  C:\Windows\System\zePxeLv.exe
  2⤵
  PID:2868
- C:\Windows\System\fDCZhzz.exe
  C:\Windows\System\fDCZhzz.exe
  2⤵
  PID:2612
- C:\Windows\System\GSXJmgP.exe
  C:\Windows\System\GSXJmgP.exe
  2⤵
  PID:2452
- C:\Windows\System\pTUPxPB.exe
  C:\Windows\System\pTUPxPB.exe
  2⤵
  PID:2440
- C:\Windows\System\NeGivBn.exe
  C:\Windows\System\NeGivBn.exe
  2⤵
  PID:2184
- C:\Windows\System\cPYdwiu.exe
  C:\Windows\System\cPYdwiu.exe
  2⤵
  PID:1224
- C:\Windows\System\ZwjGkPn.exe
  C:\Windows\System\ZwjGkPn.exe
  2⤵
  PID:2972
- C:\Windows\System\CNPwkJs.exe
  C:\Windows\System\CNPwkJs.exe
  2⤵
  PID:3036
- C:\Windows\System\lMlYyGq.exe
  C:\Windows\System\lMlYyGq.exe
  2⤵
  PID:2672
- C:\Windows\System\dcqOEft.exe
  C:\Windows\System\dcqOEft.exe
  2⤵
  PID:2564
- C:\Windows\System\zcYdVuh.exe
  C:\Windows\System\zcYdVuh.exe
  2⤵
  PID:1524
- C:\Windows\System\EuHcvzf.exe
  C:\Windows\System\EuHcvzf.exe
  2⤵
  PID:1000
- C:\Windows\System\KmuyRFa.exe
  C:\Windows\System\KmuyRFa.exe
  2⤵
  PID:892
- C:\Windows\System\tpeBpYy.exe
  C:\Windows\System\tpeBpYy.exe
  2⤵
  PID:408
- C:\Windows\System\JSaYihT.exe
  C:\Windows\System\JSaYihT.exe
  2⤵
  PID:2408
- C:\Windows\System\ZVwyKKu.exe
  C:\Windows\System\ZVwyKKu.exe
  2⤵
  PID:2636
- C:\Windows\System\kQCRSJr.exe
  C:\Windows\System\kQCRSJr.exe
  2⤵
  PID:2864
- C:\Windows\System\UZLCATj.exe
  C:\Windows\System\UZLCATj.exe
  2⤵
  PID:2476
- C:\Windows\System\uKmYfln.exe
  C:\Windows\System\uKmYfln.exe
  2⤵
  PID:2712
- C:\Windows\System\GslVbbZ.exe
  C:\Windows\System\GslVbbZ.exe
  2⤵
  PID:2728
- C:\Windows\System\FjHYteL.exe
  C:\Windows\System\FjHYteL.exe
  2⤵
  PID:2720
- C:\Windows\System\koDmRIP.exe
  C:\Windows\System\koDmRIP.exe
  2⤵
  PID:1576
- C:\Windows\System\onrIzgq.exe
  C:\Windows\System\onrIzgq.exe
  2⤵
  PID:968
- C:\Windows\System\AvEQxsj.exe
  C:\Windows\System\AvEQxsj.exe
  2⤵
  PID:576
- C:\Windows\System\sTZwlil.exe
  C:\Windows\System\sTZwlil.exe
  2⤵
  PID:1656
- C:\Windows\System\TEHAnZS.exe
  C:\Windows\System\TEHAnZS.exe
  2⤵
  PID:2464
- C:\Windows\System\jTkzzWo.exe
  C:\Windows\System\jTkzzWo.exe
  2⤵
  PID:1720
- C:\Windows\System\WTbRdDS.exe
  C:\Windows\System\WTbRdDS.exe
  2⤵
  PID:1284
- C:\Windows\System\NXwvNvS.exe
  C:\Windows\System\NXwvNvS.exe
  2⤵
  PID:1888
- C:\Windows\System\ijohrky.exe
  C:\Windows\System\ijohrky.exe
  2⤵
  PID:2132
- C:\Windows\System\wNhuVXl.exe
  C:\Windows\System\wNhuVXl.exe
  2⤵
  PID:2560
- C:\Windows\System\JcUBTOZ.exe
  C:\Windows\System\JcUBTOZ.exe
  2⤵
  PID:2520
- C:\Windows\System\BMRkGBS.exe
  C:\Windows\System\BMRkGBS.exe
  2⤵
  PID:1276
- C:\Windows\System\cOsKblT.exe
  C:\Windows\System\cOsKblT.exe
  2⤵
  PID:2040
- C:\Windows\System\XdJQJwA.exe
  C:\Windows\System\XdJQJwA.exe
  2⤵
  PID:780
- C:\Windows\System\RgveYKM.exe
  C:\Windows\System\RgveYKM.exe
  2⤵
  PID:2020
- C:\Windows\System\qfiXiPR.exe
  C:\Windows\System\qfiXiPR.exe
  2⤵
  PID:3012
- C:\Windows\System\yOhBKpU.exe
  C:\Windows\System\yOhBKpU.exe
  2⤵
  PID:2328
- C:\Windows\System\fuJIjPV.exe
  C:\Windows\System\fuJIjPV.exe
  2⤵
  PID:2376
- C:\Windows\System\tFvihxT.exe
  C:\Windows\System\tFvihxT.exe
  2⤵
  PID:1580
- C:\Windows\System\wOUEqBe.exe
  C:\Windows\System\wOUEqBe.exe
  2⤵
  PID:1532
- C:\Windows\System\wzoSYwW.exe
  C:\Windows\System\wzoSYwW.exe
  2⤵
  PID:1652
- C:\Windows\System\trTDirK.exe
  C:\Windows\System\trTDirK.exe
  2⤵
  PID:2788
- C:\Windows\System\dyUtQAI.exe
  C:\Windows\System\dyUtQAI.exe
  2⤵
  PID:1860
- C:\Windows\System\rvHBtHW.exe
  C:\Windows\System\rvHBtHW.exe
  2⤵
  PID:2200
- C:\Windows\System\eJwNVxx.exe
  C:\Windows\System\eJwNVxx.exe
  2⤵
  PID:1540
- C:\Windows\System\ERMKmrm.exe
  C:\Windows\System\ERMKmrm.exe
  2⤵
  PID:2220
- C:\Windows\System\ZHHbkku.exe
  C:\Windows\System\ZHHbkku.exe
  2⤵
  PID:2028
- C:\Windows\System\mMGhrcD.exe
  C:\Windows\System\mMGhrcD.exe
  2⤵
  PID:1516
- C:\Windows\System\iwQIuEV.exe
  C:\Windows\System\iwQIuEV.exe
  2⤵
  PID:960
- C:\Windows\System\HdCdmrg.exe
  C:\Windows\System\HdCdmrg.exe
  2⤵
  PID:1480
- C:\Windows\System\FvJSlsk.exe
  C:\Windows\System\FvJSlsk.exe
  2⤵
  PID:2400
- C:\Windows\System\REBqjPa.exe
  C:\Windows\System\REBqjPa.exe
  2⤵
  PID:356
- C:\Windows\System\LHvANVf.exe
  C:\Windows\System\LHvANVf.exe
  2⤵
  PID:2996
- C:\Windows\System\NEpPiLB.exe
  C:\Windows\System\NEpPiLB.exe
  2⤵
  PID:1896
- C:\Windows\System\spfmyxh.exe
  C:\Windows\System\spfmyxh.exe
  2⤵
  PID:2032
- C:\Windows\System\eyAQoBT.exe
  C:\Windows\System\eyAQoBT.exe
  2⤵
  PID:2136
- C:\Windows\System\OehVckS.exe
  C:\Windows\System\OehVckS.exe
  2⤵
  PID:2660
- C:\Windows\System\qXmmqEi.exe
  C:\Windows\System\qXmmqEi.exe
  2⤵
  PID:396
- C:\Windows\System\ujklBux.exe
  C:\Windows\System\ujklBux.exe
  2⤵
  PID:2840
- C:\Windows\System\QYDvnNZ.exe
  C:\Windows\System\QYDvnNZ.exe
  2⤵
  PID:3048
- C:\Windows\System\fHwTHMZ.exe
  C:\Windows\System\fHwTHMZ.exe
  2⤵
  PID:1180
- C:\Windows\System\tNsTAos.exe
  C:\Windows\System\tNsTAos.exe
  2⤵
  PID:2664
- C:\Windows\System\DUgVHFE.exe
  C:\Windows\System\DUgVHFE.exe
  2⤵
  PID:2588
- C:\Windows\System\LhDUQoe.exe
  C:\Windows\System\LhDUQoe.exe
  2⤵
  PID:640
- C:\Windows\System\LnCSvqz.exe
  C:\Windows\System\LnCSvqz.exe
  2⤵
  PID:1448
- C:\Windows\System\RjUshpy.exe
  C:\Windows\System\RjUshpy.exe
  2⤵
  PID:1648
- C:\Windows\System\rFXXksl.exe
  C:\Windows\System\rFXXksl.exe
  2⤵
  PID:2708
- C:\Windows\System\UqWcixb.exe
  C:\Windows\System\UqWcixb.exe
  2⤵
  PID:3088
- C:\Windows\System\MIuRQtz.exe
  C:\Windows\System\MIuRQtz.exe
  2⤵
  PID:3104
- C:\Windows\System\xVPScbc.exe
  C:\Windows\System\xVPScbc.exe
  2⤵
  PID:3120
- C:\Windows\System\NsZqTTj.exe
  C:\Windows\System\NsZqTTj.exe
  2⤵
  PID:3136
- C:\Windows\System\TimLKoU.exe
  C:\Windows\System\TimLKoU.exe
  2⤵
  PID:3156
- C:\Windows\System\pxbTeuk.exe
  C:\Windows\System\pxbTeuk.exe
  2⤵
  PID:3192
- C:\Windows\System\qysxvaV.exe
  C:\Windows\System\qysxvaV.exe
  2⤵
  PID:3208
- C:\Windows\System\uthDJhk.exe
  C:\Windows\System\uthDJhk.exe
  2⤵
  PID:3228
- C:\Windows\System\PxIaccR.exe
  C:\Windows\System\PxIaccR.exe
  2⤵
  PID:3244
- C:\Windows\System\RqruKpi.exe
  C:\Windows\System\RqruKpi.exe
  2⤵
  PID:3264
- C:\Windows\System\YiniFJC.exe
  C:\Windows\System\YiniFJC.exe
  2⤵
  PID:3288
- C:\Windows\System\YcYFVvY.exe
  C:\Windows\System\YcYFVvY.exe
  2⤵
  PID:3308
- C:\Windows\System\DFMIIOt.exe
  C:\Windows\System\DFMIIOt.exe
  2⤵
  PID:3324
- C:\Windows\System\ibrMwiN.exe
  C:\Windows\System\ibrMwiN.exe
  2⤵
  PID:3348
- C:\Windows\System\nZoVYeI.exe
  C:\Windows\System\nZoVYeI.exe
  2⤵
  PID:3368
- C:\Windows\System\MUUGyNl.exe
  C:\Windows\System\MUUGyNl.exe
  2⤵
  PID:3400
- C:\Windows\System\IsiBhaq.exe
  C:\Windows\System\IsiBhaq.exe
  2⤵
  PID:3416
- C:\Windows\System\dCFtcJy.exe
  C:\Windows\System\dCFtcJy.exe
  2⤵
  PID:3436
- C:\Windows\System\yNFDdBg.exe
  C:\Windows\System\yNFDdBg.exe
  2⤵
  PID:3452
- C:\Windows\System\qlQAGbM.exe
  C:\Windows\System\qlQAGbM.exe
  2⤵
  PID:3468
- C:\Windows\System\kFwmZTC.exe
  C:\Windows\System\kFwmZTC.exe
  2⤵
  PID:3484
- C:\Windows\System\uUjfhJc.exe
  C:\Windows\System\uUjfhJc.exe
  2⤵
  PID:3500
- C:\Windows\System\qrfHprf.exe
  C:\Windows\System\qrfHprf.exe
  2⤵
  PID:3516
- C:\Windows\System\Trjcrdz.exe
  C:\Windows\System\Trjcrdz.exe
  2⤵
  PID:3532
- C:\Windows\System\BxLoTTj.exe
  C:\Windows\System\BxLoTTj.exe
  2⤵
  PID:3548
- C:\Windows\System\YAjsHZE.exe
  C:\Windows\System\YAjsHZE.exe
  2⤵
  PID:3564
- C:\Windows\System\pZrqzQe.exe
  C:\Windows\System\pZrqzQe.exe
  2⤵
  PID:3580
- C:\Windows\System\luxcMgx.exe
  C:\Windows\System\luxcMgx.exe
  2⤵
  PID:3600
- C:\Windows\System\qtxuCst.exe
  C:\Windows\System\qtxuCst.exe
  2⤵
  PID:3616
- C:\Windows\System\mMkuwWE.exe
  C:\Windows\System\mMkuwWE.exe
  2⤵
  PID:3632
- C:\Windows\System\JKbuThh.exe
  C:\Windows\System\JKbuThh.exe
  2⤵
  PID:3648
- C:\Windows\System\TdoCaQO.exe
  C:\Windows\System\TdoCaQO.exe
  2⤵
  PID:3664
- C:\Windows\System\qajgIrm.exe
  C:\Windows\System\qajgIrm.exe
  2⤵
  PID:3680
- C:\Windows\System\qCGTgua.exe
  C:\Windows\System\qCGTgua.exe
  2⤵
  PID:3696
- C:\Windows\System\MpeiyXf.exe
  C:\Windows\System\MpeiyXf.exe
  2⤵
  PID:3712
- C:\Windows\System\kkzlBbS.exe
  C:\Windows\System\kkzlBbS.exe
  2⤵
  PID:3748
- C:\Windows\System\BvXnGgW.exe
  C:\Windows\System\BvXnGgW.exe
  2⤵
  PID:3764
- C:\Windows\System\YIrpjQc.exe
  C:\Windows\System\YIrpjQc.exe
  2⤵
  PID:3784
- C:\Windows\System\hKCBXpn.exe
  C:\Windows\System\hKCBXpn.exe
  2⤵
  PID:3808
- C:\Windows\System\AqZuYQp.exe
  C:\Windows\System\AqZuYQp.exe
  2⤵
  PID:3828
- C:\Windows\System\QjDxBzs.exe
  C:\Windows\System\QjDxBzs.exe
  2⤵
  PID:3864
- C:\Windows\System\VFDFSXD.exe
  C:\Windows\System\VFDFSXD.exe
  2⤵
  PID:3880
- C:\Windows\System\CuDmyIw.exe
  C:\Windows\System\CuDmyIw.exe
  2⤵
  PID:3896
- C:\Windows\System\uhHEtpi.exe
  C:\Windows\System\uhHEtpi.exe
  2⤵
  PID:3912
- C:\Windows\System\KakbLQx.exe
  C:\Windows\System\KakbLQx.exe
  2⤵
  PID:3940
- C:\Windows\System\awZhBzT.exe
  C:\Windows\System\awZhBzT.exe
  2⤵
  PID:3964
- C:\Windows\System\rTtyDYj.exe
  C:\Windows\System\rTtyDYj.exe
  2⤵
  PID:3980
- C:\Windows\System\LTFvwTO.exe
  C:\Windows\System\LTFvwTO.exe
  2⤵
  PID:4004
- C:\Windows\System\JnFGCGm.exe
  C:\Windows\System\JnFGCGm.exe
  2⤵
  PID:4020
- C:\Windows\System\pOAYRAK.exe
  C:\Windows\System\pOAYRAK.exe
  2⤵
  PID:4044
- C:\Windows\System\BSnCXch.exe
  C:\Windows\System\BSnCXch.exe
  2⤵
  PID:4064
- C:\Windows\System\SXSjRlm.exe
  C:\Windows\System\SXSjRlm.exe
  2⤵
  PID:4080
- C:\Windows\System\ZQQSHIC.exe
  C:\Windows\System\ZQQSHIC.exe
  2⤵
  PID:928
- C:\Windows\System\xSXFOWj.exe
  C:\Windows\System\xSXFOWj.exe
  2⤵
  PID:2488
- C:\Windows\System\KFgUKzJ.exe
  C:\Windows\System\KFgUKzJ.exe
  2⤵
  PID:3084
- C:\Windows\System\EVoBVTC.exe
  C:\Windows\System\EVoBVTC.exe
  2⤵
  PID:1236
- C:\Windows\System\tzZNujC.exe
  C:\Windows\System\tzZNujC.exe
  2⤵
  PID:3148
- C:\Windows\System\RTAejZF.exe
  C:\Windows\System\RTAejZF.exe
  2⤵
  PID:2416
- C:\Windows\System\aVVYTTp.exe
  C:\Windows\System\aVVYTTp.exe
  2⤵
  PID:924
- C:\Windows\System\hhBPjXK.exe
  C:\Windows\System\hhBPjXK.exe
  2⤵
  PID:2308
- C:\Windows\System\pvCAWGl.exe
  C:\Windows\System\pvCAWGl.exe
  2⤵
  PID:3204
- C:\Windows\System\TbqujjV.exe
  C:\Windows\System\TbqujjV.exe
  2⤵
  PID:3128
- C:\Windows\System\SszKGfR.exe
  C:\Windows\System\SszKGfR.exe
  2⤵
  PID:2648
- C:\Windows\System\HRhzCGR.exe
  C:\Windows\System\HRhzCGR.exe
  2⤵
  PID:3172
- C:\Windows\System\SXrMjxR.exe
  C:\Windows\System\SXrMjxR.exe
  2⤵
  PID:2748
- C:\Windows\System\ZheaMJl.exe
  C:\Windows\System\ZheaMJl.exe
  2⤵
  PID:3364
- C:\Windows\System\cqUvhPu.exe
  C:\Windows\System\cqUvhPu.exe
  2⤵
  PID:3032
- C:\Windows\System\wwMnDbM.exe
  C:\Windows\System\wwMnDbM.exe
  2⤵
  PID:3756
- C:\Windows\System\bWDWKUv.exe
  C:\Windows\System\bWDWKUv.exe
  2⤵
  PID:3796
- C:\Windows\System\kCAXiXW.exe
  C:\Windows\System\kCAXiXW.exe
  2⤵
  PID:3844
- C:\Windows\System\zvWptka.exe
  C:\Windows\System\zvWptka.exe
  2⤵
  PID:3860
- C:\Windows\System\ZbxafoK.exe
  C:\Windows\System\ZbxafoK.exe
  2⤵
  PID:3924
- C:\Windows\System\ZNNPhlS.exe
  C:\Windows\System\ZNNPhlS.exe
  2⤵
  PID:3936
- C:\Windows\System\zdnSjPC.exe
  C:\Windows\System\zdnSjPC.exe
  2⤵
  PID:4012
- C:\Windows\System\egkaJfA.exe
  C:\Windows\System\egkaJfA.exe
  2⤵
  PID:4056
- C:\Windows\System\HxQexAC.exe
  C:\Windows\System\HxQexAC.exe
  2⤵
  PID:4088
- C:\Windows\System\YxlMVcz.exe
  C:\Windows\System\YxlMVcz.exe
  2⤵
  PID:2944
- C:\Windows\System\wihsKdh.exe
  C:\Windows\System\wihsKdh.exe
  2⤵
  PID:2684
- C:\Windows\System\njlTVvB.exe
  C:\Windows\System\njlTVvB.exe
  2⤵
  PID:2876
- C:\Windows\System\tnJzJti.exe
  C:\Windows\System\tnJzJti.exe
  2⤵
  PID:3908
- C:\Windows\System\yOnciwM.exe
  C:\Windows\System\yOnciwM.exe
  2⤵
  PID:3528
- C:\Windows\System\LDajazF.exe
  C:\Windows\System\LDajazF.exe
  2⤵
  PID:3952
- C:\Windows\System\HdbBMRo.exe
  C:\Windows\System\HdbBMRo.exe
  2⤵
  PID:3100
- C:\Windows\System\YwNPmRl.exe
  C:\Windows\System\YwNPmRl.exe
  2⤵
  PID:3184
- C:\Windows\System\vqFkkyX.exe
  C:\Windows\System\vqFkkyX.exe
  2⤵
  PID:3332
- C:\Windows\System\MBuogZF.exe
  C:\Windows\System\MBuogZF.exe
  2⤵
  PID:3396
- C:\Windows\System\qtUDbpP.exe
  C:\Windows\System\qtUDbpP.exe
  2⤵
  PID:3460
- C:\Windows\System\uXLmJwv.exe
  C:\Windows\System\uXLmJwv.exe
  2⤵
  PID:3688
- C:\Windows\System\uIPfbvO.exe
  C:\Windows\System\uIPfbvO.exe
  2⤵
  PID:3728
- C:\Windows\System\MkssHOS.exe
  C:\Windows\System\MkssHOS.exe
  2⤵
  PID:3744
- C:\Windows\System\qdWUfYG.exe
  C:\Windows\System\qdWUfYG.exe
  2⤵
  PID:3816
- C:\Windows\System\uRSintU.exe
  C:\Windows\System\uRSintU.exe
  2⤵
  PID:2608
- C:\Windows\System\wFiYOFF.exe
  C:\Windows\System\wFiYOFF.exe
  2⤵
  PID:3996
- C:\Windows\System\sMQNvPw.exe
  C:\Windows\System\sMQNvPw.exe
  2⤵
  PID:4036
- C:\Windows\System\EmHloUC.exe
  C:\Windows\System\EmHloUC.exe
  2⤵
  PID:1548
- C:\Windows\System\NhGOoTN.exe
  C:\Windows\System\NhGOoTN.exe
  2⤵
  PID:1956
- C:\Windows\System\maIvEDd.exe
  C:\Windows\System\maIvEDd.exe
  2⤵
  PID:3576
- C:\Windows\System\MIBemlJ.exe
  C:\Windows\System\MIBemlJ.exe
  2⤵
  PID:3276
- C:\Windows\System\dRPLuCT.exe
  C:\Windows\System\dRPLuCT.exe
  2⤵
  PID:3096
- C:\Windows\System\XhAnetH.exe
  C:\Windows\System\XhAnetH.exe
  2⤵
  PID:3612
- C:\Windows\System\UbViqkA.exe
  C:\Windows\System\UbViqkA.exe
  2⤵
  PID:3792
- C:\Windows\System\PzbmvTu.exe
  C:\Windows\System\PzbmvTu.exe
  2⤵
  PID:3588
- C:\Windows\System\rVwbCOk.exe
  C:\Windows\System\rVwbCOk.exe
  2⤵
  PID:3704
- C:\Windows\System\kqNXHCz.exe
  C:\Windows\System\kqNXHCz.exe
  2⤵
  PID:2808
- C:\Windows\System\NPDsaGI.exe
  C:\Windows\System\NPDsaGI.exe
  2⤵
  PID:3260
- C:\Windows\System\OocmOta.exe
  C:\Windows\System\OocmOta.exe
  2⤵
  PID:3988
- C:\Windows\System\MQynDwh.exe
  C:\Windows\System\MQynDwh.exe
  2⤵
  PID:2756
- C:\Windows\System\mRXoQlg.exe
  C:\Windows\System\mRXoQlg.exe
  2⤵
  PID:3840
- C:\Windows\System\UkwVTFA.exe
  C:\Windows\System\UkwVTFA.exe
  2⤵
  PID:3384
- C:\Windows\System\JezJCwd.exe
  C:\Windows\System\JezJCwd.exe
  2⤵
  PID:3164
- C:\Windows\System\tUHAzCi.exe
  C:\Windows\System\tUHAzCi.exe
  2⤵
  PID:3724
- C:\Windows\System\ORjojvZ.exe
  C:\Windows\System\ORjojvZ.exe
  2⤵
  PID:3296
- C:\Windows\System\hgmveUJ.exe
  C:\Windows\System\hgmveUJ.exe
  2⤵
  PID:4076
- C:\Windows\System\UEYtVpC.exe
  C:\Windows\System\UEYtVpC.exe
  2⤵
  PID:3316
- C:\Windows\System\gYBbxwb.exe
  C:\Windows\System\gYBbxwb.exe
  2⤵
  PID:2852
- C:\Windows\System\cvlHdhx.exe
  C:\Windows\System\cvlHdhx.exe
  2⤵
  PID:3892
- C:\Windows\System\aNPxWPd.exe
  C:\Windows\System\aNPxWPd.exe
  2⤵
  PID:3388
- C:\Windows\System\LMZPefX.exe
  C:\Windows\System\LMZPefX.exe
  2⤵
  PID:3556
- C:\Windows\System\rVgKNra.exe
  C:\Windows\System\rVgKNra.exe
  2⤵
  PID:1400
- C:\Windows\System\LWfKUAj.exe
  C:\Windows\System\LWfKUAj.exe
  2⤵
  PID:4072
- C:\Windows\System\wHbWPDB.exe
  C:\Windows\System\wHbWPDB.exe
  2⤵
  PID:3644
- C:\Windows\System\EfXmPDO.exe
  C:\Windows\System\EfXmPDO.exe
  2⤵
  PID:3976
- C:\Windows\System\zGbHLps.exe
  C:\Windows\System\zGbHLps.exe
  2⤵
  PID:4028
- C:\Windows\System\rCaQgQa.exe
  C:\Windows\System\rCaQgQa.exe
  2⤵
  PID:236
- C:\Windows\System\cdPgzlx.exe
  C:\Windows\System\cdPgzlx.exe
  2⤵
  PID:3356
- C:\Windows\System\GBvAMUP.exe
  C:\Windows\System\GBvAMUP.exe
  2⤵
  PID:604
- C:\Windows\System\kkwpgDU.exe
  C:\Windows\System\kkwpgDU.exe
  2⤵
  PID:3272
- C:\Windows\System\tAlgcpW.exe
  C:\Windows\System\tAlgcpW.exe
  2⤵
  PID:4156
- C:\Windows\System\fqRGGse.exe
  C:\Windows\System\fqRGGse.exe
  2⤵
  PID:4184
- C:\Windows\System\YFoLcuc.exe
  C:\Windows\System\YFoLcuc.exe
  2⤵
  PID:4200
- C:\Windows\System\XZNKEtI.exe
  C:\Windows\System\XZNKEtI.exe
  2⤵
  PID:4216
- C:\Windows\System\WpfyNCl.exe
  C:\Windows\System\WpfyNCl.exe
  2⤵
  PID:4236
- C:\Windows\System\AOVqukj.exe
  C:\Windows\System\AOVqukj.exe
  2⤵
  PID:4256
- C:\Windows\System\UJftfMT.exe
  C:\Windows\System\UJftfMT.exe
  2⤵
  PID:4272
- C:\Windows\System\dHzRHjM.exe
  C:\Windows\System\dHzRHjM.exe
  2⤵
  PID:4308
- C:\Windows\System\bAZNhAN.exe
  C:\Windows\System\bAZNhAN.exe
  2⤵
  PID:4324
- C:\Windows\System\VOwrjqu.exe
  C:\Windows\System\VOwrjqu.exe
  2⤵
  PID:4340
- C:\Windows\System\eIKbsWn.exe
  C:\Windows\System\eIKbsWn.exe
  2⤵
  PID:4356
- C:\Windows\System\rvpRPhg.exe
  C:\Windows\System\rvpRPhg.exe
  2⤵
  PID:4372
- C:\Windows\System\dnQluDd.exe
  C:\Windows\System\dnQluDd.exe
  2⤵
  PID:4388
- C:\Windows\System\LQxUTsv.exe
  C:\Windows\System\LQxUTsv.exe
  2⤵
  PID:4404
- C:\Windows\System\OyLSiSr.exe
  C:\Windows\System\OyLSiSr.exe
  2⤵
  PID:4424
- C:\Windows\System\PPsFlGj.exe
  C:\Windows\System\PPsFlGj.exe
  2⤵
  PID:4440
- C:\Windows\System\nFslUhv.exe
  C:\Windows\System\nFslUhv.exe
  2⤵
  PID:4456
- C:\Windows\System\vxboOyo.exe
  C:\Windows\System\vxboOyo.exe
  2⤵
  PID:4476
- C:\Windows\System\MWxyPzh.exe
  C:\Windows\System\MWxyPzh.exe
  2⤵
  PID:4492
- C:\Windows\System\AipBSFk.exe
  C:\Windows\System\AipBSFk.exe
  2⤵
  PID:4508
- C:\Windows\System\ukyPnKI.exe
  C:\Windows\System\ukyPnKI.exe
  2⤵
  PID:4564
- C:\Windows\System\izarKSB.exe
  C:\Windows\System\izarKSB.exe
  2⤵
  PID:4580
- C:\Windows\System\mfPgEzU.exe
  C:\Windows\System\mfPgEzU.exe
  2⤵
  PID:4596
- C:\Windows\System\YbUrNAE.exe
  C:\Windows\System\YbUrNAE.exe
  2⤵
  PID:4612
- C:\Windows\System\POUtWwF.exe
  C:\Windows\System\POUtWwF.exe
  2⤵
  PID:4628
- C:\Windows\System\tUQUdRZ.exe
  C:\Windows\System\tUQUdRZ.exe
  2⤵
  PID:4644
- C:\Windows\System\OIlYCcq.exe
  C:\Windows\System\OIlYCcq.exe
  2⤵
  PID:4660
- C:\Windows\System\rTusIIN.exe
  C:\Windows\System\rTusIIN.exe
  2⤵
  PID:4676
- C:\Windows\System\eFrNLul.exe
  C:\Windows\System\eFrNLul.exe
  2⤵
  PID:4692
- C:\Windows\System\UYnixjV.exe
  C:\Windows\System\UYnixjV.exe
  2⤵
  PID:4728
- C:\Windows\System\mkKefzG.exe
  C:\Windows\System\mkKefzG.exe
  2⤵
  PID:4744
- C:\Windows\System\yGaTFgE.exe
  C:\Windows\System\yGaTFgE.exe
  2⤵
  PID:4760
- C:\Windows\System\uYkLNiE.exe
  C:\Windows\System\uYkLNiE.exe
  2⤵
  PID:4776
- C:\Windows\System\aLeFGlP.exe
  C:\Windows\System\aLeFGlP.exe
  2⤵
  PID:4792
- C:\Windows\System\ktflfBE.exe
  C:\Windows\System\ktflfBE.exe
  2⤵
  PID:4812
- C:\Windows\System\COkSggy.exe
  C:\Windows\System\COkSggy.exe
  2⤵
  PID:4828
- C:\Windows\System\FeRfgKm.exe
  C:\Windows\System\FeRfgKm.exe
  2⤵
  PID:4844
- C:\Windows\System\EWxhqVG.exe
  C:\Windows\System\EWxhqVG.exe
  2⤵
  PID:4860
- C:\Windows\System\KyUsFZW.exe
  C:\Windows\System\KyUsFZW.exe
  2⤵
  PID:4876
- C:\Windows\System\qGgNezy.exe
  C:\Windows\System\qGgNezy.exe
  2⤵
  PID:4940
- C:\Windows\System\WBYoDYy.exe
  C:\Windows\System\WBYoDYy.exe
  2⤵
  PID:4960
- C:\Windows\System\KJEhJIz.exe
  C:\Windows\System\KJEhJIz.exe
  2⤵
  PID:4976
- C:\Windows\System\AXsCbVe.exe
  C:\Windows\System\AXsCbVe.exe
  2⤵
  PID:4992
- C:\Windows\System\dTKLWTM.exe
  C:\Windows\System\dTKLWTM.exe
  2⤵
  PID:5008
- C:\Windows\System\GhgesYV.exe
  C:\Windows\System\GhgesYV.exe
  2⤵
  PID:5024
- C:\Windows\System\opATmbj.exe
  C:\Windows\System\opATmbj.exe
  2⤵
  PID:5040
- C:\Windows\System\VxdeZZt.exe
  C:\Windows\System\VxdeZZt.exe
  2⤵
  PID:5056
- C:\Windows\System\dQESHBL.exe
  C:\Windows\System\dQESHBL.exe
  2⤵
  PID:5072
- C:\Windows\System\XrodpMo.exe
  C:\Windows\System\XrodpMo.exe
  2⤵
  PID:5092
- C:\Windows\System\kpvDIRL.exe
  C:\Windows\System\kpvDIRL.exe
  2⤵
  PID:5112
- C:\Windows\System\JlbKZXa.exe
  C:\Windows\System\JlbKZXa.exe
  2⤵
  PID:352
- C:\Windows\System\uYEGyrj.exe
  C:\Windows\System\uYEGyrj.exe
  2⤵
  PID:2364
- C:\Windows\System\VcgATgM.exe
  C:\Windows\System\VcgATgM.exe
  2⤵
  PID:1716
- C:\Windows\System\MlRLYfu.exe
  C:\Windows\System\MlRLYfu.exe
  2⤵
  PID:3376
- C:\Windows\System\VWIbPyZ.exe
  C:\Windows\System\VWIbPyZ.exe
  2⤵
  PID:2688
- C:\Windows\System\iYvUJtn.exe
  C:\Windows\System\iYvUJtn.exe
  2⤵
  PID:3736
- C:\Windows\System\VvoYLft.exe
  C:\Windows\System\VvoYLft.exe
  2⤵
  PID:2196
- C:\Windows\System\YXOkdPu.exe
  C:\Windows\System\YXOkdPu.exe
  2⤵
  PID:2760
- C:\Windows\System\wiNCSOI.exe
  C:\Windows\System\wiNCSOI.exe
  2⤵
  PID:3152
- C:\Windows\System\TZhEZOq.exe
  C:\Windows\System\TZhEZOq.exe
  2⤵
  PID:3116
- C:\Windows\System\NhseLgN.exe
  C:\Windows\System\NhseLgN.exe
  2⤵
  PID:1472
- C:\Windows\System\FFXlkpl.exe
  C:\Windows\System\FFXlkpl.exe
  2⤵
  PID:3656
- C:\Windows\System\GAgnXLm.exe
  C:\Windows\System\GAgnXLm.exe
  2⤵
  PID:4120
- C:\Windows\System\UjYoNbJ.exe
  C:\Windows\System\UjYoNbJ.exe
  2⤵
  PID:4136
- C:\Windows\System\UnnsRqE.exe
  C:\Windows\System\UnnsRqE.exe
  2⤵
  PID:3496
- C:\Windows\System\BacTbCZ.exe
  C:\Windows\System\BacTbCZ.exe
  2⤵
  PID:4168
- C:\Windows\System\gINYbdw.exe
  C:\Windows\System\gINYbdw.exe
  2⤵
  PID:1788
- C:\Windows\System\OhbQFDI.exe
  C:\Windows\System\OhbQFDI.exe
  2⤵
  PID:2548
- C:\Windows\System\kTPLoZH.exe
  C:\Windows\System\kTPLoZH.exe
  2⤵
  PID:4264
- C:\Windows\System\fgHtxGE.exe
  C:\Windows\System\fgHtxGE.exe
  2⤵
  PID:4316
- C:\Windows\System\Pxupqny.exe
  C:\Windows\System\Pxupqny.exe
  2⤵
  PID:4364
- C:\Windows\System\dWPVsSe.exe
  C:\Windows\System\dWPVsSe.exe
  2⤵
  PID:4384
- C:\Windows\System\hIqcaJj.exe
  C:\Windows\System\hIqcaJj.exe
  2⤵
  PID:4436
- C:\Windows\System\KgnJXVs.exe
  C:\Windows\System\KgnJXVs.exe
  2⤵
  PID:4504
- C:\Windows\System\zNDgYeV.exe
  C:\Windows\System\zNDgYeV.exe
  2⤵
  PID:4416
- C:\Windows\System\xqYRzyr.exe
  C:\Windows\System\xqYRzyr.exe
  2⤵
  PID:4484
- C:\Windows\System\PWNKaSk.exe
  C:\Windows\System\PWNKaSk.exe
  2⤵
  PID:4524
- C:\Windows\System\TWwEkNa.exe
  C:\Windows\System\TWwEkNa.exe
  2⤵
  PID:4540
- C:\Windows\System\rTSnbqZ.exe
  C:\Windows\System\rTSnbqZ.exe
  2⤵
  PID:4604
- C:\Windows\System\GnaTJld.exe
  C:\Windows\System\GnaTJld.exe
  2⤵
  PID:4640
- C:\Windows\System\HXDOWXF.exe
  C:\Windows\System\HXDOWXF.exe
  2⤵
  PID:4708
- C:\Windows\System\QlBrffv.exe
  C:\Windows\System\QlBrffv.exe
  2⤵
  PID:4704
- C:\Windows\System\uBbxJrV.exe
  C:\Windows\System\uBbxJrV.exe
  2⤵
  PID:4756
- C:\Windows\System\UIwXtHZ.exe
  C:\Windows\System\UIwXtHZ.exe
  2⤵
  PID:4788
- C:\Windows\System\XycmeSR.exe
  C:\Windows\System\XycmeSR.exe
  2⤵
  PID:4856
- C:\Windows\System\kqNFADr.exe
  C:\Windows\System\kqNFADr.exe
  2⤵
  PID:4900
- C:\Windows\System\keYxLhe.exe
  C:\Windows\System\keYxLhe.exe
  2⤵
  PID:4916
- C:\Windows\System\HImjSct.exe
  C:\Windows\System\HImjSct.exe
  2⤵
  PID:4652
- C:\Windows\System\hwVJDuX.exe
  C:\Windows\System\hwVJDuX.exe
  2⤵
  PID:4736
- C:\Windows\System\RddwAam.exe
  C:\Windows\System\RddwAam.exe
  2⤵
  PID:4804
- C:\Windows\System\JqIEFAF.exe
  C:\Windows\System\JqIEFAF.exe
  2⤵
  PID:4872
- C:\Windows\System\rKHSfXH.exe
  C:\Windows\System\rKHSfXH.exe
  2⤵
  PID:5016
- C:\Windows\System\GbeLYZJ.exe
  C:\Windows\System\GbeLYZJ.exe
  2⤵
  PID:5084
- C:\Windows\System\ieaMsye.exe
  C:\Windows\System\ieaMsye.exe
  2⤵
  PID:3660
- C:\Windows\System\fWPRkDD.exe
  C:\Windows\System\fWPRkDD.exe
  2⤵
  PID:2912
- C:\Windows\System\pMnOGZf.exe
  C:\Windows\System\pMnOGZf.exe
  2⤵
  PID:1416
- C:\Windows\System\AKAnXnA.exe
  C:\Windows\System\AKAnXnA.exe
  2⤵
  PID:3224
- C:\Windows\System\BplspzU.exe
  C:\Windows\System\BplspzU.exe
  2⤵
  PID:2128
- C:\Windows\System\purMhis.exe
  C:\Windows\System\purMhis.exe
  2⤵
  PID:2192
- C:\Windows\System\qlHSrKD.exe
  C:\Windows\System\qlHSrKD.exe
  2⤵
  PID:4180
- C:\Windows\System\zFPpAaY.exe
  C:\Windows\System\zFPpAaY.exe
  2⤵
  PID:5100
- C:\Windows\System\yczxFTl.exe
  C:\Windows\System\yczxFTl.exe
  2⤵
  PID:3948
- C:\Windows\System\ZSxxdnw.exe
  C:\Windows\System\ZSxxdnw.exe
  2⤵
  PID:4248
- C:\Windows\System\nfvLBNg.exe
  C:\Windows\System\nfvLBNg.exe
  2⤵
  PID:5032
- C:\Windows\System\BmttGIh.exe
  C:\Windows\System\BmttGIh.exe
  2⤵
  PID:5004
- C:\Windows\System\mracOFV.exe
  C:\Windows\System\mracOFV.exe
  2⤵
  PID:4284
- C:\Windows\System\cEjHfaO.exe
  C:\Windows\System\cEjHfaO.exe
  2⤵
  PID:4332
- C:\Windows\System\OgmVWqm.exe
  C:\Windows\System\OgmVWqm.exe
  2⤵
  PID:3876
- C:\Windows\System\GDZnqSF.exe
  C:\Windows\System\GDZnqSF.exe
  2⤵
  PID:2812
- C:\Windows\System\lddZNqb.exe
  C:\Windows\System\lddZNqb.exe
  2⤵
  PID:4448
- C:\Windows\System\EEQNFJH.exe
  C:\Windows\System\EEQNFJH.exe
  2⤵
  PID:4572
- C:\Windows\System\qwvQnWn.exe
  C:\Windows\System\qwvQnWn.exe
  2⤵
  PID:4824
- C:\Windows\System\aUEjvGg.exe
  C:\Windows\System\aUEjvGg.exe
  2⤵
  PID:4684
- C:\Windows\System\vAFZoij.exe
  C:\Windows\System\vAFZoij.exe
  2⤵
  PID:5048
- C:\Windows\System\IWwHIfL.exe
  C:\Windows\System\IWwHIfL.exe
  2⤵
  PID:1520
- C:\Windows\System\lcnDjZm.exe
  C:\Windows\System\lcnDjZm.exe
  2⤵
  PID:4144
- C:\Windows\System\GaNQPKM.exe
  C:\Windows\System\GaNQPKM.exe
  2⤵
  PID:4244
- C:\Windows\System\IURJWRW.exe
  C:\Windows\System\IURJWRW.exe
  2⤵
  PID:4972
- C:\Windows\System\vaPqjKH.exe
  C:\Windows\System\vaPqjKH.exe
  2⤵
  PID:3392
- C:\Windows\System\izhasIg.exe
  C:\Windows\System\izhasIg.exe
  2⤵
  PID:4516
- C:\Windows\System\suYtmHX.exe
  C:\Windows\System\suYtmHX.exe
  2⤵
  PID:4908
- C:\Windows\System\fhWgCKH.exe
  C:\Windows\System\fhWgCKH.exe
  2⤵
  PID:4132
- C:\Windows\System\mYxCkmq.exe
  C:\Windows\System\mYxCkmq.exe
  2⤵
  PID:5136
- C:\Windows\System\PswLFKn.exe
  C:\Windows\System\PswLFKn.exe
  2⤵
  PID:5152
- C:\Windows\System\bNPPLfW.exe
  C:\Windows\System\bNPPLfW.exe
  2⤵
  PID:5172
- C:\Windows\System\oFhxVbO.exe
  C:\Windows\System\oFhxVbO.exe
  2⤵
  PID:5192
- C:\Windows\System\AoXhTyk.exe
  C:\Windows\System\AoXhTyk.exe
  2⤵
  PID:5212
- C:\Windows\System\GVrHGZS.exe
  C:\Windows\System\GVrHGZS.exe
  2⤵
  PID:5232
- C:\Windows\System\lNxQqXK.exe
  C:\Windows\System\lNxQqXK.exe
  2⤵
  PID:5252
- C:\Windows\System\qzjBpnL.exe
  C:\Windows\System\qzjBpnL.exe
  2⤵
  PID:5268
- C:\Windows\System\KDJxqIE.exe
  C:\Windows\System\KDJxqIE.exe
  2⤵
  PID:5284
- C:\Windows\System\AaSkXUv.exe
  C:\Windows\System\AaSkXUv.exe
  2⤵
  PID:5300
- C:\Windows\System\qXDKpyd.exe
  C:\Windows\System\qXDKpyd.exe
  2⤵
  PID:5316
- C:\Windows\System\EKnBEFt.exe
  C:\Windows\System\EKnBEFt.exe
  2⤵
  PID:5332
- C:\Windows\System\dqpHiqA.exe
  C:\Windows\System\dqpHiqA.exe
  2⤵
  PID:5348
- C:\Windows\System\fRyhdfV.exe
  C:\Windows\System\fRyhdfV.exe
  2⤵
  PID:5364
- C:\Windows\System\mDnjaAT.exe
  C:\Windows\System\mDnjaAT.exe
  2⤵
  PID:5380
- C:\Windows\System\WnTZpkp.exe
  C:\Windows\System\WnTZpkp.exe
  2⤵
  PID:5396
- C:\Windows\System\eKjNnoL.exe
  C:\Windows\System\eKjNnoL.exe
  2⤵
  PID:5412
- C:\Windows\System\uzOoYmQ.exe
  C:\Windows\System\uzOoYmQ.exe
  2⤵
  PID:5432
- C:\Windows\System\MfrxTMN.exe
  C:\Windows\System\MfrxTMN.exe
  2⤵
  PID:5452
- C:\Windows\System\JoJJUuP.exe
  C:\Windows\System\JoJJUuP.exe
  2⤵
  PID:5472
- C:\Windows\System\XFFRGOJ.exe
  C:\Windows\System\XFFRGOJ.exe
  2⤵
  PID:5488
- C:\Windows\System\iqHtpCA.exe
  C:\Windows\System\iqHtpCA.exe
  2⤵
  PID:5508
- C:\Windows\System\YjUsUZb.exe
  C:\Windows\System\YjUsUZb.exe
  2⤵
  PID:5524
- C:\Windows\System\herItft.exe
  C:\Windows\System\herItft.exe
  2⤵
  PID:5544
- C:\Windows\System\ZHbxqhy.exe
  C:\Windows\System\ZHbxqhy.exe
  2⤵
  PID:5564
- C:\Windows\System\IIIohFO.exe
  C:\Windows\System\IIIohFO.exe
  2⤵
  PID:5584
- C:\Windows\System\vxfKmaB.exe
  C:\Windows\System\vxfKmaB.exe
  2⤵
  PID:5604
- C:\Windows\System\jpfUmBv.exe
  C:\Windows\System\jpfUmBv.exe
  2⤵
  PID:5620
- C:\Windows\System\uOhVzlH.exe
  C:\Windows\System\uOhVzlH.exe
  2⤵
  PID:5640
- C:\Windows\System\hEfXXdf.exe
  C:\Windows\System\hEfXXdf.exe
  2⤵
  PID:5656
- C:\Windows\System\FNcAYgu.exe
  C:\Windows\System\FNcAYgu.exe
  2⤵
  PID:5672
- C:\Windows\System\MsjBhHx.exe
  C:\Windows\System\MsjBhHx.exe
  2⤵
  PID:5688
- C:\Windows\System\mwJEYxC.exe
  C:\Windows\System\mwJEYxC.exe
  2⤵
  PID:5704
- C:\Windows\System\jrYfjYL.exe
  C:\Windows\System\jrYfjYL.exe
  2⤵
  PID:5720
- C:\Windows\System\VtJuMYU.exe
  C:\Windows\System\VtJuMYU.exe
  2⤵
  PID:5736
- C:\Windows\System\qzQeLuD.exe
  C:\Windows\System\qzQeLuD.exe
  2⤵
  PID:5752
- C:\Windows\System\fkWSslX.exe
  C:\Windows\System\fkWSslX.exe
  2⤵
  PID:5768
- C:\Windows\System\BiUhLbe.exe
  C:\Windows\System\BiUhLbe.exe
  2⤵
  PID:5788
- C:\Windows\System\ATeYQlp.exe
  C:\Windows\System\ATeYQlp.exe
  2⤵
  PID:5804
- C:\Windows\System\zloiWQv.exe
  C:\Windows\System\zloiWQv.exe
  2⤵
  PID:5824
- C:\Windows\System\gyuThMw.exe
  C:\Windows\System\gyuThMw.exe
  2⤵
  PID:5848
- C:\Windows\System\SINlkKX.exe
  C:\Windows\System\SINlkKX.exe
  2⤵
  PID:5868
- C:\Windows\System\pxqquxd.exe
  C:\Windows\System\pxqquxd.exe
  2⤵
  PID:5884
- C:\Windows\System\BmdwbvU.exe
  C:\Windows\System\BmdwbvU.exe
  2⤵
  PID:5904
- C:\Windows\System\bkjMyLZ.exe
  C:\Windows\System\bkjMyLZ.exe
  2⤵
  PID:5924
- C:\Windows\System\BzNtIxX.exe
  C:\Windows\System\BzNtIxX.exe
  2⤵
  PID:5940
- C:\Windows\System\PrFmAZh.exe
  C:\Windows\System\PrFmAZh.exe
  2⤵
  PID:5960
- C:\Windows\System\SrYBcWx.exe
  C:\Windows\System\SrYBcWx.exe
  2⤵
  PID:5980
- C:\Windows\System\hwooeki.exe
  C:\Windows\System\hwooeki.exe
  2⤵
  PID:6004
- C:\Windows\System\jdUsYLT.exe
  C:\Windows\System\jdUsYLT.exe
  2⤵
  PID:6036
- C:\Windows\System\xafBeAr.exe
  C:\Windows\System\xafBeAr.exe
  2⤵
  PID:6056
- C:\Windows\System\YUmjzew.exe
  C:\Windows\System\YUmjzew.exe
  2⤵
  PID:6112
- C:\Windows\System\ipQnDMN.exe
  C:\Windows\System\ipQnDMN.exe
  2⤵
  PID:6128
- C:\Windows\System\paBaOXZ.exe
  C:\Windows\System\paBaOXZ.exe
  2⤵
  PID:4152
- C:\Windows\System\GoyQFNZ.exe
  C:\Windows\System\GoyQFNZ.exe
  2⤵
  PID:2576
- C:\Windows\System\uDwltVe.exe
  C:\Windows\System\uDwltVe.exe
  2⤵
  PID:5168
- C:\Windows\System\wJsVaPQ.exe
  C:\Windows\System\wJsVaPQ.exe
  2⤵
  PID:5240
- C:\Windows\System\fajqneE.exe
  C:\Windows\System\fajqneE.exe
  2⤵
  PID:5308
- C:\Windows\System\SFSlkDY.exe
  C:\Windows\System\SFSlkDY.exe
  2⤵
  PID:5376
- C:\Windows\System\aCAcEXE.exe
  C:\Windows\System\aCAcEXE.exe
  2⤵
  PID:5444
- C:\Windows\System\wjTazcG.exe
  C:\Windows\System\wjTazcG.exe
  2⤵
  PID:5516
- C:\Windows\System\wJpteTH.exe
  C:\Windows\System\wJpteTH.exe
  2⤵
  PID:5560
- C:\Windows\System\IRqOBBO.exe
  C:\Windows\System\IRqOBBO.exe
  2⤵
  PID:5628
- C:\Windows\System\uwiLDQq.exe
  C:\Windows\System\uwiLDQq.exe
  2⤵
  PID:5728
- C:\Windows\System\iuYyTXB.exe
  C:\Windows\System\iuYyTXB.exe
  2⤵
  PID:5796
- C:\Windows\System\iFTQitG.exe
  C:\Windows\System\iFTQitG.exe
  2⤵
  PID:5840
- C:\Windows\System\EqOCdFq.exe
  C:\Windows\System\EqOCdFq.exe
  2⤵
  PID:5912
- C:\Windows\System\ogOhVpk.exe
  C:\Windows\System\ogOhVpk.exe
  2⤵
  PID:5952
- C:\Windows\System\DpdlioF.exe
  C:\Windows\System\DpdlioF.exe
  2⤵
  PID:5996
- C:\Windows\System\mPNiSTn.exe
  C:\Windows\System\mPNiSTn.exe
  2⤵
  PID:3676
- C:\Windows\System\geBZrdl.exe
  C:\Windows\System\geBZrdl.exe
  2⤵
  PID:4300
- C:\Windows\System\WMqyFcv.exe
  C:\Windows\System\WMqyFcv.exe
  2⤵
  PID:4468
- C:\Windows\System\yEnbRhE.exe
  C:\Windows\System\yEnbRhE.exe
  2⤵
  PID:4712
- C:\Windows\System\ywZuDEo.exe
  C:\Windows\System\ywZuDEo.exe
  2⤵
  PID:4592
- C:\Windows\System\TrQgHrl.exe
  C:\Windows\System\TrQgHrl.exe
  2⤵
  PID:4620
- C:\Windows\System\iHBYntK.exe
  C:\Windows\System\iHBYntK.exe
  2⤵
  PID:4800
- C:\Windows\System\HglnJYk.exe
  C:\Windows\System\HglnJYk.exe
  2⤵
  PID:4984
- C:\Windows\System\SCPJNpk.exe
  C:\Windows\System\SCPJNpk.exe
  2⤵
  PID:3720
- C:\Windows\System\QSmjfDH.exe
  C:\Windows\System\QSmjfDH.exe
  2⤵
  PID:4172
- C:\Windows\System\yzcbEqN.exe
  C:\Windows\System\yzcbEqN.exe
  2⤵
  PID:4252
- C:\Windows\System\qatSnCO.exe
  C:\Windows\System\qatSnCO.exe
  2⤵
  PID:4280
- C:\Windows\System\KJSpzVM.exe
  C:\Windows\System\KJSpzVM.exe
  2⤵
  PID:4400
- C:\Windows\System\ZYZeNdk.exe
  C:\Windows\System\ZYZeNdk.exe
  2⤵
  PID:4560
- C:\Windows\System\BMIZpNw.exe
  C:\Windows\System\BMIZpNw.exe
  2⤵
  PID:3280
- C:\Windows\System\MpBSfAz.exe
  C:\Windows\System\MpBSfAz.exe
  2⤵
  PID:4052
- C:\Windows\System\QImHIEI.exe
  C:\Windows\System\QImHIEI.exe
  2⤵
  PID:5180
- C:\Windows\System\jXXROVq.exe
  C:\Windows\System\jXXROVq.exe
  2⤵
  PID:5224
- C:\Windows\System\FEurVqt.exe
  C:\Windows\System\FEurVqt.exe
  2⤵
  PID:5812
- C:\Windows\System\GQyASwo.exe
  C:\Windows\System\GQyASwo.exe
  2⤵
  PID:5748
- C:\Windows\System\ssQWcWB.exe
  C:\Windows\System\ssQWcWB.exe
  2⤵
  PID:5684
- C:\Windows\System\DISBYgU.exe
  C:\Windows\System\DISBYgU.exe
  2⤵
  PID:5616
- C:\Windows\System\vrXSzYm.exe
  C:\Windows\System\vrXSzYm.exe
  2⤵
  PID:5572
- C:\Windows\System\LsEiglq.exe
  C:\Windows\System\LsEiglq.exe
  2⤵
  PID:5504
- C:\Windows\System\zgrfLDK.exe
  C:\Windows\System\zgrfLDK.exe
  2⤵
  PID:5460
- C:\Windows\System\WqiTEEJ.exe
  C:\Windows\System\WqiTEEJ.exe
  2⤵
  PID:5392
- C:\Windows\System\qbuJYvU.exe
  C:\Windows\System\qbuJYvU.exe
  2⤵
  PID:5328
- C:\Windows\System\RphkGWD.exe
  C:\Windows\System\RphkGWD.exe
  2⤵
  PID:6032
- C:\Windows\System\uApxCxR.exe
  C:\Windows\System\uApxCxR.exe
  2⤵
  PID:6016
- C:\Windows\System\oxYMRll.exe
  C:\Windows\System\oxYMRll.exe
  2⤵
  PID:5968
- C:\Windows\System\nzcJVrN.exe
  C:\Windows\System\nzcJVrN.exe
  2⤵
  PID:5896
- C:\Windows\System\DkxNZSt.exe
  C:\Windows\System\DkxNZSt.exe
  2⤵
  PID:5856
- C:\Windows\System\bDCQrSe.exe
  C:\Windows\System\bDCQrSe.exe
  2⤵
  PID:6064
- C:\Windows\System\JwsAQAS.exe
  C:\Windows\System\JwsAQAS.exe
  2⤵
  PID:6080
- C:\Windows\System\iFIlJAd.exe
  C:\Windows\System\iFIlJAd.exe
  2⤵
  PID:6100
- C:\Windows\System\lpcPizt.exe
  C:\Windows\System\lpcPizt.exe
  2⤵
  PID:6136
- C:\Windows\System\SpFavWy.exe
  C:\Windows\System\SpFavWy.exe
  2⤵
  PID:5204
- C:\Windows\System\KeKwxIZ.exe
  C:\Windows\System\KeKwxIZ.exe
  2⤵
  PID:5080
- C:\Windows\System\eCZsePI.exe
  C:\Windows\System\eCZsePI.exe
  2⤵
  PID:4232
- C:\Windows\System\dDBBNjZ.exe
  C:\Windows\System\dDBBNjZ.exe
  2⤵
  PID:5340
- C:\Windows\System\aWyAaFT.exe
  C:\Windows\System\aWyAaFT.exe
  2⤵
  PID:5372
- C:\Windows\System\BbnsCfu.exe
  C:\Windows\System\BbnsCfu.exe
  2⤵
  PID:5408
- C:\Windows\System\NMHokFY.exe
  C:\Windows\System\NMHokFY.exe
  2⤵
  PID:5636
- C:\Windows\System\scwlZnk.exe
  C:\Windows\System\scwlZnk.exe
  2⤵
  PID:5876
- C:\Windows\System\jcpaYcq.exe
  C:\Windows\System\jcpaYcq.exe
  2⤵
  PID:5260
- C:\Windows\System\UaalzQk.exe
  C:\Windows\System\UaalzQk.exe
  2⤵
  PID:4888
- C:\Windows\System\sKxuhnt.exe
  C:\Windows\System\sKxuhnt.exe
  2⤵
  PID:4924
- C:\Windows\System\sAUHCCZ.exe
  C:\Windows\System\sAUHCCZ.exe
  2⤵
  PID:5836
- C:\Windows\System\yoJkhmT.exe
  C:\Windows\System\yoJkhmT.exe
  2⤵
  PID:4420
- C:\Windows\System\wHrirCi.exe
  C:\Windows\System\wHrirCi.exe
  2⤵
  PID:4896
- C:\Windows\System\ocnbEAj.exe
  C:\Windows\System\ocnbEAj.exe
  2⤵
  PID:4268
- C:\Windows\System\ugiahkK.exe
  C:\Windows\System\ugiahkK.exe
  2⤵
  PID:3992
- C:\Windows\System\EJMoEjI.exe
  C:\Windows\System\EJMoEjI.exe
  2⤵
  PID:4212
- C:\Windows\System\qOfJrbW.exe
  C:\Windows\System\qOfJrbW.exe
  2⤵
  PID:4868
- C:\Windows\System\iLKrhDK.exe
  C:\Windows\System\iLKrhDK.exe
  2⤵
  PID:5220
- C:\Windows\System\RBApOZN.exe
  C:\Windows\System\RBApOZN.exe
  2⤵
  PID:5648
- C:\Windows\System\HFMfBwF.exe
  C:\Windows\System\HFMfBwF.exe
  2⤵
  PID:5576
- C:\Windows\System\nvjkfHm.exe
  C:\Windows\System\nvjkfHm.exe
  2⤵
  PID:5820
- C:\Windows\System\MVfkXKn.exe
  C:\Windows\System\MVfkXKn.exe
  2⤵
  PID:5976
- C:\Windows\System\HCNShCY.exe
  C:\Windows\System\HCNShCY.exe
  2⤵
  PID:6120
- C:\Windows\System\yTjohIA.exe
  C:\Windows\System\yTjohIA.exe
  2⤵
  PID:5360
- C:\Windows\System\VwuelGN.exe
  C:\Windows\System\VwuelGN.exe
  2⤵
  PID:5900
- C:\Windows\System\SayKhpP.exe
  C:\Windows\System\SayKhpP.exe
  2⤵
  PID:6092
- C:\Windows\System\BMFIGhR.exe
  C:\Windows\System\BMFIGhR.exe
  2⤵
  PID:4852
- C:\Windows\System\PbZdeXx.exe
  C:\Windows\System\PbZdeXx.exe
  2⤵
  PID:5760
- C:\Windows\System\MaHOnFM.exe
  C:\Windows\System\MaHOnFM.exe
  2⤵
  PID:4536
- C:\Windows\System\CYqwGPK.exe
  C:\Windows\System\CYqwGPK.exe
  2⤵
  PID:5164
- C:\Windows\System\wJEUXzN.exe
  C:\Windows\System\wJEUXzN.exe
  2⤵
  PID:4532
- C:\Windows\System\rvZOcPo.exe
  C:\Windows\System\rvZOcPo.exe
  2⤵
  PID:5832
- C:\Windows\System\YFaDkjY.exe
  C:\Windows\System\YFaDkjY.exe
  2⤵
  PID:5700
- C:\Windows\System\mrOQVep.exe
  C:\Windows\System\mrOQVep.exe
  2⤵
  PID:5652
- C:\Windows\System\prSVIZo.exe
  C:\Windows\System\prSVIZo.exe
  2⤵
  PID:880
- C:\Windows\System\HLmOJkI.exe
  C:\Windows\System\HLmOJkI.exe
  2⤵
  PID:3300
- C:\Windows\System\TkUOvcc.exe
  C:\Windows\System\TkUOvcc.exe
  2⤵
  PID:5532
- C:\Windows\System\BhpHpfT.exe
  C:\Windows\System\BhpHpfT.exe
  2⤵
  PID:5864
- C:\Windows\System\QZfjGWu.exe
  C:\Windows\System\QZfjGWu.exe
  2⤵
  PID:6076
- C:\Windows\System\moqwfoP.exe
  C:\Windows\System\moqwfoP.exe
  2⤵
  PID:6020
- C:\Windows\System\afgqpZX.exe
  C:\Windows\System\afgqpZX.exe
  2⤵
  PID:2080
- C:\Windows\System\SsLuwBZ.exe
  C:\Windows\System\SsLuwBZ.exe
  2⤵
  PID:5132
- C:\Windows\System\YRGNBSY.exe
  C:\Windows\System\YRGNBSY.exe
  2⤵
  PID:6088
- C:\Windows\System\LSzZrTI.exe
  C:\Windows\System\LSzZrTI.exe
  2⤵
  PID:5484
- C:\Windows\System\EeOrTuq.exe
  C:\Windows\System\EeOrTuq.exe
  2⤵
  PID:5776
- C:\Windows\System\indtTcg.exe
  C:\Windows\System\indtTcg.exe
  2⤵
  PID:4948
- C:\Windows\System\BtoXGgH.exe
  C:\Windows\System\BtoXGgH.exe
  2⤵
  PID:6072
- C:\Windows\System\jFZbEKb.exe
  C:\Windows\System\jFZbEKb.exe
  2⤵
  PID:1188
- C:\Windows\System\rhyuIuR.exe
  C:\Windows\System\rhyuIuR.exe
  2⤵
  PID:5344
- C:\Windows\System\RoylJtX.exe
  C:\Windows\System\RoylJtX.exe
  2⤵
  PID:4720
- C:\Windows\System\bWnKgwA.exe
  C:\Windows\System\bWnKgwA.exe
  2⤵
  PID:6148
- C:\Windows\System\UGFYbzF.exe
  C:\Windows\System\UGFYbzF.exe
  2⤵
  PID:6168
- C:\Windows\System\ZJuXABh.exe
  C:\Windows\System\ZJuXABh.exe
  2⤵
  PID:6188
- C:\Windows\System\lwlDIKt.exe
  C:\Windows\System\lwlDIKt.exe
  2⤵
  PID:6204
- C:\Windows\System\hJIIAht.exe
  C:\Windows\System\hJIIAht.exe
  2⤵
  PID:6228
- C:\Windows\System\JOAmNhH.exe
  C:\Windows\System\JOAmNhH.exe
  2⤵
  PID:6248
- C:\Windows\System\KpMMPaB.exe
  C:\Windows\System\KpMMPaB.exe
  2⤵
  PID:6264
- C:\Windows\System\RbbwWNM.exe
  C:\Windows\System\RbbwWNM.exe
  2⤵
  PID:6280
- C:\Windows\System\DlNWIDi.exe
  C:\Windows\System\DlNWIDi.exe
  2⤵
  PID:6296
- C:\Windows\System\XvowTGG.exe
  C:\Windows\System\XvowTGG.exe
  2⤵
  PID:6312
- C:\Windows\System\wzIlkQQ.exe
  C:\Windows\System\wzIlkQQ.exe
  2⤵
  PID:6328
- C:\Windows\System\ozBLxnB.exe
  C:\Windows\System\ozBLxnB.exe
  2⤵
  PID:6348
- C:\Windows\System\nrkueTW.exe
  C:\Windows\System\nrkueTW.exe
  2⤵
  PID:6364
- C:\Windows\System\pflhHwD.exe
  C:\Windows\System\pflhHwD.exe
  2⤵
  PID:6384
- C:\Windows\System\DwucuBP.exe
  C:\Windows\System\DwucuBP.exe
  2⤵
  PID:6404
- C:\Windows\System\duToINE.exe
  C:\Windows\System\duToINE.exe
  2⤵
  PID:6420
- C:\Windows\System\nSwlClo.exe
  C:\Windows\System\nSwlClo.exe
  2⤵
  PID:6436
- C:\Windows\System\LIZikDr.exe
  C:\Windows\System\LIZikDr.exe
  2⤵
  PID:6460
- C:\Windows\System\OHAFwSj.exe
  C:\Windows\System\OHAFwSj.exe
  2⤵
  PID:6476
- C:\Windows\System\tGqpOsW.exe
  C:\Windows\System\tGqpOsW.exe
  2⤵
  PID:6492
- C:\Windows\System\BzqfonJ.exe
  C:\Windows\System\BzqfonJ.exe
  2⤵
  PID:6508
- C:\Windows\System\frQrZsI.exe
  C:\Windows\System\frQrZsI.exe
  2⤵
  PID:6524
- C:\Windows\System\CfNEekU.exe
  C:\Windows\System\CfNEekU.exe
  2⤵
  PID:6540
- C:\Windows\System\KLudLab.exe
  C:\Windows\System\KLudLab.exe
  2⤵
  PID:6556
- C:\Windows\System\uHlErcf.exe
  C:\Windows\System\uHlErcf.exe
  2⤵
  PID:6572
- C:\Windows\System\ApQWsNd.exe
  C:\Windows\System\ApQWsNd.exe
  2⤵
  PID:6588
- C:\Windows\System\XKvsIvQ.exe
  C:\Windows\System\XKvsIvQ.exe
  2⤵
  PID:6604
- C:\Windows\System\GGyQxKv.exe
  C:\Windows\System\GGyQxKv.exe
  2⤵
  PID:6620
- C:\Windows\System\OmXILDp.exe
  C:\Windows\System\OmXILDp.exe
  2⤵
  PID:6636
- C:\Windows\System\VFdXHKD.exe
  C:\Windows\System\VFdXHKD.exe
  2⤵
  PID:6652
- C:\Windows\System\SvhrDCf.exe
  C:\Windows\System\SvhrDCf.exe
  2⤵
  PID:6668
- C:\Windows\System\nEamCkF.exe
  C:\Windows\System\nEamCkF.exe
  2⤵
  PID:6684
- C:\Windows\System\GYFOmKu.exe
  C:\Windows\System\GYFOmKu.exe
  2⤵
  PID:6704
- C:\Windows\System\xZiayux.exe
  C:\Windows\System\xZiayux.exe
  2⤵
  PID:6720
- C:\Windows\System\mIvlEai.exe
  C:\Windows\System\mIvlEai.exe
  2⤵
  PID:6736
- C:\Windows\System\zWdmQSc.exe
  C:\Windows\System\zWdmQSc.exe
  2⤵
  PID:6784
- C:\Windows\System\yplqXBs.exe
  C:\Windows\System\yplqXBs.exe
  2⤵
  PID:6800
- C:\Windows\System\hWAGiGV.exe
  C:\Windows\System\hWAGiGV.exe
  2⤵
  PID:6816
- C:\Windows\System\hIPiGOC.exe
  C:\Windows\System\hIPiGOC.exe
  2⤵
  PID:6832
- C:\Windows\System\ZLsWtyW.exe
  C:\Windows\System\ZLsWtyW.exe
  2⤵
  PID:6848
- C:\Windows\System\eDtcPBL.exe
  C:\Windows\System\eDtcPBL.exe
  2⤵
  PID:6864
- C:\Windows\System\pPXEZgQ.exe
  C:\Windows\System\pPXEZgQ.exe
  2⤵
  PID:6880
- C:\Windows\System\CBhLzid.exe
  C:\Windows\System\CBhLzid.exe
  2⤵
  PID:6896
- C:\Windows\System\ugrhpyI.exe
  C:\Windows\System\ugrhpyI.exe
  2⤵
  PID:6912
- C:\Windows\System\CIIOtFP.exe
  C:\Windows\System\CIIOtFP.exe
  2⤵
  PID:6928
- C:\Windows\System\YvxATRH.exe
  C:\Windows\System\YvxATRH.exe
  2⤵
  PID:6952
- C:\Windows\System\NkslpCN.exe
  C:\Windows\System\NkslpCN.exe
  2⤵
  PID:6976
- C:\Windows\System\XWSgzIb.exe
  C:\Windows\System\XWSgzIb.exe
  2⤵
  PID:6992
- C:\Windows\System\aIzpmiB.exe
  C:\Windows\System\aIzpmiB.exe
  2⤵
  PID:7008
- C:\Windows\System\aqZGJZB.exe
  C:\Windows\System\aqZGJZB.exe
  2⤵
  PID:7032
- C:\Windows\System\lYkmCpG.exe
  C:\Windows\System\lYkmCpG.exe
  2⤵
  PID:7056
- C:\Windows\System\MbGyDEY.exe
  C:\Windows\System\MbGyDEY.exe
  2⤵
  PID:7076
- C:\Windows\System\rMecYSu.exe
  C:\Windows\System\rMecYSu.exe
  2⤵
  PID:7096
- C:\Windows\System\eQnVxRY.exe
  C:\Windows\System\eQnVxRY.exe
  2⤵
  PID:7116
- C:\Windows\System\SykrfYE.exe
  C:\Windows\System\SykrfYE.exe
  2⤵
  PID:7136
- C:\Windows\System\Jbcmoif.exe
  C:\Windows\System\Jbcmoif.exe
  2⤵
  PID:7152
- C:\Windows\System\zDjGJHg.exe
  C:\Windows\System\zDjGJHg.exe
  2⤵
  PID:5296
- C:\Windows\System\YyETFLl.exe
  C:\Windows\System\YyETFLl.exe
  2⤵
  PID:4288
- C:\Windows\System\egGlcYq.exe
  C:\Windows\System\egGlcYq.exe
  2⤵
  PID:6184
- C:\Windows\System\NIdIyhF.exe
  C:\Windows\System\NIdIyhF.exe
  2⤵
  PID:6256
- C:\Windows\System\lkknKxe.exe
  C:\Windows\System\lkknKxe.exe
  2⤵
  PID:6320
- C:\Windows\System\CoDFxpP.exe
  C:\Windows\System\CoDFxpP.exe
  2⤵
  PID:1232
- C:\Windows\System\TjSdlLl.exe
  C:\Windows\System\TjSdlLl.exe
  2⤵
  PID:6224
- C:\Windows\System\lkTshWA.exe
  C:\Windows\System\lkTshWA.exe
  2⤵
  PID:6236
- C:\Windows\System\MuqUwaw.exe
  C:\Windows\System\MuqUwaw.exe
  2⤵
  PID:6052
- C:\Windows\System\KMOEvnx.exe
  C:\Windows\System\KMOEvnx.exe
  2⤵
  PID:6200
- C:\Windows\System\uLxrUHC.exe
  C:\Windows\System\uLxrUHC.exe
  2⤵
  PID:6428
- C:\Windows\System\uCJzaMM.exe
  C:\Windows\System\uCJzaMM.exe
  2⤵
  PID:6380
- C:\Windows\System\bEZMthT.exe
  C:\Windows\System\bEZMthT.exe
  2⤵
  PID:6468
- C:\Windows\System\oabwTJy.exe
  C:\Windows\System\oabwTJy.exe
  2⤵
  PID:6412
- C:\Windows\System\RzlWjSc.exe
  C:\Windows\System\RzlWjSc.exe
  2⤵
  PID:6564
- C:\Windows\System\WBxWgEQ.exe
  C:\Windows\System\WBxWgEQ.exe
  2⤵
  PID:6628
- C:\Windows\System\TnRSont.exe
  C:\Windows\System\TnRSont.exe
  2⤵
  PID:6664
- C:\Windows\System\RKcfqcX.exe
  C:\Windows\System\RKcfqcX.exe
  2⤵
  PID:6728
- C:\Windows\System\VOeKomO.exe
  C:\Windows\System\VOeKomO.exe
  2⤵
  PID:6488
- C:\Windows\System\RKibrtg.exe
  C:\Windows\System\RKibrtg.exe
  2⤵
  PID:6584
- C:\Windows\System\LYvKCpN.exe
  C:\Windows\System\LYvKCpN.exe
  2⤵
  PID:6648
- C:\Windows\System\cayOhWP.exe
  C:\Windows\System\cayOhWP.exe
  2⤵
  PID:6716
- C:\Windows\System\vjuPVqH.exe
  C:\Windows\System\vjuPVqH.exe
  2⤵
  PID:6752
- C:\Windows\System\BBAYRMy.exe
  C:\Windows\System\BBAYRMy.exe
  2⤵
  PID:6792
- C:\Windows\System\oboGsHR.exe
  C:\Windows\System\oboGsHR.exe
  2⤵
  PID:6828
- C:\Windows\System\DhqVFqY.exe
  C:\Windows\System\DhqVFqY.exe
  2⤵
  PID:6768
- C:\Windows\System\spPniGZ.exe
  C:\Windows\System\spPniGZ.exe
  2⤵
  PID:6964
- C:\Windows\System\HluBtiG.exe
  C:\Windows\System\HluBtiG.exe
  2⤵
  PID:7004
- C:\Windows\System\zYbseAk.exe
  C:\Windows\System\zYbseAk.exe
  2⤵
  PID:6840
- C:\Windows\System\DcnRQTh.exe
  C:\Windows\System\DcnRQTh.exe
  2⤵
  PID:6876
- C:\Windows\System\tpdAvqq.exe
  C:\Windows\System\tpdAvqq.exe
  2⤵
  PID:6940
- C:\Windows\System\yojPAmq.exe
  C:\Windows\System\yojPAmq.exe
  2⤵
  PID:6988
- C:\Windows\System\DrnECoc.exe
  C:\Windows\System\DrnECoc.exe
  2⤵
  PID:7028
- C:\Windows\System\ktSVyWp.exe
  C:\Windows\System\ktSVyWp.exe
  2⤵
  PID:7064
- C:\Windows\System\srNiECX.exe
  C:\Windows\System\srNiECX.exe
  2⤵
  PID:7084
- C:\Windows\System\jtfSTvS.exe
  C:\Windows\System\jtfSTvS.exe
  2⤵
  PID:7128
- C:\Windows\System\vrDVMTE.exe
  C:\Windows\System\vrDVMTE.exe
  2⤵
  PID:7164
- C:\Windows\System\yuvJTpN.exe
  C:\Windows\System\yuvJTpN.exe
  2⤵
  PID:7148
- C:\Windows\System\ZmkcBlC.exe
  C:\Windows\System\ZmkcBlC.exe
  2⤵
  PID:6176
- C:\Windows\System\hHNpWWE.exe
  C:\Windows\System\hHNpWWE.exe
  2⤵
  PID:5248
- C:\Windows\System\KwLxHpC.exe
  C:\Windows\System\KwLxHpC.exe
  2⤵
  PID:6356
- C:\Windows\System\rBmowVJ.exe
  C:\Windows\System\rBmowVJ.exe
  2⤵
  PID:6336
- C:\Windows\System\MsRHCrH.exe
  C:\Windows\System\MsRHCrH.exe
  2⤵
  PID:6308
- C:\Windows\System\goDXSuW.exe
  C:\Windows\System\goDXSuW.exe
  2⤵
  PID:6156
- C:\Windows\System\TQweAup.exe
  C:\Windows\System\TQweAup.exe
  2⤵
  PID:6392
- C:\Windows\System\HulpASE.exe
  C:\Windows\System\HulpASE.exe
  2⤵
  PID:5988
- C:\Windows\System\pAMXNKu.exe
  C:\Windows\System\pAMXNKu.exe
  2⤵
  PID:6416
- C:\Windows\System\SPZvoIZ.exe
  C:\Windows\System\SPZvoIZ.exe
  2⤵
  PID:6444
- C:\Windows\System\Qguvqgw.exe
  C:\Windows\System\Qguvqgw.exe
  2⤵
  PID:6452
- C:\Windows\System\lWFEAKM.exe
  C:\Windows\System\lWFEAKM.exe
  2⤵
  PID:6696
- C:\Windows\System\dDYIfwx.exe
  C:\Windows\System\dDYIfwx.exe
  2⤵
  PID:6824
- C:\Windows\System\tdRkeXJ.exe
  C:\Windows\System\tdRkeXJ.exe
  2⤵
  PID:6808
- C:\Windows\System\jHaTvdG.exe
  C:\Windows\System\jHaTvdG.exe
  2⤵
  PID:6936
- C:\Windows\System\tJGMIrU.exe
  C:\Windows\System\tJGMIrU.exe
  2⤵
  PID:6600
- C:\Windows\System\hMrwJAZ.exe
  C:\Windows\System\hMrwJAZ.exe
  2⤵
  PID:7068
- C:\Windows\System\GlJQAnn.exe
  C:\Windows\System\GlJQAnn.exe
  2⤵
  PID:7104
- C:\Windows\System\rdFUZNq.exe
  C:\Windows\System\rdFUZNq.exe
  2⤵
  PID:5188
- C:\Windows\System\expfIiG.exe
  C:\Windows\System\expfIiG.exe
  2⤵
  PID:6680
- C:\Windows\System\IAPNuwE.exe
  C:\Windows\System\IAPNuwE.exe
  2⤵
  PID:5464
- C:\Windows\System\njVaPvP.exe
  C:\Windows\System\njVaPvP.exe
  2⤵
  PID:4700
- C:\Windows\System\gBdWWsL.exe
  C:\Windows\System\gBdWWsL.exe
  2⤵
  PID:5948
- C:\Windows\System\VGsdFis.exe
  C:\Windows\System\VGsdFis.exe
  2⤵
  PID:7112
- C:\Windows\System\afgzyeT.exe
  C:\Windows\System\afgzyeT.exe
  2⤵
  PID:6304
- C:\Windows\System\OxLnzky.exe
  C:\Windows\System\OxLnzky.exe
  2⤵
  PID:5668
- C:\Windows\System\CeJpCTf.exe
  C:\Windows\System\CeJpCTf.exe
  2⤵
  PID:6660
- C:\Windows\System\DJTmbFr.exe
  C:\Windows\System\DJTmbFr.exe
  2⤵
  PID:6844
- C:\Windows\System\etCzMoj.exe
  C:\Windows\System\etCzMoj.exe
  2⤵
  PID:6644
- C:\Windows\System\gZCVHGF.exe
  C:\Windows\System\gZCVHGF.exe
  2⤵
  PID:6776
- C:\Windows\System\DPXDhcB.exe
  C:\Windows\System\DPXDhcB.exe
  2⤵
  PID:6892
- C:\Windows\System\RgxKULO.exe
  C:\Windows\System\RgxKULO.exe
  2⤵
  PID:7044
- C:\Windows\System\WCbaMbI.exe
  C:\Windows\System\WCbaMbI.exe
  2⤵
  PID:6276
- C:\Windows\System\fHvHmJW.exe
  C:\Windows\System\fHvHmJW.exe
  2⤵
  PID:6632
- C:\Windows\System\EvCUzPn.exe
  C:\Windows\System\EvCUzPn.exe
  2⤵
  PID:6024
- C:\Windows\System\FECdKVJ.exe
  C:\Windows\System\FECdKVJ.exe
  2⤵
  PID:7160
- C:\Windows\System\IpTmzaT.exe
  C:\Windows\System\IpTmzaT.exe
  2⤵
  PID:6972
- C:\Windows\System\glGBpNG.exe
  C:\Windows\System\glGBpNG.exe
  2⤵
  PID:6796
- C:\Windows\System\eOBBOPC.exe
  C:\Windows\System\eOBBOPC.exe
  2⤵
  PID:6216
- C:\Windows\System\CaSpGvJ.exe
  C:\Windows\System\CaSpGvJ.exe
  2⤵
  PID:6220
- C:\Windows\System\ySTnddx.exe
  C:\Windows\System\ySTnddx.exe
  2⤵
  PID:7176
- C:\Windows\System\PHJtVhA.exe
  C:\Windows\System\PHJtVhA.exe
  2⤵
  PID:7196
- C:\Windows\System\yqKDqZv.exe
  C:\Windows\System\yqKDqZv.exe
  2⤵
  PID:7212
- C:\Windows\System\IhvfNSF.exe
  C:\Windows\System\IhvfNSF.exe
  2⤵
  PID:7228
- C:\Windows\System\TkLLvsd.exe
  C:\Windows\System\TkLLvsd.exe
  2⤵
  PID:7248
- C:\Windows\System\mecZqui.exe
  C:\Windows\System\mecZqui.exe
  2⤵
  PID:7264
- C:\Windows\System\UsVaVDz.exe
  C:\Windows\System\UsVaVDz.exe
  2⤵
  PID:7284
- C:\Windows\System\HWnywfi.exe
  C:\Windows\System\HWnywfi.exe
  2⤵
  PID:7300
- C:\Windows\System\zUjYlSi.exe
  C:\Windows\System\zUjYlSi.exe
  2⤵
  PID:7316
- C:\Windows\System\TjoArof.exe
  C:\Windows\System\TjoArof.exe
  2⤵
  PID:7332
- C:\Windows\System\lREaEcw.exe
  C:\Windows\System\lREaEcw.exe
  2⤵
  PID:7348
- C:\Windows\System\YCGUnWW.exe
  C:\Windows\System\YCGUnWW.exe
  2⤵
  PID:7368
- C:\Windows\System\gmqRXUf.exe
  C:\Windows\System\gmqRXUf.exe
  2⤵
  PID:7388
- C:\Windows\System\ypPmqDx.exe
  C:\Windows\System\ypPmqDx.exe
  2⤵
  PID:7404
- C:\Windows\System\TprqQXr.exe
  C:\Windows\System\TprqQXr.exe
  2⤵
  PID:7420
- C:\Windows\System\KmHNkFI.exe
  C:\Windows\System\KmHNkFI.exe
  2⤵
  PID:7436
- C:\Windows\System\GsCrBAT.exe
  C:\Windows\System\GsCrBAT.exe
  2⤵
  PID:7452
- C:\Windows\System\DntepOZ.exe
  C:\Windows\System\DntepOZ.exe
  2⤵
  PID:7468
- C:\Windows\System\MUVaKks.exe
  C:\Windows\System\MUVaKks.exe
  2⤵
  PID:7484
- C:\Windows\System\OsmfcAt.exe
  C:\Windows\System\OsmfcAt.exe
  2⤵
  PID:7500
- C:\Windows\System\bcyIUqu.exe
  C:\Windows\System\bcyIUqu.exe
  2⤵
  PID:7516
- C:\Windows\System\xRgnzDr.exe
  C:\Windows\System\xRgnzDr.exe
  2⤵
  PID:7544
- C:\Windows\System\yfZbBMo.exe
  C:\Windows\System\yfZbBMo.exe
  2⤵
  PID:7560
- C:\Windows\System\qJVxFLZ.exe
  C:\Windows\System\qJVxFLZ.exe
  2⤵
  PID:7576
- C:\Windows\System\QdTCxeE.exe
  C:\Windows\System\QdTCxeE.exe
  2⤵
  PID:7592
- C:\Windows\System\OWqwrRM.exe
  C:\Windows\System\OWqwrRM.exe
  2⤵
  PID:7608
- C:\Windows\System\BKtOLIc.exe
  C:\Windows\System\BKtOLIc.exe
  2⤵
  PID:7628
- C:\Windows\System\QXBzdmK.exe
  C:\Windows\System\QXBzdmK.exe
  2⤵
  PID:7644
- C:\Windows\System\DHaJvsl.exe
  C:\Windows\System\DHaJvsl.exe
  2⤵
  PID:7664
- C:\Windows\System\WcKSjsE.exe
  C:\Windows\System\WcKSjsE.exe
  2⤵
  PID:7684
- C:\Windows\System\ByRPtsW.exe
  C:\Windows\System\ByRPtsW.exe
  2⤵
  PID:7700
- C:\Windows\System\pXbbkmm.exe
  C:\Windows\System\pXbbkmm.exe
  2⤵
  PID:7724
- C:\Windows\System\BileeNF.exe
  C:\Windows\System\BileeNF.exe
  2⤵
  PID:7740
- C:\Windows\System\VKgADza.exe
  C:\Windows\System\VKgADza.exe
  2⤵
  PID:7764
- C:\Windows\System\pWfjbWv.exe
  C:\Windows\System\pWfjbWv.exe
  2⤵
  PID:7784
- C:\Windows\System\vztjLlw.exe
  C:\Windows\System\vztjLlw.exe
  2⤵
  PID:7808
- C:\Windows\System\OkrxyPv.exe
  C:\Windows\System\OkrxyPv.exe
  2⤵
  PID:7824
- C:\Windows\System\sALZQkw.exe
  C:\Windows\System\sALZQkw.exe
  2⤵
  PID:7840
- C:\Windows\System\dhLpsjJ.exe
  C:\Windows\System\dhLpsjJ.exe
  2⤵
  PID:7856
- C:\Windows\System\VYQvCzY.exe
  C:\Windows\System\VYQvCzY.exe
  2⤵
  PID:7872
- C:\Windows\System\hYLiCmY.exe
  C:\Windows\System\hYLiCmY.exe
  2⤵
  PID:7888
- C:\Windows\System\biCABsH.exe
  C:\Windows\System\biCABsH.exe
  2⤵
  PID:7904
- C:\Windows\System\UoYcFEB.exe
  C:\Windows\System\UoYcFEB.exe
  2⤵
  PID:7924
- C:\Windows\System\gbVkjJc.exe
  C:\Windows\System\gbVkjJc.exe
  2⤵
  PID:7944
- C:\Windows\System\YfslAwi.exe
  C:\Windows\System\YfslAwi.exe
  2⤵
  PID:7960
- C:\Windows\System\pEMNdhW.exe
  C:\Windows\System\pEMNdhW.exe
  2⤵
  PID:7976
- C:\Windows\System\jamfMDY.exe
  C:\Windows\System\jamfMDY.exe
  2⤵
  PID:7992
- C:\Windows\System\AQCKidO.exe
  C:\Windows\System\AQCKidO.exe
  2⤵
  PID:8012
- C:\Windows\System\NVddvEh.exe
  C:\Windows\System\NVddvEh.exe
  2⤵
  PID:8032
- C:\Windows\System\AeNQWQG.exe
  C:\Windows\System\AeNQWQG.exe
  2⤵
  PID:8048
- C:\Windows\System\FCzSCmI.exe
  C:\Windows\System\FCzSCmI.exe
  2⤵
  PID:8064
- C:\Windows\System\vckgNLB.exe
  C:\Windows\System\vckgNLB.exe
  2⤵
  PID:8080
- C:\Windows\System\HZApcwN.exe
  C:\Windows\System\HZApcwN.exe
  2⤵
  PID:8096
- C:\Windows\System\rsPVuSU.exe
  C:\Windows\System\rsPVuSU.exe
  2⤵
  PID:8112
- C:\Windows\System\jEUaAPi.exe
  C:\Windows\System\jEUaAPi.exe
  2⤵
  PID:8128
- C:\Windows\System\HNcZpYb.exe
  C:\Windows\System\HNcZpYb.exe
  2⤵
  PID:8144
- C:\Windows\System\BjNeYiJ.exe
  C:\Windows\System\BjNeYiJ.exe
  2⤵
  PID:8160
- C:\Windows\System\yleqVQY.exe
  C:\Windows\System\yleqVQY.exe
  2⤵
  PID:8176
- C:\Windows\System\LRLWTXp.exe
  C:\Windows\System\LRLWTXp.exe
  2⤵
  PID:6372
- C:\Windows\System\DUYCZIG.exe
  C:\Windows\System\DUYCZIG.exe
  2⤵
  PID:7528
- C:\Windows\System\gSzWZux.exe
  C:\Windows\System\gSzWZux.exe
  2⤵
  PID:8004
- C:\Windows\System\ppfZeRz.exe
  C:\Windows\System\ppfZeRz.exe
  2⤵
  PID:8044
- C:\Windows\System\fXANvRe.exe
  C:\Windows\System\fXANvRe.exe
  2⤵
  PID:6948
- C:\Windows\System\EMioLcq.exe
  C:\Windows\System\EMioLcq.exe
  2⤵
  PID:6960
- C:\Windows\System\sLVRRQR.exe
  C:\Windows\System\sLVRRQR.exe
  2⤵
  PID:7236
- C:\Windows\System\vskAtik.exe
  C:\Windows\System\vskAtik.exe
  2⤵
  PID:7308
- C:\Windows\System\FegnxvY.exe
  C:\Windows\System\FegnxvY.exe
  2⤵
  PID:7328
- C:\Windows\System\AyUOjus.exe
  C:\Windows\System\AyUOjus.exe
  2⤵
  PID:7376
- C:\Windows\System\zdjIykZ.exe
  C:\Windows\System\zdjIykZ.exe
  2⤵
  PID:7416
- C:\Windows\System\vrmtHiS.exe
  C:\Windows\System\vrmtHiS.exe
  2⤵
  PID:7476
- C:\Windows\System\bMFyUPf.exe
  C:\Windows\System\bMFyUPf.exe
  2⤵
  PID:7400
- C:\Windows\System\FvpnNvb.exe
  C:\Windows\System\FvpnNvb.exe
  2⤵
  PID:7496
- C:\Windows\System\jRpnLhk.exe
  C:\Windows\System\jRpnLhk.exe
  2⤵
  PID:6344
- C:\Windows\System\eQCsXlm.exe
  C:\Windows\System\eQCsXlm.exe
  2⤵
  PID:7624
- C:\Windows\System\BVtTJwL.exe
  C:\Windows\System\BVtTJwL.exe
  2⤵
  PID:7692
- C:\Windows\System\GdNfHjQ.exe
  C:\Windows\System\GdNfHjQ.exe
  2⤵
  PID:7732
- C:\Windows\System\FXTzXGK.exe
  C:\Windows\System\FXTzXGK.exe
  2⤵
  PID:7780
- C:\Windows\System\MHIeZnq.exe
  C:\Windows\System\MHIeZnq.exe
  2⤵
  PID:7604
- C:\Windows\System\MJVfCKn.exe
  C:\Windows\System\MJVfCKn.exe
  2⤵
  PID:7676
- C:\Windows\System\BxjEOKq.exe
  C:\Windows\System\BxjEOKq.exe
  2⤵
  PID:7820
- C:\Windows\System\QdDMJdr.exe
  C:\Windows\System\QdDMJdr.exe
  2⤵
  PID:7852
- C:\Windows\System\CibthwN.exe
  C:\Windows\System\CibthwN.exe
  2⤵
  PID:7752
- C:\Windows\System\xHorcua.exe
  C:\Windows\System\xHorcua.exe
  2⤵
  PID:7800
- C:\Windows\System\ByFiKHZ.exe
  C:\Windows\System\ByFiKHZ.exe
  2⤵
  PID:7920
- C:\Windows\System\frpeEqS.exe
  C:\Windows\System\frpeEqS.exe
  2⤵
  PID:7836
- C:\Windows\System\NOxpYOT.exe
  C:\Windows\System\NOxpYOT.exe
  2⤵
  PID:7956
- C:\Windows\System\CKaliSp.exe
  C:\Windows\System\CKaliSp.exe
  2⤵
  PID:7988
- C:\Windows\System\ustrgHo.exe
  C:\Windows\System\ustrgHo.exe
  2⤵
  PID:7864
- C:\Windows\System\LmgyeTY.exe
  C:\Windows\System\LmgyeTY.exe
  2⤵
  PID:8000
- C:\Windows\System\bsObqKh.exe
  C:\Windows\System\bsObqKh.exe
  2⤵
  PID:8120
- C:\Windows\System\RscFgOB.exe
  C:\Windows\System\RscFgOB.exe
  2⤵
  PID:8072
- C:\Windows\System\WEnqCLL.exe
  C:\Windows\System\WEnqCLL.exe
  2⤵
  PID:8104
- C:\Windows\System\IVpTnvH.exe
  C:\Windows\System\IVpTnvH.exe
  2⤵
  PID:8168
- C:\Windows\System\iJpwNaU.exe
  C:\Windows\System\iJpwNaU.exe
  2⤵
  PID:8184
- C:\Windows\System\pXhkBCI.exe
  C:\Windows\System\pXhkBCI.exe
  2⤵
  PID:7192
- C:\Windows\System\XhRzBpG.exe
  C:\Windows\System\XhRzBpG.exe
  2⤵
  PID:7204
- C:\Windows\System\AdMvwGm.exe
  C:\Windows\System\AdMvwGm.exe
  2⤵
  PID:7512
- C:\Windows\System\dBfptrf.exe
  C:\Windows\System\dBfptrf.exe
  2⤵
  PID:7660
- C:\Windows\System\JRxmFsN.exe
  C:\Windows\System\JRxmFsN.exe
  2⤵
  PID:7672
- C:\Windows\System\rgDbmxY.exe
  C:\Windows\System\rgDbmxY.exe
  2⤵
  PID:7792
- C:\Windows\System\dhMKcDl.exe
  C:\Windows\System\dhMKcDl.exe
  2⤵
  PID:7900
- C:\Windows\System\TfeRoId.exe
  C:\Windows\System\TfeRoId.exe
  2⤵
  PID:7220
- C:\Windows\System\pGffhNJ.exe
  C:\Windows\System\pGffhNJ.exe
  2⤵
  PID:7708
- C:\Windows\System\ZnfvKTn.exe
  C:\Windows\System\ZnfvKTn.exe
  2⤵
  PID:7272
- C:\Windows\System\dHrSpad.exe
  C:\Windows\System\dHrSpad.exe
  2⤵
  PID:7292
- C:\Windows\System\dDyYSNg.exe
  C:\Windows\System\dDyYSNg.exe
  2⤵
  PID:7572
- C:\Windows\System\QQPfsFe.exe
  C:\Windows\System\QQPfsFe.exe
  2⤵
  PID:6340
- C:\Windows\System\PcHtaIa.exe
  C:\Windows\System\PcHtaIa.exe
  2⤵
  PID:8088
- C:\Windows\System\CZcNjpy.exe
  C:\Windows\System\CZcNjpy.exe
  2⤵
  PID:8024
- C:\Windows\System\POjOcrC.exe
  C:\Windows\System\POjOcrC.exe
  2⤵
  PID:6616
- C:\Windows\System\rhlVekT.exe
  C:\Windows\System\rhlVekT.exe
  2⤵
  PID:8172
- C:\Windows\System\vslWFkz.exe
  C:\Windows\System\vslWFkz.exe
  2⤵
  PID:7640
- C:\Windows\System\FYXhmoq.exe
  C:\Windows\System\FYXhmoq.exe
  2⤵
  PID:7584
- C:\Windows\System\nGSZMcS.exe
  C:\Windows\System\nGSZMcS.exe
  2⤵
  PID:7256
- C:\Windows\System\QnKZCED.exe
  C:\Windows\System\QnKZCED.exe
  2⤵
  PID:7360
- C:\Windows\System\dqZDKbA.exe
  C:\Windows\System\dqZDKbA.exe
  2⤵
  PID:7464
- C:\Windows\System\islfoJT.exe
  C:\Windows\System\islfoJT.exe
  2⤵
  PID:6760
- C:\Windows\System\ugNTeQJ.exe
  C:\Windows\System\ugNTeQJ.exe
  2⤵
  PID:7568
- C:\Windows\System\IFJOPjz.exe
  C:\Windows\System\IFJOPjz.exe
  2⤵
  PID:7224
- C:\Windows\System\tvzCLRk.exe
  C:\Windows\System\tvzCLRk.exe
  2⤵
  PID:7524
- C:\Windows\System\nMvjKAF.exe
  C:\Windows\System\nMvjKAF.exe
  2⤵
  PID:7184
- C:\Windows\System\iqEqhVf.exe
  C:\Windows\System\iqEqhVf.exe
  2⤵
  PID:7696
- C:\Windows\System\uclKNbp.exe
  C:\Windows\System\uclKNbp.exe
  2⤵
  PID:8136
- C:\Windows\System\dvFDPYg.exe
  C:\Windows\System\dvFDPYg.exe
  2⤵
  PID:8140
- C:\Windows\System\iSmuAYv.exe
  C:\Windows\System\iSmuAYv.exe
  2⤵
  PID:7616
- C:\Windows\System\WqMPFcK.exe
  C:\Windows\System\WqMPFcK.exe
  2⤵
  PID:7356
- C:\Windows\System\iwtOoQS.exe
  C:\Windows\System\iwtOoQS.exe
  2⤵
  PID:8124
- C:\Windows\System\GHrBxpC.exe
  C:\Windows\System\GHrBxpC.exe
  2⤵
  PID:8212
- C:\Windows\System\FIHBCRD.exe
  C:\Windows\System\FIHBCRD.exe
  2⤵
  PID:8228
- C:\Windows\System\IoRjWRl.exe
  C:\Windows\System\IoRjWRl.exe
  2⤵
  PID:8244
- C:\Windows\System\roqIOgj.exe
  C:\Windows\System\roqIOgj.exe
  2⤵
  PID:8260
- C:\Windows\System\DLUSuzD.exe
  C:\Windows\System\DLUSuzD.exe
  2⤵
  PID:8276
- C:\Windows\System\stJutRR.exe
  C:\Windows\System\stJutRR.exe
  2⤵
  PID:8292
- C:\Windows\System\sRxbuex.exe
  C:\Windows\System\sRxbuex.exe
  2⤵
  PID:8308
- C:\Windows\System\keslyQj.exe
  C:\Windows\System\keslyQj.exe
  2⤵
  PID:8324
- C:\Windows\System\qhkjkqn.exe
  C:\Windows\System\qhkjkqn.exe
  2⤵
  PID:8340
- C:\Windows\System\CIcwHHB.exe
  C:\Windows\System\CIcwHHB.exe
  2⤵
  PID:8356
- C:\Windows\System\HIIhUPh.exe
  C:\Windows\System\HIIhUPh.exe
  2⤵
  PID:8372
- C:\Windows\System\dRvbIvb.exe
  C:\Windows\System\dRvbIvb.exe
  2⤵
  PID:8388
- C:\Windows\System\bADqINz.exe
  C:\Windows\System\bADqINz.exe
  2⤵
  PID:8500
- C:\Windows\System\sSqBYeO.exe
  C:\Windows\System\sSqBYeO.exe
  2⤵
  PID:8516
- C:\Windows\System\lZKMhGu.exe
  C:\Windows\System\lZKMhGu.exe
  2⤵
  PID:8532
- C:\Windows\System\jxidfvH.exe
  C:\Windows\System\jxidfvH.exe
  2⤵
  PID:8548
- C:\Windows\System\jRUgaPC.exe
  C:\Windows\System\jRUgaPC.exe
  2⤵
  PID:8564
- C:\Windows\System\dyxzWdV.exe
  C:\Windows\System\dyxzWdV.exe
  2⤵
  PID:8580
- C:\Windows\System\PEjAGDh.exe
  C:\Windows\System\PEjAGDh.exe
  2⤵
  PID:8596
- C:\Windows\System\hLjFUAb.exe
  C:\Windows\System\hLjFUAb.exe
  2⤵
  PID:8612
- C:\Windows\System\BbvAfTu.exe
  C:\Windows\System\BbvAfTu.exe
  2⤵
  PID:8628
- C:\Windows\System\tqbwYMj.exe
  C:\Windows\System\tqbwYMj.exe
  2⤵
  PID:8644
- C:\Windows\System\uFcOvAW.exe
  C:\Windows\System\uFcOvAW.exe
  2⤵
  PID:8660
- C:\Windows\System\EBVnvRe.exe
  C:\Windows\System\EBVnvRe.exe
  2⤵
  PID:8676
- C:\Windows\System\GREnxPm.exe
  C:\Windows\System\GREnxPm.exe
  2⤵
  PID:8692
- C:\Windows\System\NkkBVTM.exe
  C:\Windows\System\NkkBVTM.exe
  2⤵
  PID:8708
- C:\Windows\System\jdxiSLy.exe
  C:\Windows\System\jdxiSLy.exe
  2⤵
  PID:8724
- C:\Windows\System\YUceGjN.exe
  C:\Windows\System\YUceGjN.exe
  2⤵
  PID:8740
- C:\Windows\System\RQXdmlJ.exe
  C:\Windows\System\RQXdmlJ.exe
  2⤵
  PID:8756
- C:\Windows\System\Sfnlvrq.exe
  C:\Windows\System\Sfnlvrq.exe
  2⤵
  PID:8772
- C:\Windows\System\LWJjwff.exe
  C:\Windows\System\LWJjwff.exe
  2⤵
  PID:8788
- C:\Windows\System\HHMUiev.exe
  C:\Windows\System\HHMUiev.exe
  2⤵
  PID:8804
- C:\Windows\System\MZIhljh.exe
  C:\Windows\System\MZIhljh.exe
  2⤵
  PID:8820
- C:\Windows\System\fYXzQby.exe
  C:\Windows\System\fYXzQby.exe
  2⤵
  PID:8836
- C:\Windows\System\DCDarkk.exe
  C:\Windows\System\DCDarkk.exe
  2⤵
  PID:8856
- C:\Windows\System\ttzDJlK.exe
  C:\Windows\System\ttzDJlK.exe
  2⤵
  PID:8872
- C:\Windows\System\sIZbgbq.exe
  C:\Windows\System\sIZbgbq.exe
  2⤵
  PID:8888
- C:\Windows\System\lkUzvcT.exe
  C:\Windows\System\lkUzvcT.exe
  2⤵
  PID:8904
- C:\Windows\System\JgFGtPm.exe
  C:\Windows\System\JgFGtPm.exe
  2⤵
  PID:8920
- C:\Windows\System\DORlZIZ.exe
  C:\Windows\System\DORlZIZ.exe
  2⤵
  PID:8936
- C:\Windows\System\ZwFGwiA.exe
  C:\Windows\System\ZwFGwiA.exe
  2⤵
  PID:8952
- C:\Windows\System\UeoURqh.exe
  C:\Windows\System\UeoURqh.exe
  2⤵
  PID:8968
- C:\Windows\System\pWABWYx.exe
  C:\Windows\System\pWABWYx.exe
  2⤵
  PID:8984
- C:\Windows\System\AdPYYiu.exe
  C:\Windows\System\AdPYYiu.exe
  2⤵
  PID:9000
- C:\Windows\System\sNACAZF.exe
  C:\Windows\System\sNACAZF.exe
  2⤵
  PID:9016
- C:\Windows\System\aWDiZPC.exe
  C:\Windows\System\aWDiZPC.exe
  2⤵
  PID:9032
- C:\Windows\System\UxrANkK.exe
  C:\Windows\System\UxrANkK.exe
  2⤵
  PID:9048
- C:\Windows\System\lwjbHlF.exe
  C:\Windows\System\lwjbHlF.exe
  2⤵
  PID:9064
- C:\Windows\System\dpYjtqT.exe
  C:\Windows\System\dpYjtqT.exe
  2⤵
  PID:9080
- C:\Windows\System\HsxzWce.exe
  C:\Windows\System\HsxzWce.exe
  2⤵
  PID:9096
- C:\Windows\System\VmeSSWr.exe
  C:\Windows\System\VmeSSWr.exe
  2⤵
  PID:9112
- C:\Windows\System\muqaxqC.exe
  C:\Windows\System\muqaxqC.exe
  2⤵
  PID:9128
- C:\Windows\System\pHwmTzI.exe
  C:\Windows\System\pHwmTzI.exe
  2⤵
  PID:9144
- C:\Windows\System\XusiHQV.exe
  C:\Windows\System\XusiHQV.exe
  2⤵
  PID:9160
- C:\Windows\System\oVADIOt.exe
  C:\Windows\System\oVADIOt.exe
  2⤵
  PID:9176
- C:\Windows\System\fxvKpZM.exe
  C:\Windows\System\fxvKpZM.exe
  2⤵
  PID:9192
- C:\Windows\System\GWstfUq.exe
  C:\Windows\System\GWstfUq.exe
  2⤵
  PID:9208
- C:\Windows\System\RPOPCKY.exe
  C:\Windows\System\RPOPCKY.exe
  2⤵
  PID:7916
- C:\Windows\System\hDgRQbq.exe
  C:\Windows\System\hDgRQbq.exe
  2⤵
  PID:8236
- C:\Windows\System\JMLxARc.exe
  C:\Windows\System\JMLxARc.exe
  2⤵
  PID:8268
- C:\Windows\System\exJcdZG.exe
  C:\Windows\System\exJcdZG.exe
  2⤵
  PID:7480
- C:\Windows\System\NJPyeGG.exe
  C:\Windows\System\NJPyeGG.exe
  2⤵
  PID:8256
- C:\Windows\System\ChnXibQ.exe
  C:\Windows\System\ChnXibQ.exe
  2⤵
  PID:8320
- C:\Windows\System\PTRzglz.exe
  C:\Windows\System\PTRzglz.exe
  2⤵
  PID:8348
- C:\Windows\System\vnRoBNo.exe
  C:\Windows\System\vnRoBNo.exe
  2⤵
  PID:8396
- C:\Windows\System\OGTogBw.exe
  C:\Windows\System\OGTogBw.exe
  2⤵
  PID:8300
- C:\Windows\System\fXZCuNv.exe
  C:\Windows\System\fXZCuNv.exe
  2⤵
  PID:8400
- C:\Windows\System\ButYVNB.exe
  C:\Windows\System\ButYVNB.exe
  2⤵
  PID:8424
- C:\Windows\System\nCOyMNa.exe
  C:\Windows\System\nCOyMNa.exe
  2⤵
  PID:8440
- C:\Windows\System\jcCLXaG.exe
  C:\Windows\System\jcCLXaG.exe
  2⤵
  PID:8456
- C:\Windows\System\EYdwCQP.exe
  C:\Windows\System\EYdwCQP.exe
  2⤵
  PID:8472
- C:\Windows\System\msBShuE.exe
  C:\Windows\System\msBShuE.exe
  2⤵
  PID:7972
- C:\Windows\System\swrcJle.exe
  C:\Windows\System\swrcJle.exe
  2⤵
  PID:8508
- C:\Windows\System\JgHPcoA.exe
  C:\Windows\System\JgHPcoA.exe
  2⤵
  PID:8528
- C:\Windows\System\SDvxcix.exe
  C:\Windows\System\SDvxcix.exe
  2⤵
  PID:8572
- C:\Windows\System\dehhNSf.exe
  C:\Windows\System\dehhNSf.exe
  2⤵
  PID:8636
- C:\Windows\System\laDxckW.exe
  C:\Windows\System\laDxckW.exe
  2⤵
  PID:8700
- C:\Windows\System\wdADHSq.exe
  C:\Windows\System\wdADHSq.exe
  2⤵
  PID:8684
- C:\Windows\System\zBIQmMB.exe
  C:\Windows\System\zBIQmMB.exe
  2⤵
  PID:8592
- C:\Windows\System\UHSTAVo.exe
  C:\Windows\System\UHSTAVo.exe
  2⤵
  PID:8716
- C:\Windows\System\BCSzjOx.exe
  C:\Windows\System\BCSzjOx.exe
  2⤵
  PID:8764
- C:\Windows\System\JpvcmFV.exe
  C:\Windows\System\JpvcmFV.exe
  2⤵
  PID:8800
- C:\Windows\System\FtyQtQO.exe
  C:\Windows\System\FtyQtQO.exe
  2⤵
  PID:8748
- C:\Windows\System\JgrRlZb.exe
  C:\Windows\System\JgrRlZb.exe
  2⤵
  PID:8900
- C:\Windows\System\YsHTDQo.exe
  C:\Windows\System\YsHTDQo.exe
  2⤵
  PID:8964
- C:\Windows\System\QEwLTgM.exe
  C:\Windows\System\QEwLTgM.exe
  2⤵
  PID:9028
- C:\Windows\System\GUmBwmn.exe
  C:\Windows\System\GUmBwmn.exe
  2⤵
  PID:9056
- C:\Windows\System\ICvdflc.exe
  C:\Windows\System\ICvdflc.exe
  2⤵
  PID:8912
- C:\Windows\System\FOlVEbK.exe
  C:\Windows\System\FOlVEbK.exe
  2⤵
  PID:8980
- C:\Windows\System\bjVVBlx.exe
  C:\Windows\System\bjVVBlx.exe
  2⤵
  PID:9088
- C:\Windows\System\kJbGZew.exe
  C:\Windows\System\kJbGZew.exe
  2⤵
  PID:9120
- C:\Windows\System\mMwGevf.exe
  C:\Windows\System\mMwGevf.exe
  2⤵
  PID:9136
- C:\Windows\System\PUuAqNI.exe
  C:\Windows\System\PUuAqNI.exe
  2⤵
  PID:7460
- C:\Windows\System\yHYbzUR.exe
  C:\Windows\System\yHYbzUR.exe
  2⤵
  PID:7716
- C:\Windows\System\PhyExDk.exe
  C:\Windows\System\PhyExDk.exe
  2⤵
  PID:8364
- C:\Windows\System\qeNtZXy.exe
  C:\Windows\System\qeNtZXy.exe
  2⤵
  PID:8404
- C:\Windows\System\tVgitJn.exe
  C:\Windows\System\tVgitJn.exe
  2⤵
  PID:8452
- C:\Windows\System\RhqNuDs.exe
  C:\Windows\System\RhqNuDs.exe
  2⤵
  PID:8540
- C:\Windows\System\nTzTBHe.exe
  C:\Windows\System\nTzTBHe.exe
  2⤵
  PID:8704
- C:\Windows\System\pePKDUN.exe
  C:\Windows\System\pePKDUN.exe
  2⤵
  PID:8668
- C:\Windows\System\HAxDBFk.exe
  C:\Windows\System\HAxDBFk.exe
  2⤵
  PID:8468
- C:\Windows\System\bTOVJrv.exe
  C:\Windows\System\bTOVJrv.exe
  2⤵
  PID:8852
- C:\Windows\System\nepRQdR.exe
  C:\Windows\System\nepRQdR.exe
  2⤵
  PID:8812
- C:\Windows\System\KFSDxxe.exe
  C:\Windows\System\KFSDxxe.exe
  2⤵
  PID:8868
- C:\Windows\System\oOhnvAY.exe
  C:\Windows\System\oOhnvAY.exe
  2⤵
  PID:8864
- C:\Windows\System\OGVsvkn.exe
  C:\Windows\System\OGVsvkn.exe
  2⤵
  PID:8960
- C:\Windows\System\CNhNKkj.exe
  C:\Windows\System\CNhNKkj.exe
  2⤵
  PID:9012
- C:\Windows\System\kvYXxux.exe
  C:\Windows\System\kvYXxux.exe
  2⤵
  PID:9152
- C:\Windows\System\jkLXaDN.exe
  C:\Windows\System\jkLXaDN.exe
  2⤵
  PID:9184
- C:\Windows\System\DPFabvi.exe
  C:\Windows\System\DPFabvi.exe
  2⤵
  PID:9200
- C:\Windows\System\RZcNQoI.exe
  C:\Windows\System\RZcNQoI.exe
  2⤵
  PID:8220
- C:\Windows\System\wKsNUbR.exe
  C:\Windows\System\wKsNUbR.exe
  2⤵
  PID:8352
- C:\Windows\System\LrszQrB.exe
  C:\Windows\System\LrszQrB.exe
  2⤵
  PID:9204
- C:\Windows\System\elkfkzs.exe
  C:\Windows\System\elkfkzs.exe
  2⤵
  PID:8476
- C:\Windows\System\MgwIkBo.exe
  C:\Windows\System\MgwIkBo.exe
  2⤵
  PID:8732
- C:\Windows\System\HFyWdWf.exe
  C:\Windows\System\HFyWdWf.exe
  2⤵
  PID:8608
- C:\Windows\System\yLNNkRc.exe
  C:\Windows\System\yLNNkRc.exe
  2⤵
  PID:8796
- C:\Windows\System\tgGISoF.exe
  C:\Windows\System\tgGISoF.exe
  2⤵
  PID:8896
- C:\Windows\System\WHLVofo.exe
  C:\Windows\System\WHLVofo.exe
  2⤵
  PID:8976
- C:\Windows\System\jItzPke.exe
  C:\Windows\System\jItzPke.exe
  2⤵
  PID:9140
- C:\Windows\System\bSwzJTw.exe
  C:\Windows\System\bSwzJTw.exe
  2⤵
  PID:9072
- C:\Windows\System\nGmNPqN.exe
  C:\Windows\System\nGmNPqN.exe
  2⤵
  PID:8208
- C:\Windows\System\ZKKJHCC.exe
  C:\Windows\System\ZKKJHCC.exe
  2⤵
  PID:8420
- C:\Windows\System\LZtBdPl.exe
  C:\Windows\System\LZtBdPl.exe
  2⤵
  PID:8672
- C:\Windows\System\IKfxrXJ.exe
  C:\Windows\System\IKfxrXJ.exe
  2⤵
  PID:8996
- C:\Windows\System\ivnXAyW.exe
  C:\Windows\System\ivnXAyW.exe
  2⤵
  PID:8380
- C:\Windows\System\WQqWvAJ.exe
  C:\Windows\System\WQqWvAJ.exe
  2⤵
  PID:8272
- C:\Windows\System\QqoUDuI.exe
  C:\Windows\System\QqoUDuI.exe
  2⤵
  PID:8620
- C:\Windows\System\LgnyOkl.exe
  C:\Windows\System\LgnyOkl.exe
  2⤵
  PID:7260
- C:\Windows\System\uauBlpI.exe
  C:\Windows\System\uauBlpI.exe
  2⤵
  PID:9044
- C:\Windows\System\DRwGVqS.exe
  C:\Windows\System\DRwGVqS.exe
  2⤵
  PID:8884
- C:\Windows\System\SKgOKEO.exe
  C:\Windows\System\SKgOKEO.exe
  2⤵
  PID:9232
- C:\Windows\System\EdHWhgq.exe
  C:\Windows\System\EdHWhgq.exe
  2⤵
  PID:9248
- C:\Windows\System\oCmpJVk.exe
  C:\Windows\System\oCmpJVk.exe
  2⤵
  PID:9264
- C:\Windows\System\bgJmIyL.exe
  C:\Windows\System\bgJmIyL.exe
  2⤵
  PID:9280
- C:\Windows\System\idWqOdt.exe
  C:\Windows\System\idWqOdt.exe
  2⤵
  PID:9296
- C:\Windows\System\xNbYnaT.exe
  C:\Windows\System\xNbYnaT.exe
  2⤵
  PID:9312
- C:\Windows\System\AFnkKgG.exe
  C:\Windows\System\AFnkKgG.exe
  2⤵
  PID:9328
- C:\Windows\System\exlqsWl.exe
  C:\Windows\System\exlqsWl.exe
  2⤵
  PID:9344
- C:\Windows\System\gJYBETd.exe
  C:\Windows\System\gJYBETd.exe
  2⤵
  PID:9360
- C:\Windows\System\IfqkHhi.exe
  C:\Windows\System\IfqkHhi.exe
  2⤵
  PID:9376
- C:\Windows\System\LrhRHob.exe
  C:\Windows\System\LrhRHob.exe
  2⤵
  PID:9392
- C:\Windows\System\MaraKaq.exe
  C:\Windows\System\MaraKaq.exe
  2⤵
  PID:9408
- C:\Windows\System\KgQBtQy.exe
  C:\Windows\System\KgQBtQy.exe
  2⤵
  PID:9428
- C:\Windows\System\vBMoGVb.exe
  C:\Windows\System\vBMoGVb.exe
  2⤵
  PID:9448
- C:\Windows\System\BtGfqrp.exe
  C:\Windows\System\BtGfqrp.exe
  2⤵
  PID:9464
- C:\Windows\System\xpjXVtI.exe
  C:\Windows\System\xpjXVtI.exe
  2⤵
  PID:9480
- C:\Windows\System\NCsYghV.exe
  C:\Windows\System\NCsYghV.exe
  2⤵
  PID:9496
- C:\Windows\System\MrGyseu.exe
  C:\Windows\System\MrGyseu.exe
  2⤵
  PID:9512
- C:\Windows\System\dRHBykV.exe
  C:\Windows\System\dRHBykV.exe
  2⤵
  PID:9528
- C:\Windows\System\ZxWqSmX.exe
  C:\Windows\System\ZxWqSmX.exe
  2⤵
  PID:9544
- C:\Windows\System\NTUvXiD.exe
  C:\Windows\System\NTUvXiD.exe
  2⤵
  PID:9560
- C:\Windows\System\oJOallZ.exe
  C:\Windows\System\oJOallZ.exe
  2⤵
  PID:9576
- C:\Windows\System\wvngwTK.exe
  C:\Windows\System\wvngwTK.exe
  2⤵
  PID:9592
- C:\Windows\System\XMCiDJW.exe
  C:\Windows\System\XMCiDJW.exe
  2⤵
  PID:9608
- C:\Windows\System\QWprsio.exe
  C:\Windows\System\QWprsio.exe
  2⤵
  PID:9736
- C:\Windows\System\yPPEBmD.exe
  C:\Windows\System\yPPEBmD.exe
  2⤵
  PID:9764
- C:\Windows\System\kXIVPKZ.exe
  C:\Windows\System\kXIVPKZ.exe
  2⤵
  PID:9792
- C:\Windows\System\TVvwYKk.exe
  C:\Windows\System\TVvwYKk.exe
  2⤵
  PID:9860
- C:\Windows\System\nctOpOu.exe
  C:\Windows\System\nctOpOu.exe
  2⤵
  PID:9884
- C:\Windows\System\STEMwBj.exe
  C:\Windows\System\STEMwBj.exe
  2⤵
  PID:9908
- C:\Windows\System\oXnAJTN.exe
  C:\Windows\System\oXnAJTN.exe
  2⤵
  PID:9980
- C:\Windows\System\YbhBaqp.exe
  C:\Windows\System\YbhBaqp.exe
  2⤵
  PID:10004
- C:\Windows\System\FkqHWPn.exe
  C:\Windows\System\FkqHWPn.exe
  2⤵
  PID:10040
- C:\Windows\System\vWnbvpm.exe
  C:\Windows\System\vWnbvpm.exe
  2⤵
  PID:10060
- C:\Windows\System\HxryPiG.exe
  C:\Windows\System\HxryPiG.exe
  2⤵
  PID:10076
- C:\Windows\System\hdyfRHW.exe
  C:\Windows\System\hdyfRHW.exe
  2⤵
  PID:10092
- C:\Windows\System\SzNNJOI.exe
  C:\Windows\System\SzNNJOI.exe
  2⤵
  PID:10108
- C:\Windows\System\PdBlAJO.exe
  C:\Windows\System\PdBlAJO.exe
  2⤵
  PID:10124
- C:\Windows\System\xMbLOmo.exe
  C:\Windows\System\xMbLOmo.exe
  2⤵
  PID:10140
- C:\Windows\System\ivtKldK.exe
  C:\Windows\System\ivtKldK.exe
  2⤵
  PID:10156
- C:\Windows\System\LmFQUZD.exe
  C:\Windows\System\LmFQUZD.exe
  2⤵
  PID:10172
- C:\Windows\System\buigMKm.exe
  C:\Windows\System\buigMKm.exe
  2⤵
  PID:10188
- C:\Windows\System\muRSoHf.exe
  C:\Windows\System\muRSoHf.exe
  2⤵
  PID:10204
- C:\Windows\System\SHiBIqs.exe
  C:\Windows\System\SHiBIqs.exe
  2⤵
  PID:10220
- C:\Windows\System\mfszoHB.exe
  C:\Windows\System\mfszoHB.exe
  2⤵
  PID:10236
- C:\Windows\System\RqtlbPa.exe
  C:\Windows\System\RqtlbPa.exe
  2⤵
  PID:9256
- C:\Windows\System\EETlcls.exe
  C:\Windows\System\EETlcls.exe
  2⤵
  PID:7412
- C:\Windows\System\sycZpsG.exe
  C:\Windows\System\sycZpsG.exe
  2⤵
  PID:8624
- C:\Windows\System\ddHDiCu.exe
  C:\Windows\System\ddHDiCu.exe
  2⤵
  PID:9320
- C:\Windows\System\VGlMcgk.exe
  C:\Windows\System\VGlMcgk.exe
  2⤵
  PID:9352
- C:\Windows\System\NcvrRwZ.exe
  C:\Windows\System\NcvrRwZ.exe
  2⤵
  PID:9384
- C:\Windows\System\PWvlFbJ.exe
  C:\Windows\System\PWvlFbJ.exe
  2⤵
  PID:9424
- C:\Windows\System\yKxHlwt.exe
  C:\Windows\System\yKxHlwt.exe
  2⤵
  PID:9456
- C:\Windows\System\cXSWMhw.exe
  C:\Windows\System\cXSWMhw.exe
  2⤵
  PID:9492
- C:\Windows\System\sbWwead.exe
  C:\Windows\System\sbWwead.exe
  2⤵
  PID:9476
- C:\Windows\System\edzEhfD.exe
  C:\Windows\System\edzEhfD.exe
  2⤵
  PID:9540
- C:\Windows\System\lcJUvwt.exe
  C:\Windows\System\lcJUvwt.exe
  2⤵
  PID:9572
- C:\Windows\System\wWPjNOp.exe
  C:\Windows\System\wWPjNOp.exe
  2⤵
  PID:9616
- C:\Windows\System\csCvZyb.exe
  C:\Windows\System\csCvZyb.exe
  2⤵
  PID:9632
- C:\Windows\System\uVVLHpE.exe
  C:\Windows\System\uVVLHpE.exe
  2⤵
  PID:9648
- C:\Windows\System\MYhFaBO.exe
  C:\Windows\System\MYhFaBO.exe
  2⤵
  PID:9664
- C:\Windows\System\smVlOtp.exe
  C:\Windows\System\smVlOtp.exe
  2⤵
  PID:9692
- C:\Windows\System\KGrQSgD.exe
  C:\Windows\System\KGrQSgD.exe
  2⤵
  PID:9696
- C:\Windows\System\trhtQox.exe
  C:\Windows\System\trhtQox.exe
  2⤵
  PID:9712
- C:\Windows\System\wTUzAOh.exe
  C:\Windows\System\wTUzAOh.exe
  2⤵
  PID:9728
- C:\Windows\System\bnDqKYn.exe
  C:\Windows\System\bnDqKYn.exe
  2⤵
  PID:9776
- C:\Windows\System\qTsSuGm.exe
  C:\Windows\System\qTsSuGm.exe
  2⤵
  PID:9756
- C:\Windows\System\jCyHXnK.exe
  C:\Windows\System\jCyHXnK.exe
  2⤵
  PID:9800
- C:\Windows\System\DZAashr.exe
  C:\Windows\System\DZAashr.exe
  2⤵
  PID:9820
- C:\Windows\System\JjAuCTK.exe
  C:\Windows\System\JjAuCTK.exe
  2⤵
  PID:9804
- C:\Windows\System\OPXDDTW.exe
  C:\Windows\System\OPXDDTW.exe
  2⤵
  PID:9840
- C:\Windows\System\wjCirQK.exe
  C:\Windows\System\wjCirQK.exe
  2⤵
  PID:9872
- C:\Windows\System\fdvvgse.exe
  C:\Windows\System\fdvvgse.exe
  2⤵
  PID:9892
- C:\Windows\System\hDjgnLT.exe
  C:\Windows\System\hDjgnLT.exe
  2⤵
  PID:9916
- C:\Windows\System\ygEUOLE.exe
  C:\Windows\System\ygEUOLE.exe
  2⤵
  PID:9948
- C:\Windows\System\MwPqDyK.exe
  C:\Windows\System\MwPqDyK.exe
  2⤵
  PID:9964
- C:\Windows\System\mZNLxsM.exe
  C:\Windows\System\mZNLxsM.exe
  2⤵
  PID:9968
- C:\Windows\System\kQrHraj.exe
  C:\Windows\System\kQrHraj.exe
  2⤵
  PID:10012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Ftorlvr.exe

Filesize
2.7MB

MD5
0239b0ff35de0f45bdee21dce5a5528b

SHA1
7fc278e4adc71a23c6d369e79f7f0c728a123234

SHA256
544181196ac6db05e2655181159fe7088b35531d9726e45c8fb83a8a0adb315c

SHA512
9fe76823b1d454a32f3af97422d853537e6cea993acddbc5e35d09a23d4d2b8908c0b827de183a53b53f91eebf393730866dbde1cc2c5a982bbba45d6c7a3f66

Download Submit
C:\Windows\system\IWJCXgz.exe

Filesize
2.7MB

MD5
5c34049f33ad433c28c3f60cc57c9af7

SHA1
2104abb610642f46010c265ed10ce3d5d0461ac9

SHA256
66902637d5eacb65dab6e2a0168b0960d923a9e7bc79fb0481a58d7131763d73

SHA512
670aaaf4b251f0f3afe325150dfe13aee5c4b9c5f062e8f239bbedb4a08839fb625777fd861c024ad20aea9099be1c82f8a2768932a52a16ecfe1074ce5cf16e

Download Submit
C:\Windows\system\ODzAaKC.exe

Filesize
2.7MB

MD5
67f3f82414b188e040a0045b5a70898c

SHA1
3d06e761a19806a3af552fd2ac9668216a560277

SHA256
9d2651ffdc516f97c8d8eaba795ec3dbf8a8dbf6e0c10e043f0bbad36bd53b38

SHA512
8d8479d450a6273d62fe3bdf825f37e604b06be91c661b8e93be28c2938ba08f49edb7b95144a4ef9306f9c878d9efba4d4a5aecd4b8406d9d4ba8c57e3fb366

Download Submit
C:\Windows\system\RAQDPfO.exe

Filesize
2.7MB

MD5
0b250aaae96b418057ee53854c6e85a2

SHA1
07982a2c18093d15921b40d48968ddd17b482229

SHA256
89fa435caf35c3a5e25f4adf9a314d7a45a0b7fe8d3e0bb7a77efa8b404423e5

SHA512
7a72082c48d26b91d6ca55c138449c06281c9c291dba9747ca33837761bcc72886953163bfbb4b21764da3b46126c1a44376cd67c79b2ff1c38770acf576ae1c

Download Submit
C:\Windows\system\TXIayRf.exe

Filesize
2.7MB

MD5
7fff364a774dd979adeea4681bf38bd7

SHA1
51fc374f0d3da1ef4894503f236cae10dc9a89b2

SHA256
a0c7f6264aad67cf8253fb353e2e60eb118ff173aef172000979e660406349aa

SHA512
68232afef8a52a521ca2e3e1b5aba840bf4a2092ffe45e18f7cf755184f379ac2cd78d6d77bc1cdfd0856daa503e307aa25ce8725037b069b25953550e8ae29a

Download Submit
C:\Windows\system\UuSzANc.exe

Filesize
2.7MB

MD5
ef0c3fd22869a5add3e3b170ec7e76b6

SHA1
000c1906c2cba0cec03765156b07784acc7bbe6b

SHA256
1c204dea2b46e79677c0ee825e59127a7504e9b4bd86a0ec2227d96570949048

SHA512
c19945ac84fbc50f683fe88aa1b1221f6cc022791d095bf62b6e204cc51ea18d87cc2fa8daa2283373db0f0bb7683b775496219efc81323f3278efd0287eb33c

Download Submit
C:\Windows\system\VpIxmNe.exe

Filesize
2.7MB

MD5
40a6385f2803ba5a2d3453f333a83c11

SHA1
b928a85a1d996f03b33189fd8ead93cb68deb978

SHA256
b77426776f0fc94951c99b5f9efcbb69e86665c54c2c85a1833785032e973782

SHA512
99af77787e287597cabac629368cea2d56a88c1cc8292b7a5b1f97f68bbb56d88e7aa3906bbe9fcada2438e6315ddcebfc4168218b12b6497ba206a1c59e10c7

Download Submit
C:\Windows\system\YZkXCPK.exe

Filesize
2.7MB

MD5
83774fadc2bfa70e5d33e191b2b3ceb2

SHA1
754913943c46198dc9dcdf4d4858c1e9489edad8

SHA256
b09907fc6d30d26cec530ba14061d3c151858f3e0d127d3e807fbb58e0569064

SHA512
8430e054aa0f3701196fbabd549d739b34d1a385039873860cb97f28fd79502a8f8fd6b5a65213e2f513e654c3d2116b4d2a3e58e260e5d7d29fb473623663ef

Download Submit
C:\Windows\system\aUkLMwi.exe

Filesize
2.7MB

MD5
e1d84db3e653077e9e727171a1f790f8

SHA1
5a19b272edf9270c9b9f8ed03b245a7426190f4a

SHA256
46a8c880050d9d2e60e1dce3b7236a95cec5c35053909e4b91a62c5613ee5dd9

SHA512
bd1f1c04b39995b7de602f2ab5ae11dcb5235fc55bbb3ed0a27b2a2f8aff8f7610325f4ec5c874959c49b0c8fd2ee0c221c6fcf119464b0cdc029131ede55c94

Download Submit
C:\Windows\system\cAjkhwP.exe

Filesize
2.7MB

MD5
bb885ca4add2cfa4f47e83a9ba1974cd

SHA1
f15f0c50a3aff2be33e152c6d99ccdcfe89a1479

SHA256
4768a46f5cfffbc53dd53142ec3e430cf12e47b6972819e07f57404df7ad408a

SHA512
e0108d22938b724ab8c58cff5cccdb4e04318cf9a87a185967bcc53aafd250cba2686639a760df184b2ce3330c94ed7313a13e1a907ad356abf7055f1cd255ab

Download Submit
C:\Windows\system\cautPnR.exe

Filesize
2.7MB

MD5
81356602a019175fea50ce5314d73241

SHA1
1b3530bcc5e91c686370728c1a328d153f93fa0e

SHA256
1e9db33d9ac8ba881e34ca5c019583cea8345ccf1b73140ee281d772a00c33c4

SHA512
4331f79f3e80589af357ec44b479f186305ea2351201110c6e65e05a609bb64c2c682a9f2bfe52ba8d9cd4feaddb9ba3cdd35ffb891bdf21e1df0d843a4ca01c

Download Submit
C:\Windows\system\iXtWVTI.exe

Filesize
2.7MB

MD5
2744f51295d23e673ab203bef3b931f5

SHA1
b5bb41e1cebec6e08a7b592d8dddf3eeea2cfc6b

SHA256
99f77d0783495157f52b59c14c1bbc01999d9c025a584a9c54cedb57fb6fcb72

SHA512
ab67a0c83a6075af98e0aef1a85f2b538b2589daf910f05ea1bcf412067864c9ad8d9dd0b7707e1d8d8ab8b366fd13b2af268b36a563ded02938d6d124d396f8

Download Submit
C:\Windows\system\iqaOOkK.exe

Filesize
2.7MB

MD5
4aae13f508595ac61811477e3bb93c61

SHA1
e8ea2a4ced7feb509bbdec6436d9ae7737288014

SHA256
d272f558008c9837aa5c0287ce8183d2a6dd120ef1b3c2326054ceab652cd488

SHA512
f0c8a61e4a3d6268f837d78d45638e0c30686cf56026ed161b0d2d54cc90f2ee86031f385393475ac91bb32dd4e7d01ebb57e5a4ff682c3b93c6d4b16503be9b

Download Submit
C:\Windows\system\jAHVQEf.exe

Filesize
2.7MB

MD5
63011d84d3d7d5714246e300384d5589

SHA1
42eac5ce2dd623e1ee102d09c7601bc559fae563

SHA256
e0386312bb888406ccb904f13a563df1d6334ea3cabc971fc24b54b8b10c68a1

SHA512
b7d74e074d9db9329fbe5d3d6717c1f551865c8c4110ddb50dfccb7d2a699dc912764baccf51e059b412c98dbe39b79601c53a5e209629f8244a2759d120c2b1

Download Submit
C:\Windows\system\jlVQZmd.exe

Filesize
2.7MB

MD5
e0e0a4a99b08242ac7955d34947a0c80

SHA1
0ba5116b82ff3a474251f5d9536e80a0bbc28a42

SHA256
07f5ddc4aaff7276511b13c9320fb1c7f128ed44f705b592ef267a0c6b57586b

SHA512
e9987d83731f0f20e3821d80c97edf3c4d3509ee926aad1f3c3756d02845ebd4230fd2d92579c4bb3acc1aa1d6e0e689ee18c881be16d7970230c91d819f1738

Download Submit
C:\Windows\system\kCdrRjF.exe

Filesize
2.7MB

MD5
4e5f510f6cb21154a0642d9ad0802d22

SHA1
c482de916d0ee465abf85a2196f3fc58b4d26f95

SHA256
5ed88b23b8f6a5a19ff9e889c701adf3885280588537fe6815c276cfa7b45da2

SHA512
78604f31901db2bb4f5910f32fdec6651c6d53194c2c1de62fa7a7b22923daee21c3276b31416f579e542c0c9158c339457b6eb31bd6f5fcf3b6e0ed3c4ab676

Download Submit
C:\Windows\system\kisSwff.exe

Filesize
2.7MB

MD5
1a124ff3c6f906757173fd6e2615c5da

SHA1
7120063baf2550d5b345e620dfb9dbf5167ffe69

SHA256
74709412e44f22c51597e53c38bb8baa398723a7ace1f088fad11b9ecc997195

SHA512
abb458f67ce4284017b207d155912361ce7447ff55efacd584fe381b81bcae33da068d2790d834de90c165a723d558d93f586c4290e4fec06c2a8b0c89b3966c

Download Submit
C:\Windows\system\kpbJauh.exe

Filesize
2.7MB

MD5
c501fd08981e5daba6ad4a97c87c54b0

SHA1
f2920646d4c279c56464dc49c7d37640b04399f0

SHA256
534a4823104344638c74d5d8129734014f7264987eb79b9e51740809743de47d

SHA512
575c60a280956462dea331f2e2dd57b8bce438d4e4d12792b833a6e740d859eeebed76a3536a16d254b694517b0bd3261846ce054a6b00d6b28c3853e5cf1057

Download Submit
C:\Windows\system\mImWFnU.exe

Filesize
2.7MB

MD5
dc6b2d3b56ffa70035ff1705001f9b3f

SHA1
67aa3992c4f098b9481f85e1806ea397b928a35e

SHA256
a1b1d6af3e0551b0d9cc24e7eb4f31c6713956ab3214d959f308f15452e6ede7

SHA512
737ac30e6e4537187cbe9fb5a6fa5891677dd88b4452b8239b81c12f34ec69d526b6d78350335c39bbe30202cd9fcc1fae62a9a3ad6cf21b30e2c385633ca034

Download Submit
C:\Windows\system\qcHtYYC.exe

Filesize
2.7MB

MD5
c35af81292053ecf095698aa7ef4275f

SHA1
55d7a5ee6d0c9eb74260dbab693f2ebe84361205

SHA256
d600e37d2134267baa8371994c0e30243f5aed99e0ad356b37ca6bb47eae75ea

SHA512
148f601f5fa7546faaf7c21796cd229d97dd3e76d9c4dcda141e980e00eca4736981bf2f96397958f5e1207604f2546b53f382882e115c1314e2311df27cd77a

Download Submit
C:\Windows\system\tGmhdlk.exe

Filesize
2.7MB

MD5
3bed9c9246b3d01e7d8905236e35102e

SHA1
ea51334a4189531c171d7d748ec2ee0135d895de

SHA256
5ec3266fa5f3b1ed14b006e5b35505af53419f9a334c366a4b92befa581cf66b

SHA512
bbc472b2a5f1049261adb1d76f5c62303960421c20b6938fdd78dfb6e98f00d7bc5ded4dfab0e6bc3f099daafeaf2d18ab5512027a87955576ae0307462fe235

Download Submit
C:\Windows\system\uAiDoLT.exe

Filesize
2.7MB

MD5
a96dfd42340e4429bc9b18c2539d7595

SHA1
3803d20cac3afc9fa8f2752a87d57a3d2308995b

SHA256
2c81d3cb3cd04e7e01b1673544286acced86f8db51aacb82ec5b3bc6ec3ba9ce

SHA512
d5313e44423ed204b9b056fde37437c480d23083c69b7311212b3af6119a44ba73fda1cc83bd8c51823ce810d78bcc0ddded55172aaa0571b74a3c1da4aafc85

Download Submit
C:\Windows\system\vymOpXX.exe

Filesize
2.7MB

MD5
7cbc509acd1374d18e07bf8cb24f4605

SHA1
0fd8bdf54fd9837a84d9e0f68e20f558f50e71dc

SHA256
428018ebb0091aa868ce72a6bc11f86f8bc5847085e5927fbacd27133c15e90d

SHA512
0f9c60df382df70e3d606f9d74dd0f1e9e5dc7d48dad916cf0f48a94a31761a2220efbf01697ffa5e53157c254d88a7c693f187c9ae74899027007427938229c

Download Submit
C:\Windows\system\wrhHAYB.exe

Filesize
2.7MB

MD5
6958148d5a2b9c39af97f6afd58c4a91

SHA1
e16b1c83ebfa089b69d62419e4fbec0c21bc0fb9

SHA256
6cf95f698bda3e2c5d461d8b1353601907749be630606834831c216f91defc8a

SHA512
b2f8f5c39b816de19881c28477f8eae5031f0c761ad25ec43c16af6c4f074697a56d97b791b43d67ae2fc0355554251d6d89f8c614df113682e533fb9e4547ce

Download Submit
C:\Windows\system\xewNAMr.exe

Filesize
2.7MB

MD5
a0348781feea69f51e36154d42522f8b

SHA1
d75419e2f7d1e5df4f1a0077882a958d06becb6c

SHA256
cefec017a6c04e39bb374eaef5a28cf4d820506af2fcff9631a9c8a48ce252fd

SHA512
47e7a642c67b3d877fdfab3c526fc2b5f415ec9ccf59679cc17561faefe0b4f69bcb1f105453b657f121b0f63f745a0c59f851605e1363d2a5365cfd68ab6a62

Download Submit
\Windows\system\CCuFDtm.exe

Filesize
2.7MB

MD5
1394409141e5334875148e03e53c7b5d

SHA1
05cf7b65fe331ea13b42cc4bd7cb7cb0d489556d

SHA256
0dd5b82c30cc3b6eb04dd64799e51648099b8b02e5e2a6a731c72d01b728a6eb

SHA512
1d6f9dd343d64b7fad69a9527dbc8c3f318b5eca6dca574048b4a88061abf0fd5431ab4f74ac3fd4d6218019a0890bb28ed5f30ce8d3cda729babc62cd05e6eb

Download Submit
\Windows\system\ENAXoKn.exe

Filesize
2.7MB

MD5
c27aa39a2fa93e61339b68182350aabf

SHA1
4dcc8b18b4049a6bfb49f4cc5f46c484a08ee1f1

SHA256
bdee9c2e351e196ea16e693b2fb71695f000b48db16269f137bdcf891c49c3e4

SHA512
6b3ea69c9baf172532669daa83add744a08d64050a4bda6b1de60967d24741aeb5329c91f0286e30a587c1fcbb3c5eecdc91f2a9ab59565e119b0aef5080c208

Download Submit
\Windows\system\IxBqMwc.exe

Filesize
2.7MB

MD5
affb2f965e33a6449294c5e945b79007

SHA1
30f7dd7a1f721d0bd19e07995b1f3b77318a5bf1

SHA256
f1ee36c22d2b172cd901e7027d2fa00615affd8ca5038fb82e2f4908b6b6965d

SHA512
24c05c390dae782f7947159bb1d2baf8e920c8d1a04df06afed3f03e71a44cb2085eda3e63a700d3c7925659a577907c327cd63cf0c3031a8d8f9a17806bc161

Download Submit
\Windows\system\clFhQqX.exe

Filesize
2.7MB

MD5
c97d56e4fe87c363124f25c4722733df

SHA1
478acaa97511ee6b60a4435c7711445479a54a4c

SHA256
bee195e24a7f72620ce25eadd977f8732b7f21d5056531f68fef7fe1fef62740

SHA512
eedd0d2bbabc280fcf96cf410322ec2a23f072b78fab42b81fbf47d6a36332cf9509b3f2b264011d72d75a53f0d2f6f0dfd61de6b95aa95fac5a41f10ebd15e6

Download Submit
\Windows\system\hxKdezB.exe

Filesize
2.7MB

MD5
21f1755cbaddddef92af482e63b76ebc

SHA1
c17bf7717a4ca8aed7690655a0035550c1585021

SHA256
f1a172e5c06ae4c3233756d39b9cb9a06af719df64ec27242ed848d29a9f7749

SHA512
69db5bd69d1fd0bd4367fbd8c1c51d6b927f08c79d01a49715b5710ac928105a315cd1ac36770edfb5ebbe4c28497afcfae90a3384ecdead340e19b533dda4de

Download Submit
\Windows\system\mMSQbAl.exe

Filesize
2.7MB

MD5
66c5e3db71619adfdd120ebe4e7b8cd3

SHA1
ee31aee311c7fab114cae47ec58196be3f2f6065

SHA256
6fd377d90c72f34dc69520c55d769a1e9dd2832fbf8fd220c97e4409fe3fc946

SHA512
98735e3ce98a8685465eb0b8bc5889015fc43b346aecfb14de37c93e862d65876261fc9b6568c0985813e1d77457b6e1566aab8ef86ba755e8ac7a3006ddea44

Download Submit
\Windows\system\nXyPBVf.exe

Filesize
2.7MB

MD5
7a58630bb62abeb804bcde48da4a6175

SHA1
e3be76f3544d2ad20aea26ec592380e610e9e2a9

SHA256
303c9c050ba6087287c77c6c9e68c5fe8f3ae21105ab971d392a447a6333d816

SHA512
976576a9570c3d007f9026b068f859fce4f7a5302e35295293c9eb744347393c81f7b8dd27135b5075ba24e6db0e06218bde0793f336538efd7ab01d1d8d918c

Download Submit
\Windows\system\vaDubZY.exe

Filesize
2.7MB

MD5
bfbff1a0074bc4ca214426591441e4b1

SHA1
4f4b0c33b0be606fcb7e508bd47a02e5c26c786f

SHA256
1114cd7254e975ad5d5e76de32c0877064bc2533eb40c7a1eb56401e18987789

SHA512
fbd80de068a7b2d197545adce8ae76ad6e58612ea4f5ec8fc624409d37d23e44f997c183eb502068269dd38a685dd8fcfedce62155baf4d197309fa5d1894014

Download Submit
\Windows\system\yLzLCev.exe

Filesize
2.7MB

MD5
09e527ce3942eb81f029ec10edc9395c

SHA1
aa82573a7d2a5f42a4ed187e7bd3bcc59f86bad3

SHA256
d15d91fe97fbe82fe01eba808414f3cfad8ab9b0d6691c570cbd69b9ef9c8d56

SHA512
9d863965ba826756e779dce174f7299a2ee7efc0448ae4b823c4a6578afbda91d31831f29eaf34a31b00fda6b0d1516cf1d3cb03d80c57e1a6ee74c757257da3

Download Submit
memory/2152-125-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2492-118-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2532-4476-0x000000013FE80000-0x0000000140276000-memory.dmp

Filesize
4.0MB

Download
memory/2532-116-0x000000013FE80000-0x0000000140276000-memory.dmp

Filesize
4.0MB

Download
memory/2536-123-0x000000013F460000-0x000000013F856000-memory.dmp

Filesize
4.0MB

Download
memory/2536-4523-0x000000013F460000-0x000000013F856000-memory.dmp

Filesize
4.0MB

Download
memory/2556-120-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2616-110-0x000000013FE70000-0x0000000140266000-memory.dmp

Filesize
4.0MB

Download
memory/2620-29-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2732-4525-0x000000013F920000-0x000000013FD16000-memory.dmp

Filesize
4.0MB

Download
memory/2732-130-0x000000013F920000-0x000000013FD16000-memory.dmp

Filesize
4.0MB

Download
memory/2744-132-0x000000013FA20000-0x000000013FE16000-memory.dmp

Filesize
4.0MB

Download
memory/2752-20-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2752-4563-0x000000013FA80000-0x000000013FE76000-memory.dmp

Filesize
4.0MB

Download
memory/2772-108-0x000000013F0D0000-0x000000013F4C6000-memory.dmp

Filesize
4.0MB

Download
memory/2772-4488-0x000000013F0D0000-0x000000013F4C6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-11-0x00000000030A0000-0x0000000003496000-memory.dmp

Filesize
4.0MB

Download
memory/2916-117-0x000000013FE50000-0x0000000140246000-memory.dmp

Filesize
4.0MB

Download
memory/2916-122-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-126-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-131-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-109-0x000000013FE70000-0x0000000140266000-memory.dmp

Filesize
4.0MB

Download
memory/2916-133-0x000000013F0D0000-0x000000013F4C6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-19-0x00000000030A0000-0x0000000003496000-memory.dmp

Filesize
4.0MB

Download
memory/2916-114-0x000000013FE80000-0x0000000140276000-memory.dmp

Filesize
4.0MB

Download
memory/2916-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2916-1-0x000000013F840000-0x000000013FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2916-4479-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-119-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-124-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-2355-0x000000013F840000-0x000000013FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2916-2359-0x00000000030A0000-0x0000000003496000-memory.dmp

Filesize
4.0MB

Download
memory/2916-3858-0x00000000030A0000-0x0000000003496000-memory.dmp

Filesize
4.0MB

Download
memory/2916-4462-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-4467-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/2916-4472-0x0000000003600000-0x00000000039F6000-memory.dmp

Filesize
4.0MB

Download
memory/3004-581-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/3004-30-0x000007FEF5BDE000-0x000007FEF5BDF000-memory.dmp

Filesize
4KB

Download
memory/3004-107-0x000007FEF5920000-0x000007FEF62BD000-memory.dmp

Filesize
9.6MB

Download
memory/3004-204-0x000000001B890000-0x000000001BB72000-memory.dmp

Filesize
2.9MB

Download
memory/3004-208-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/3064-4478-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download
memory/3064-21-0x000000013F540000-0x000000013F936000-memory.dmp

Filesize
4.0MB

Download