xmrig | 4684d2a8cf3c03a30da8de959a4d7cdba2383dc723ae0e9d6d8fc7b80950cba9

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
Size

2.7MB
MD5

bc83ba83cbd265015519769c0ae48ae0
SHA1

0658535fb7698d327f86bbc354f0e7d6eaf7a9a7
SHA256

4684d2a8cf3c03a30da8de959a4d7cdba2383dc723ae0e9d6d8fc7b80950cba9
SHA512

0d2b1f60d5e269a74c3a7b300d3b3488c0909d66479a02815e5bc4c081a202e1f52ebdce3f91c38400487595c1d38ad06f58bb4e84410dab0a2b5bcd60eb9514
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pOu:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2344-1-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	xmrig
behavioral1/files/0x000b000000014230-3.dat	xmrig
behavioral1/files/0x00340000000144e4-9.dat	xmrig
behavioral1/files/0x0007000000014708-19.dat	xmrig
behavioral1/memory/2572-25-0x000000013F040000-0x000000013F436000-memory.dmp	xmrig
behavioral1/memory/2112-14-0x000000013F6A0000-0x000000013FA96000-memory.dmp	xmrig
behavioral1/memory/2728-32-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/memory/2564-39-0x000000013F100000-0x000000013F4F6000-memory.dmp	xmrig
behavioral1/files/0x000a000000014aa2-50.dat	xmrig
behavioral1/files/0x0006000000015ce1-83.dat	xmrig
behavioral1/memory/2572-84-0x000000013F040000-0x000000013F436000-memory.dmp	xmrig
behavioral1/memory/2732-45-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/files/0x000700000001568c-92.dat	xmrig
behavioral1/files/0x0006000000015d07-105.dat	xmrig
behavioral1/files/0x0006000000015ceb-109.dat	xmrig
behavioral1/files/0x0006000000015d4a-113.dat	xmrig
behavioral1/memory/2596-93-0x000000013F260000-0x000000013F656000-memory.dmp	xmrig
behavioral1/files/0x0006000000015eaf-150.dat	xmrig
behavioral1/files/0x0006000000015d79-131.dat	xmrig
behavioral1/files/0x0006000000015cd5-102.dat	xmrig
behavioral1/files/0x0006000000016c4a-187.dat	xmrig
behavioral1/files/0x0006000000016843-180.dat	xmrig
behavioral1/files/0x0006000000016572-173.dat	xmrig
behavioral1/memory/2564-599-0x000000013F100000-0x000000013F4F6000-memory.dmp	xmrig
behavioral1/memory/2732-1379-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ca6-99.dat	xmrig
behavioral1/files/0x000600000001630b-166.dat	xmrig
behavioral1/files/0x0006000000016117-159.dat	xmrig
behavioral1/files/0x0006000000015f6d-152.dat	xmrig
behavioral1/files/0x0006000000015e3a-145.dat	xmrig
behavioral1/files/0x0006000000015d8f-138.dat	xmrig
behavioral1/files/0x0006000000015d67-124.dat	xmrig
behavioral1/files/0x0006000000015d56-117.dat	xmrig
behavioral1/memory/2344-73-0x00000000031C0000-0x00000000035B6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d28-110.dat	xmrig
behavioral1/memory/2456-54-0x000000013FC10000-0x0000000140006000-memory.dmp	xmrig
behavioral1/files/0x0006000000016a9a-185.dat	xmrig
behavioral1/files/0x000600000001661c-178.dat	xmrig
behavioral1/files/0x00060000000164b2-171.dat	xmrig
behavioral1/files/0x00060000000161e7-164.dat	xmrig
behavioral1/files/0x0006000000015fe9-157.dat	xmrig
behavioral1/files/0x0006000000015d9b-143.dat	xmrig
behavioral1/files/0x0006000000015d87-136.dat	xmrig
behavioral1/files/0x0006000000015d6f-129.dat	xmrig
behavioral1/files/0x0006000000015d5e-122.dat	xmrig
behavioral1/memory/2408-88-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/2492-87-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/files/0x0008000000014857-44.dat	xmrig
behavioral1/memory/2432-86-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	xmrig
behavioral1/memory/2728-85-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cba-82.dat	xmrig
behavioral1/files/0x0006000000015be6-81.dat	xmrig
behavioral1/memory/2112-79-0x000000013F6A0000-0x000000013FA96000-memory.dmp	xmrig
behavioral1/memory/1156-69-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	xmrig
behavioral1/memory/2344-49-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	xmrig
behavioral1/files/0x0007000000004e76-36.dat	xmrig
behavioral1/files/0x000700000001471d-29.dat	xmrig
behavioral1/memory/1156-8-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	xmrig
behavioral1/memory/2564-4335-0x000000013F100000-0x000000013F4F6000-memory.dmp	xmrig
behavioral1/memory/2728-4534-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/memory/2732-4570-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/memory/2408-4638-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/2492-4624-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/memory/2596-4623-0x000000013F260000-0x000000013F656000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2128	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1156	oKjmVAC.exe
2112	owLOoOJ.exe
2572	LasqkWA.exe
2728	iTMYsEO.exe
2564	KYhuQUS.exe
2732	THVdyOw.exe
2456	tUPUfMQ.exe
2432	wWuqDRz.exe
2492	XuQUxAM.exe
2408	cvRSypT.exe
2596	EEsptnE.exe
2452	SNgliVo.exe
1620	ZZLsDqF.exe
2608	cprOWOU.exe
1500	gPwZwWI.exe
2840	leMQfcz.exe
1600	ZpuYZiN.exe
1492	OZAeKYe.exe
1692	zBMyYFt.exe
1908	MbiKlVE.exe
2412	RnNoqoE.exe
268	xoFhEve.exe
576	MPYoPzA.exe
1852	ILZYUBm.exe
556	USbiWQm.exe
2388	bRGwvto.exe
1732	chwiFDi.exe
1524	KQBnKIN.exe
960	wTZoHsC.exe
1048	MdXHgRb.exe
1784	QSAyMUx.exe
320	QmKQyYX.exe
3036	QyYeKsC.exe
3040	DrcWtud.exe
1928	hUFBUpV.exe
2008	cknqrTD.exe
1292	gjvhQMW.exe
2404	ZxxQDLz.exe
1564	yiIOBEv.exe
2704	TOGfIaZ.exe
2876	PdseQZg.exe
3012	FEoYsBp.exe
1644	xNnFdEg.exe
1268	xStHVqh.exe
336	VCqMtjD.exe
1840	dSKjSpD.exe
820	BnSiyTh.exe
564	YjsgByq.exe
2236	GfCacop.exe
3028	DRCXakB.exe
604	svSfCSd.exe
3104	efrzeji.exe
3136	bILRkGl.exe
3168	wcJDBcL.exe
3200	YtTTctA.exe
3232	ZVngGeR.exe
3264	joiMiSb.exe
3296	AKgaJkB.exe
3328	MfpxpUA.exe
3360	sLRuppJ.exe
3392	zDQTFNT.exe
3424	wDUaXpz.exe
3456	iuRxLYi.exe
3488	SMUsfZg.exe

Loads dropped DLL 64 IoCs

pid	Process
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2344-1-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	upx
behavioral1/files/0x000b000000014230-3.dat	upx
behavioral1/files/0x00340000000144e4-9.dat	upx
behavioral1/files/0x0007000000014708-19.dat	upx
behavioral1/memory/2572-25-0x000000013F040000-0x000000013F436000-memory.dmp	upx
behavioral1/memory/2112-14-0x000000013F6A0000-0x000000013FA96000-memory.dmp	upx
behavioral1/memory/2728-32-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/memory/2564-39-0x000000013F100000-0x000000013F4F6000-memory.dmp	upx
behavioral1/files/0x000a000000014aa2-50.dat	upx
behavioral1/files/0x0006000000015ce1-83.dat	upx
behavioral1/memory/2572-84-0x000000013F040000-0x000000013F436000-memory.dmp	upx
behavioral1/memory/2732-45-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/files/0x000700000001568c-92.dat	upx
behavioral1/files/0x0006000000015d07-105.dat	upx
behavioral1/files/0x0006000000015ceb-109.dat	upx
behavioral1/files/0x0006000000015d4a-113.dat	upx
behavioral1/memory/2596-93-0x000000013F260000-0x000000013F656000-memory.dmp	upx
behavioral1/files/0x0006000000015eaf-150.dat	upx
behavioral1/files/0x0006000000015d79-131.dat	upx
behavioral1/files/0x0006000000015cd5-102.dat	upx
behavioral1/files/0x0006000000016c4a-187.dat	upx
behavioral1/files/0x0006000000016843-180.dat	upx
behavioral1/files/0x0006000000016572-173.dat	upx
behavioral1/memory/2564-599-0x000000013F100000-0x000000013F4F6000-memory.dmp	upx
behavioral1/memory/2732-1379-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/files/0x0006000000015ca6-99.dat	upx
behavioral1/files/0x000600000001630b-166.dat	upx
behavioral1/files/0x0006000000016117-159.dat	upx
behavioral1/files/0x0006000000015f6d-152.dat	upx
behavioral1/files/0x0006000000015e3a-145.dat	upx
behavioral1/files/0x0006000000015d8f-138.dat	upx
behavioral1/files/0x0006000000015d67-124.dat	upx
behavioral1/files/0x0006000000015d56-117.dat	upx
behavioral1/files/0x0006000000015d28-110.dat	upx
behavioral1/memory/2456-54-0x000000013FC10000-0x0000000140006000-memory.dmp	upx
behavioral1/files/0x0006000000016a9a-185.dat	upx
behavioral1/files/0x000600000001661c-178.dat	upx
behavioral1/files/0x00060000000164b2-171.dat	upx
behavioral1/files/0x00060000000161e7-164.dat	upx
behavioral1/files/0x0006000000015fe9-157.dat	upx
behavioral1/files/0x0006000000015d9b-143.dat	upx
behavioral1/files/0x0006000000015d87-136.dat	upx
behavioral1/files/0x0006000000015d6f-129.dat	upx
behavioral1/files/0x0006000000015d5e-122.dat	upx
behavioral1/memory/2408-88-0x000000013F620000-0x000000013FA16000-memory.dmp	upx
behavioral1/memory/2492-87-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/files/0x0008000000014857-44.dat	upx
behavioral1/memory/2432-86-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	upx
behavioral1/memory/2728-85-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x0006000000015cba-82.dat	upx
behavioral1/files/0x0006000000015be6-81.dat	upx
behavioral1/memory/2112-79-0x000000013F6A0000-0x000000013FA96000-memory.dmp	upx
behavioral1/memory/1156-69-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	upx
behavioral1/memory/2344-49-0x000000013F3C0000-0x000000013F7B6000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-36.dat	upx
behavioral1/files/0x000700000001471d-29.dat	upx
behavioral1/memory/1156-8-0x000000013F2D0000-0x000000013F6C6000-memory.dmp	upx
behavioral1/memory/2564-4335-0x000000013F100000-0x000000013F4F6000-memory.dmp	upx
behavioral1/memory/2728-4534-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/memory/2732-4570-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/memory/2408-4638-0x000000013F620000-0x000000013FA16000-memory.dmp	upx
behavioral1/memory/2492-4624-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/memory/2596-4623-0x000000013F260000-0x000000013F656000-memory.dmp	upx
behavioral1/memory/2432-4698-0x000000013F4B0000-0x000000013F8A6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zMMgHhe.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\BDUETVE.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\NotEJlP.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\ApgPIGw.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\CCWLSMe.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\mcoeSFL.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\ucEAHut.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\bFDvUui.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\dyfwFPl.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\GcLgcAp.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\XHZcaQn.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\htPtdxU.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\egOjzOP.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\uacGDwQ.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\WChEyDZ.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\yCWdTIf.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\FVDZVaD.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\oiPFNKG.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\eBHayRn.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\efKLUPk.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\ySkZJEc.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\AYKEgyj.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\QvTzWGs.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\cqlqXtl.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\rOrqgsi.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\PaDSYxx.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\RXzalFc.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\VBvTqDP.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\bkNMESz.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\RAeHEEW.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\BeAiOtB.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\DYVNcQx.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\WDDDheG.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\JIelqfG.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\qwmBPeV.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\MIhAgaP.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\sCMLYgP.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\vgVntVl.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\ZlVbJfZ.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\NBIsiuP.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\mbEABhQ.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\LHxltah.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\iLodsFH.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\iWpHPZs.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\ZOLjiVZ.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\STCEijk.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\zIMpBVG.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\MqswYWv.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\qjRZWAG.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\RbIIXpN.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\PBCakBW.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\HkCmDOi.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\gEWmrUY.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\wXTNWLv.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\tocYHPd.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\lVdaAWW.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\KPfACzE.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\rXADIqI.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\azSlrmj.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\IBmqEem.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\lPDohOC.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\GkleVTy.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\ZsnNUPf.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
File created	C:\Windows\System\TNHuldH.exe	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2128	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 2128	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 2128	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	29
PID 2344 wrote to memory of 1156	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	30
PID 2344 wrote to memory of 1156	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	30
PID 2344 wrote to memory of 1156	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	30
PID 2344 wrote to memory of 2112	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	31
PID 2344 wrote to memory of 2112	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	31
PID 2344 wrote to memory of 2112	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	31
PID 2344 wrote to memory of 2572	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	32
PID 2344 wrote to memory of 2572	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	32
PID 2344 wrote to memory of 2572	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	32
PID 2344 wrote to memory of 2728	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	33
PID 2344 wrote to memory of 2728	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	33
PID 2344 wrote to memory of 2728	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	33
PID 2344 wrote to memory of 2564	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	34
PID 2344 wrote to memory of 2564	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	34
PID 2344 wrote to memory of 2564	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	34
PID 2344 wrote to memory of 2732	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	35
PID 2344 wrote to memory of 2732	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	35
PID 2344 wrote to memory of 2732	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	35
PID 2344 wrote to memory of 2456	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	36
PID 2344 wrote to memory of 2456	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	36
PID 2344 wrote to memory of 2456	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	36
PID 2344 wrote to memory of 2596	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	37
PID 2344 wrote to memory of 2596	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	37
PID 2344 wrote to memory of 2596	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	37
PID 2344 wrote to memory of 2432	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	38
PID 2344 wrote to memory of 2432	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	38
PID 2344 wrote to memory of 2432	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	38
PID 2344 wrote to memory of 2452	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	39
PID 2344 wrote to memory of 2452	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	39
PID 2344 wrote to memory of 2452	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	39
PID 2344 wrote to memory of 2492	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	40
PID 2344 wrote to memory of 2492	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	40
PID 2344 wrote to memory of 2492	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	40
PID 2344 wrote to memory of 1620	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	41
PID 2344 wrote to memory of 1620	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	41
PID 2344 wrote to memory of 1620	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	41
PID 2344 wrote to memory of 2408	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	42
PID 2344 wrote to memory of 2408	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	42
PID 2344 wrote to memory of 2408	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	42
PID 2344 wrote to memory of 1500	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	43
PID 2344 wrote to memory of 1500	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	43
PID 2344 wrote to memory of 1500	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	43
PID 2344 wrote to memory of 2608	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	44
PID 2344 wrote to memory of 2608	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	44
PID 2344 wrote to memory of 2608	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	44
PID 2344 wrote to memory of 1688	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	45
PID 2344 wrote to memory of 1688	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	45
PID 2344 wrote to memory of 1688	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	45
PID 2344 wrote to memory of 2840	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	46
PID 2344 wrote to memory of 2840	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	46
PID 2344 wrote to memory of 2840	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	46
PID 2344 wrote to memory of 2856	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	47
PID 2344 wrote to memory of 2856	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	47
PID 2344 wrote to memory of 2856	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	47
PID 2344 wrote to memory of 1600	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	48
PID 2344 wrote to memory of 1600	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	48
PID 2344 wrote to memory of 1600	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	48
PID 2344 wrote to memory of 1196	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	49
PID 2344 wrote to memory of 1196	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	49
PID 2344 wrote to memory of 1196	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	49
PID 2344 wrote to memory of 1492	2344	bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bc83ba83cbd265015519769c0ae48ae0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System\oKjmVAC.exe
  C:\Windows\System\oKjmVAC.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\owLOoOJ.exe
  C:\Windows\System\owLOoOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\LasqkWA.exe
  C:\Windows\System\LasqkWA.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\iTMYsEO.exe
  C:\Windows\System\iTMYsEO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\KYhuQUS.exe
  C:\Windows\System\KYhuQUS.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\THVdyOw.exe
  C:\Windows\System\THVdyOw.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\tUPUfMQ.exe
  C:\Windows\System\tUPUfMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\EEsptnE.exe
  C:\Windows\System\EEsptnE.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\wWuqDRz.exe
  C:\Windows\System\wWuqDRz.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\SNgliVo.exe
  C:\Windows\System\SNgliVo.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\XuQUxAM.exe
  C:\Windows\System\XuQUxAM.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ZZLsDqF.exe
  C:\Windows\System\ZZLsDqF.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\cvRSypT.exe
  C:\Windows\System\cvRSypT.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\gPwZwWI.exe
  C:\Windows\System\gPwZwWI.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\cprOWOU.exe
  C:\Windows\System\cprOWOU.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ZMKhqkN.exe
  C:\Windows\System\ZMKhqkN.exe
  2⤵
  PID:1688
- C:\Windows\System\leMQfcz.exe
  C:\Windows\System\leMQfcz.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\WBQOReq.exe
  C:\Windows\System\WBQOReq.exe
  2⤵
  PID:2856
- C:\Windows\System\ZpuYZiN.exe
  C:\Windows\System\ZpuYZiN.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\QxYfFdn.exe
  C:\Windows\System\QxYfFdn.exe
  2⤵
  PID:1196
- C:\Windows\System\OZAeKYe.exe
  C:\Windows\System\OZAeKYe.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\DrwYivv.exe
  C:\Windows\System\DrwYivv.exe
  2⤵
  PID:1752
- C:\Windows\System\zBMyYFt.exe
  C:\Windows\System\zBMyYFt.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\IlnVpGz.exe
  C:\Windows\System\IlnVpGz.exe
  2⤵
  PID:2004
- C:\Windows\System\MbiKlVE.exe
  C:\Windows\System\MbiKlVE.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\zbVdlTh.exe
  C:\Windows\System\zbVdlTh.exe
  2⤵
  PID:1796
- C:\Windows\System\RnNoqoE.exe
  C:\Windows\System\RnNoqoE.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\TXhZgEy.exe
  C:\Windows\System\TXhZgEy.exe
  2⤵
  PID:1792
- C:\Windows\System\xoFhEve.exe
  C:\Windows\System\xoFhEve.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\aCvrItW.exe
  C:\Windows\System\aCvrItW.exe
  2⤵
  PID:784
- C:\Windows\System\MPYoPzA.exe
  C:\Windows\System\MPYoPzA.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\lixSyAq.exe
  C:\Windows\System\lixSyAq.exe
  2⤵
  PID:2904
- C:\Windows\System\ILZYUBm.exe
  C:\Windows\System\ILZYUBm.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\lxPsPtc.exe
  C:\Windows\System\lxPsPtc.exe
  2⤵
  PID:300
- C:\Windows\System\USbiWQm.exe
  C:\Windows\System\USbiWQm.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\Wmymzrs.exe
  C:\Windows\System\Wmymzrs.exe
  2⤵
  PID:452
- C:\Windows\System\bRGwvto.exe
  C:\Windows\System\bRGwvto.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\LmNYwtC.exe
  C:\Windows\System\LmNYwtC.exe
  2⤵
  PID:2160
- C:\Windows\System\chwiFDi.exe
  C:\Windows\System\chwiFDi.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\MLIdTwA.exe
  C:\Windows\System\MLIdTwA.exe
  2⤵
  PID:1340
- C:\Windows\System\KQBnKIN.exe
  C:\Windows\System\KQBnKIN.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\MHdxHYO.exe
  C:\Windows\System\MHdxHYO.exe
  2⤵
  PID:332
- C:\Windows\System\wTZoHsC.exe
  C:\Windows\System\wTZoHsC.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\yxYrCaJ.exe
  C:\Windows\System\yxYrCaJ.exe
  2⤵
  PID:1124
- C:\Windows\System\MdXHgRb.exe
  C:\Windows\System\MdXHgRb.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\ehppHnh.exe
  C:\Windows\System\ehppHnh.exe
  2⤵
  PID:1812
- C:\Windows\System\QSAyMUx.exe
  C:\Windows\System\QSAyMUx.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\qpBEORp.exe
  C:\Windows\System\qpBEORp.exe
  2⤵
  PID:884
- C:\Windows\System\QmKQyYX.exe
  C:\Windows\System\QmKQyYX.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\HZDaCxb.exe
  C:\Windows\System\HZDaCxb.exe
  2⤵
  PID:1436
- C:\Windows\System\QyYeKsC.exe
  C:\Windows\System\QyYeKsC.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\YQyUaxU.exe
  C:\Windows\System\YQyUaxU.exe
  2⤵
  PID:2044
- C:\Windows\System\DrcWtud.exe
  C:\Windows\System\DrcWtud.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\KljCFtH.exe
  C:\Windows\System\KljCFtH.exe
  2⤵
  PID:2940
- C:\Windows\System\hUFBUpV.exe
  C:\Windows\System\hUFBUpV.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ByJSVDF.exe
  C:\Windows\System\ByJSVDF.exe
  2⤵
  PID:2368
- C:\Windows\System\cknqrTD.exe
  C:\Windows\System\cknqrTD.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\MkjCKJT.exe
  C:\Windows\System\MkjCKJT.exe
  2⤵
  PID:1684
- C:\Windows\System\gjvhQMW.exe
  C:\Windows\System\gjvhQMW.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\yerLacC.exe
  C:\Windows\System\yerLacC.exe
  2⤵
  PID:1648
- C:\Windows\System\ZxxQDLz.exe
  C:\Windows\System\ZxxQDLz.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\wxMMHgP.exe
  C:\Windows\System\wxMMHgP.exe
  2⤵
  PID:1572
- C:\Windows\System\yiIOBEv.exe
  C:\Windows\System\yiIOBEv.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\hbSXCOc.exe
  C:\Windows\System\hbSXCOc.exe
  2⤵
  PID:2580
- C:\Windows\System\TOGfIaZ.exe
  C:\Windows\System\TOGfIaZ.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\oplqyBf.exe
  C:\Windows\System\oplqyBf.exe
  2⤵
  PID:2560
- C:\Windows\System\PdseQZg.exe
  C:\Windows\System\PdseQZg.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\RAYypqD.exe
  C:\Windows\System\RAYypqD.exe
  2⤵
  PID:2448
- C:\Windows\System\FEoYsBp.exe
  C:\Windows\System\FEoYsBp.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\PBElvPd.exe
  C:\Windows\System\PBElvPd.exe
  2⤵
  PID:2524
- C:\Windows\System\xNnFdEg.exe
  C:\Windows\System\xNnFdEg.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\gHUKvPf.exe
  C:\Windows\System\gHUKvPf.exe
  2⤵
  PID:2760
- C:\Windows\System\xStHVqh.exe
  C:\Windows\System\xStHVqh.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\tJBMAvp.exe
  C:\Windows\System\tJBMAvp.exe
  2⤵
  PID:2392
- C:\Windows\System\VCqMtjD.exe
  C:\Windows\System\VCqMtjD.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\ZzzrbAN.exe
  C:\Windows\System\ZzzrbAN.exe
  2⤵
  PID:2068
- C:\Windows\System\dSKjSpD.exe
  C:\Windows\System\dSKjSpD.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\kaSZMlO.exe
  C:\Windows\System\kaSZMlO.exe
  2⤵
  PID:1512
- C:\Windows\System\BnSiyTh.exe
  C:\Windows\System\BnSiyTh.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\VBvTqDP.exe
  C:\Windows\System\VBvTqDP.exe
  2⤵
  PID:352
- C:\Windows\System\YjsgByq.exe
  C:\Windows\System\YjsgByq.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\BOlDsyy.exe
  C:\Windows\System\BOlDsyy.exe
  2⤵
  PID:880
- C:\Windows\System\GfCacop.exe
  C:\Windows\System\GfCacop.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\UQWyXWp.exe
  C:\Windows\System\UQWyXWp.exe
  2⤵
  PID:2588
- C:\Windows\System\DRCXakB.exe
  C:\Windows\System\DRCXakB.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\PNrkWVa.exe
  C:\Windows\System\PNrkWVa.exe
  2⤵
  PID:2284
- C:\Windows\System\svSfCSd.exe
  C:\Windows\System\svSfCSd.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\PYipUvH.exe
  C:\Windows\System\PYipUvH.exe
  2⤵
  PID:3088
- C:\Windows\System\efrzeji.exe
  C:\Windows\System\efrzeji.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\qglNCfc.exe
  C:\Windows\System\qglNCfc.exe
  2⤵
  PID:3120
- C:\Windows\System\bILRkGl.exe
  C:\Windows\System\bILRkGl.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\YtuNfwO.exe
  C:\Windows\System\YtuNfwO.exe
  2⤵
  PID:3152
- C:\Windows\System\wcJDBcL.exe
  C:\Windows\System\wcJDBcL.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\vKSbfJN.exe
  C:\Windows\System\vKSbfJN.exe
  2⤵
  PID:3184
- C:\Windows\System\YtTTctA.exe
  C:\Windows\System\YtTTctA.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\GfgDKjN.exe
  C:\Windows\System\GfgDKjN.exe
  2⤵
  PID:3216
- C:\Windows\System\ZVngGeR.exe
  C:\Windows\System\ZVngGeR.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\lsgmFUH.exe
  C:\Windows\System\lsgmFUH.exe
  2⤵
  PID:3248
- C:\Windows\System\joiMiSb.exe
  C:\Windows\System\joiMiSb.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\XhEdwQN.exe
  C:\Windows\System\XhEdwQN.exe
  2⤵
  PID:3280
- C:\Windows\System\AKgaJkB.exe
  C:\Windows\System\AKgaJkB.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\huCVIRS.exe
  C:\Windows\System\huCVIRS.exe
  2⤵
  PID:3312
- C:\Windows\System\MfpxpUA.exe
  C:\Windows\System\MfpxpUA.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\jEcjtEn.exe
  C:\Windows\System\jEcjtEn.exe
  2⤵
  PID:3344
- C:\Windows\System\sLRuppJ.exe
  C:\Windows\System\sLRuppJ.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\EbMbDQd.exe
  C:\Windows\System\EbMbDQd.exe
  2⤵
  PID:3376
- C:\Windows\System\zDQTFNT.exe
  C:\Windows\System\zDQTFNT.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\GyIVzZD.exe
  C:\Windows\System\GyIVzZD.exe
  2⤵
  PID:3408
- C:\Windows\System\wDUaXpz.exe
  C:\Windows\System\wDUaXpz.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\LwrTLfp.exe
  C:\Windows\System\LwrTLfp.exe
  2⤵
  PID:3440
- C:\Windows\System\iuRxLYi.exe
  C:\Windows\System\iuRxLYi.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\LmYiTej.exe
  C:\Windows\System\LmYiTej.exe
  2⤵
  PID:3472
- C:\Windows\System\SMUsfZg.exe
  C:\Windows\System\SMUsfZg.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\dtvsRVD.exe
  C:\Windows\System\dtvsRVD.exe
  2⤵
  PID:3504
- C:\Windows\System\jWgetRm.exe
  C:\Windows\System\jWgetRm.exe
  2⤵
  PID:3520
- C:\Windows\System\mJXMbkW.exe
  C:\Windows\System\mJXMbkW.exe
  2⤵
  PID:3536
- C:\Windows\System\lzPzEsz.exe
  C:\Windows\System\lzPzEsz.exe
  2⤵
  PID:3552
- C:\Windows\System\UlxesVx.exe
  C:\Windows\System\UlxesVx.exe
  2⤵
  PID:3568
- C:\Windows\System\jKrAnQX.exe
  C:\Windows\System\jKrAnQX.exe
  2⤵
  PID:3584
- C:\Windows\System\GYUDAkJ.exe
  C:\Windows\System\GYUDAkJ.exe
  2⤵
  PID:3600
- C:\Windows\System\uoguWKC.exe
  C:\Windows\System\uoguWKC.exe
  2⤵
  PID:3616
- C:\Windows\System\wChVxrt.exe
  C:\Windows\System\wChVxrt.exe
  2⤵
  PID:3632
- C:\Windows\System\bJOZoLl.exe
  C:\Windows\System\bJOZoLl.exe
  2⤵
  PID:3648
- C:\Windows\System\nYUyzdM.exe
  C:\Windows\System\nYUyzdM.exe
  2⤵
  PID:3664
- C:\Windows\System\vwBGsUp.exe
  C:\Windows\System\vwBGsUp.exe
  2⤵
  PID:3680
- C:\Windows\System\dhDLvdT.exe
  C:\Windows\System\dhDLvdT.exe
  2⤵
  PID:3696
- C:\Windows\System\FitxuQn.exe
  C:\Windows\System\FitxuQn.exe
  2⤵
  PID:3712
- C:\Windows\System\cwKoMDt.exe
  C:\Windows\System\cwKoMDt.exe
  2⤵
  PID:3728
- C:\Windows\System\WOrMNZg.exe
  C:\Windows\System\WOrMNZg.exe
  2⤵
  PID:3744
- C:\Windows\System\TfttUkD.exe
  C:\Windows\System\TfttUkD.exe
  2⤵
  PID:3760
- C:\Windows\System\leadoPu.exe
  C:\Windows\System\leadoPu.exe
  2⤵
  PID:3776
- C:\Windows\System\bhdpMeA.exe
  C:\Windows\System\bhdpMeA.exe
  2⤵
  PID:3792
- C:\Windows\System\nuYCttJ.exe
  C:\Windows\System\nuYCttJ.exe
  2⤵
  PID:3808
- C:\Windows\System\LeofPKk.exe
  C:\Windows\System\LeofPKk.exe
  2⤵
  PID:3824
- C:\Windows\System\SyNnlKc.exe
  C:\Windows\System\SyNnlKc.exe
  2⤵
  PID:3840
- C:\Windows\System\aTfhNDf.exe
  C:\Windows\System\aTfhNDf.exe
  2⤵
  PID:3856
- C:\Windows\System\qIxsNgX.exe
  C:\Windows\System\qIxsNgX.exe
  2⤵
  PID:3872
- C:\Windows\System\aqlinxT.exe
  C:\Windows\System\aqlinxT.exe
  2⤵
  PID:3888
- C:\Windows\System\WfnHkev.exe
  C:\Windows\System\WfnHkev.exe
  2⤵
  PID:3904
- C:\Windows\System\GcLgcAp.exe
  C:\Windows\System\GcLgcAp.exe
  2⤵
  PID:3920
- C:\Windows\System\AcLYJRj.exe
  C:\Windows\System\AcLYJRj.exe
  2⤵
  PID:3936
- C:\Windows\System\txBZVBE.exe
  C:\Windows\System\txBZVBE.exe
  2⤵
  PID:3952
- C:\Windows\System\lZFJrqy.exe
  C:\Windows\System\lZFJrqy.exe
  2⤵
  PID:3968
- C:\Windows\System\zcjwqaT.exe
  C:\Windows\System\zcjwqaT.exe
  2⤵
  PID:3984
- C:\Windows\System\AHtwwVv.exe
  C:\Windows\System\AHtwwVv.exe
  2⤵
  PID:4000
- C:\Windows\System\yNAlAaz.exe
  C:\Windows\System\yNAlAaz.exe
  2⤵
  PID:4016
- C:\Windows\System\QGZiHJq.exe
  C:\Windows\System\QGZiHJq.exe
  2⤵
  PID:4032
- C:\Windows\System\hPRanjX.exe
  C:\Windows\System\hPRanjX.exe
  2⤵
  PID:4048
- C:\Windows\System\mmrrbIh.exe
  C:\Windows\System\mmrrbIh.exe
  2⤵
  PID:4064
- C:\Windows\System\jqfYZgo.exe
  C:\Windows\System\jqfYZgo.exe
  2⤵
  PID:4080
- C:\Windows\System\WxJcaNk.exe
  C:\Windows\System\WxJcaNk.exe
  2⤵
  PID:1508
- C:\Windows\System\XgskXos.exe
  C:\Windows\System\XgskXos.exe
  2⤵
  PID:2924
- C:\Windows\System\YHwNyDI.exe
  C:\Windows\System\YHwNyDI.exe
  2⤵
  PID:1224
- C:\Windows\System\PaJPKbI.exe
  C:\Windows\System\PaJPKbI.exe
  2⤵
  PID:3084
- C:\Windows\System\HXcouCv.exe
  C:\Windows\System\HXcouCv.exe
  2⤵
  PID:3148
- C:\Windows\System\aTDSkOR.exe
  C:\Windows\System\aTDSkOR.exe
  2⤵
  PID:3212
- C:\Windows\System\qGJfpxF.exe
  C:\Windows\System\qGJfpxF.exe
  2⤵
  PID:3276
- C:\Windows\System\tdOMAAe.exe
  C:\Windows\System\tdOMAAe.exe
  2⤵
  PID:3340
- C:\Windows\System\IyPuQIY.exe
  C:\Windows\System\IyPuQIY.exe
  2⤵
  PID:3404
- C:\Windows\System\aMZfROl.exe
  C:\Windows\System\aMZfROl.exe
  2⤵
  PID:3468
- C:\Windows\System\rHiaOIY.exe
  C:\Windows\System\rHiaOIY.exe
  2⤵
  PID:3528
- C:\Windows\System\mpQzUfz.exe
  C:\Windows\System\mpQzUfz.exe
  2⤵
  PID:3592
- C:\Windows\System\onAYOoR.exe
  C:\Windows\System\onAYOoR.exe
  2⤵
  PID:3656
- C:\Windows\System\XogYqTN.exe
  C:\Windows\System\XogYqTN.exe
  2⤵
  PID:3720
- C:\Windows\System\OoATcin.exe
  C:\Windows\System\OoATcin.exe
  2⤵
  PID:3784
- C:\Windows\System\vdFCjit.exe
  C:\Windows\System\vdFCjit.exe
  2⤵
  PID:3820
- C:\Windows\System\FDTVmSx.exe
  C:\Windows\System\FDTVmSx.exe
  2⤵
  PID:3884
- C:\Windows\System\sXnQbjM.exe
  C:\Windows\System\sXnQbjM.exe
  2⤵
  PID:3948
- C:\Windows\System\RpeiiEI.exe
  C:\Windows\System\RpeiiEI.exe
  2⤵
  PID:4012
- C:\Windows\System\XtFAgjC.exe
  C:\Windows\System\XtFAgjC.exe
  2⤵
  PID:4076
- C:\Windows\System\RxHJviF.exe
  C:\Windows\System\RxHJviF.exe
  2⤵
  PID:3080
- C:\Windows\System\LTRAKuk.exe
  C:\Windows\System\LTRAKuk.exe
  2⤵
  PID:3308
- C:\Windows\System\yLEUbtk.exe
  C:\Windows\System\yLEUbtk.exe
  2⤵
  PID:3464
- C:\Windows\System\YWvKmgZ.exe
  C:\Windows\System\YWvKmgZ.exe
  2⤵
  PID:3692
- C:\Windows\System\xdHZfVm.exe
  C:\Windows\System\xdHZfVm.exe
  2⤵
  PID:4104
- C:\Windows\System\aeuvJep.exe
  C:\Windows\System\aeuvJep.exe
  2⤵
  PID:4120
- C:\Windows\System\zqXYljF.exe
  C:\Windows\System\zqXYljF.exe
  2⤵
  PID:4136
- C:\Windows\System\tmWUEog.exe
  C:\Windows\System\tmWUEog.exe
  2⤵
  PID:4152
- C:\Windows\System\hMzLcic.exe
  C:\Windows\System\hMzLcic.exe
  2⤵
  PID:4168
- C:\Windows\System\hSlAWlL.exe
  C:\Windows\System\hSlAWlL.exe
  2⤵
  PID:4184
- C:\Windows\System\GNGSHqJ.exe
  C:\Windows\System\GNGSHqJ.exe
  2⤵
  PID:4200
- C:\Windows\System\rkTSxrv.exe
  C:\Windows\System\rkTSxrv.exe
  2⤵
  PID:4216
- C:\Windows\System\tAzUbDg.exe
  C:\Windows\System\tAzUbDg.exe
  2⤵
  PID:4232
- C:\Windows\System\SLWgKAv.exe
  C:\Windows\System\SLWgKAv.exe
  2⤵
  PID:4248
- C:\Windows\System\BzXhPmi.exe
  C:\Windows\System\BzXhPmi.exe
  2⤵
  PID:4264
- C:\Windows\System\aVGvXFb.exe
  C:\Windows\System\aVGvXFb.exe
  2⤵
  PID:4280
- C:\Windows\System\EQBQImq.exe
  C:\Windows\System\EQBQImq.exe
  2⤵
  PID:4296
- C:\Windows\System\kaedxHJ.exe
  C:\Windows\System\kaedxHJ.exe
  2⤵
  PID:4312
- C:\Windows\System\UtAclgH.exe
  C:\Windows\System\UtAclgH.exe
  2⤵
  PID:4328
- C:\Windows\System\DAAeZMS.exe
  C:\Windows\System\DAAeZMS.exe
  2⤵
  PID:4352
- C:\Windows\System\vFYQsyi.exe
  C:\Windows\System\vFYQsyi.exe
  2⤵
  PID:4720
- C:\Windows\System\NDyfOHQ.exe
  C:\Windows\System\NDyfOHQ.exe
  2⤵
  PID:4736
- C:\Windows\System\KqUKkqp.exe
  C:\Windows\System\KqUKkqp.exe
  2⤵
  PID:4752
- C:\Windows\System\fTljTmo.exe
  C:\Windows\System\fTljTmo.exe
  2⤵
  PID:4768
- C:\Windows\System\tIkKcRl.exe
  C:\Windows\System\tIkKcRl.exe
  2⤵
  PID:4784
- C:\Windows\System\jOXYqbU.exe
  C:\Windows\System\jOXYqbU.exe
  2⤵
  PID:4804
- C:\Windows\System\SZSuCdu.exe
  C:\Windows\System\SZSuCdu.exe
  2⤵
  PID:4820
- C:\Windows\System\nbVhdun.exe
  C:\Windows\System\nbVhdun.exe
  2⤵
  PID:4836
- C:\Windows\System\SXIljlz.exe
  C:\Windows\System\SXIljlz.exe
  2⤵
  PID:4876
- C:\Windows\System\KwuvbmY.exe
  C:\Windows\System\KwuvbmY.exe
  2⤵
  PID:4892
- C:\Windows\System\UTDyTUk.exe
  C:\Windows\System\UTDyTUk.exe
  2⤵
  PID:4908
- C:\Windows\System\aFEyKSa.exe
  C:\Windows\System\aFEyKSa.exe
  2⤵
  PID:4924
- C:\Windows\System\xikZUtT.exe
  C:\Windows\System\xikZUtT.exe
  2⤵
  PID:4940
- C:\Windows\System\egUVcWP.exe
  C:\Windows\System\egUVcWP.exe
  2⤵
  PID:4956
- C:\Windows\System\BeDuBlN.exe
  C:\Windows\System\BeDuBlN.exe
  2⤵
  PID:4972
- C:\Windows\System\KUpGhAU.exe
  C:\Windows\System\KUpGhAU.exe
  2⤵
  PID:4988
- C:\Windows\System\ZaiGCOO.exe
  C:\Windows\System\ZaiGCOO.exe
  2⤵
  PID:5004
- C:\Windows\System\coTYlEg.exe
  C:\Windows\System\coTYlEg.exe
  2⤵
  PID:5020
- C:\Windows\System\USXROLo.exe
  C:\Windows\System\USXROLo.exe
  2⤵
  PID:5036
- C:\Windows\System\VFvTTJl.exe
  C:\Windows\System\VFvTTJl.exe
  2⤵
  PID:5052
- C:\Windows\System\RDEhqyE.exe
  C:\Windows\System\RDEhqyE.exe
  2⤵
  PID:5068
- C:\Windows\System\CVFqpnP.exe
  C:\Windows\System\CVFqpnP.exe
  2⤵
  PID:5084
- C:\Windows\System\rxjNowL.exe
  C:\Windows\System\rxjNowL.exe
  2⤵
  PID:5100
- C:\Windows\System\zqxNpYO.exe
  C:\Windows\System\zqxNpYO.exe
  2⤵
  PID:5116
- C:\Windows\System\XrtPImS.exe
  C:\Windows\System\XrtPImS.exe
  2⤵
  PID:4044
- C:\Windows\System\GaVWyEX.exe
  C:\Windows\System\GaVWyEX.exe
  2⤵
  PID:3564
- C:\Windows\System\HaXDsQg.exe
  C:\Windows\System\HaXDsQg.exe
  2⤵
  PID:4144
- C:\Windows\System\WDsArmm.exe
  C:\Windows\System\WDsArmm.exe
  2⤵
  PID:2656
- C:\Windows\System\dXYrgPS.exe
  C:\Windows\System\dXYrgPS.exe
  2⤵
  PID:4208
- C:\Windows\System\XtOLwdD.exe
  C:\Windows\System\XtOLwdD.exe
  2⤵
  PID:4272
- C:\Windows\System\NhfpaiI.exe
  C:\Windows\System\NhfpaiI.exe
  2⤵
  PID:4336
- C:\Windows\System\nBYhLTv.exe
  C:\Windows\System\nBYhLTv.exe
  2⤵
  PID:2832
- C:\Windows\System\JXwlWky.exe
  C:\Windows\System\JXwlWky.exe
  2⤵
  PID:4348
- C:\Windows\System\IcmZJQK.exe
  C:\Windows\System\IcmZJQK.exe
  2⤵
  PID:2972
- C:\Windows\System\sYqQUgl.exe
  C:\Windows\System\sYqQUgl.exe
  2⤵
  PID:4764
- C:\Windows\System\aQMmGxM.exe
  C:\Windows\System\aQMmGxM.exe
  2⤵
  PID:4828
- C:\Windows\System\zQxDqSV.exe
  C:\Windows\System\zQxDqSV.exe
  2⤵
  PID:4884
- C:\Windows\System\ZmRXjjp.exe
  C:\Windows\System\ZmRXjjp.exe
  2⤵
  PID:4920
- C:\Windows\System\fRASnDr.exe
  C:\Windows\System\fRASnDr.exe
  2⤵
  PID:4980
- C:\Windows\System\OXFtYWj.exe
  C:\Windows\System\OXFtYWj.exe
  2⤵
  PID:2964
- C:\Windows\System\GwfJReV.exe
  C:\Windows\System\GwfJReV.exe
  2⤵
  PID:5128
- C:\Windows\System\PbhrpnC.exe
  C:\Windows\System\PbhrpnC.exe
  2⤵
  PID:5144
- C:\Windows\System\mcoeSFL.exe
  C:\Windows\System\mcoeSFL.exe
  2⤵
  PID:5160
- C:\Windows\System\YdSMpzb.exe
  C:\Windows\System\YdSMpzb.exe
  2⤵
  PID:5176
- C:\Windows\System\pBNWZGd.exe
  C:\Windows\System\pBNWZGd.exe
  2⤵
  PID:5192
- C:\Windows\System\jQLwLxc.exe
  C:\Windows\System\jQLwLxc.exe
  2⤵
  PID:5208
- C:\Windows\System\GFsIDsf.exe
  C:\Windows\System\GFsIDsf.exe
  2⤵
  PID:5224
- C:\Windows\System\NBnKfnj.exe
  C:\Windows\System\NBnKfnj.exe
  2⤵
  PID:5240
- C:\Windows\System\DgOCFAt.exe
  C:\Windows\System\DgOCFAt.exe
  2⤵
  PID:5256
- C:\Windows\System\UPqijyx.exe
  C:\Windows\System\UPqijyx.exe
  2⤵
  PID:5272
- C:\Windows\System\pHkOGcx.exe
  C:\Windows\System\pHkOGcx.exe
  2⤵
  PID:5288
- C:\Windows\System\LZIyYrH.exe
  C:\Windows\System\LZIyYrH.exe
  2⤵
  PID:5304
- C:\Windows\System\kfdszLz.exe
  C:\Windows\System\kfdszLz.exe
  2⤵
  PID:5320
- C:\Windows\System\oyIJjfr.exe
  C:\Windows\System\oyIJjfr.exe
  2⤵
  PID:5336
- C:\Windows\System\gJToSvB.exe
  C:\Windows\System\gJToSvB.exe
  2⤵
  PID:5352
- C:\Windows\System\JasAozg.exe
  C:\Windows\System\JasAozg.exe
  2⤵
  PID:5368
- C:\Windows\System\aNTMqlQ.exe
  C:\Windows\System\aNTMqlQ.exe
  2⤵
  PID:5384
- C:\Windows\System\DozuKUO.exe
  C:\Windows\System\DozuKUO.exe
  2⤵
  PID:5400
- C:\Windows\System\TOWmtEY.exe
  C:\Windows\System\TOWmtEY.exe
  2⤵
  PID:5416
- C:\Windows\System\LyqrSav.exe
  C:\Windows\System\LyqrSav.exe
  2⤵
  PID:5432
- C:\Windows\System\ElORAYb.exe
  C:\Windows\System\ElORAYb.exe
  2⤵
  PID:5448
- C:\Windows\System\aHuEtTp.exe
  C:\Windows\System\aHuEtTp.exe
  2⤵
  PID:5468
- C:\Windows\System\bPuHFhL.exe
  C:\Windows\System\bPuHFhL.exe
  2⤵
  PID:5484
- C:\Windows\System\RLClqVQ.exe
  C:\Windows\System\RLClqVQ.exe
  2⤵
  PID:5504
- C:\Windows\System\KATQtyY.exe
  C:\Windows\System\KATQtyY.exe
  2⤵
  PID:5524
- C:\Windows\System\wbIZQPs.exe
  C:\Windows\System\wbIZQPs.exe
  2⤵
  PID:5548
- C:\Windows\System\qVfIFRG.exe
  C:\Windows\System\qVfIFRG.exe
  2⤵
  PID:5564
- C:\Windows\System\asMzFEJ.exe
  C:\Windows\System\asMzFEJ.exe
  2⤵
  PID:5620
- C:\Windows\System\LIZyciF.exe
  C:\Windows\System\LIZyciF.exe
  2⤵
  PID:5636
- C:\Windows\System\CqmYBmT.exe
  C:\Windows\System\CqmYBmT.exe
  2⤵
  PID:5652
- C:\Windows\System\syjMvZE.exe
  C:\Windows\System\syjMvZE.exe
  2⤵
  PID:5668
- C:\Windows\System\TTkDdQl.exe
  C:\Windows\System\TTkDdQl.exe
  2⤵
  PID:5684
- C:\Windows\System\rXADIqI.exe
  C:\Windows\System\rXADIqI.exe
  2⤵
  PID:5700
- C:\Windows\System\IQAvRRu.exe
  C:\Windows\System\IQAvRRu.exe
  2⤵
  PID:5716
- C:\Windows\System\FddFvys.exe
  C:\Windows\System\FddFvys.exe
  2⤵
  PID:5732
- C:\Windows\System\wduBgwe.exe
  C:\Windows\System\wduBgwe.exe
  2⤵
  PID:5748
- C:\Windows\System\NijJBzR.exe
  C:\Windows\System\NijJBzR.exe
  2⤵
  PID:5764
- C:\Windows\System\mNjPKpV.exe
  C:\Windows\System\mNjPKpV.exe
  2⤵
  PID:5808
- C:\Windows\System\RHKIwMM.exe
  C:\Windows\System\RHKIwMM.exe
  2⤵
  PID:5844
- C:\Windows\System\IOygDDc.exe
  C:\Windows\System\IOygDDc.exe
  2⤵
  PID:5880
- C:\Windows\System\KTsnAYp.exe
  C:\Windows\System\KTsnAYp.exe
  2⤵
  PID:5916
- C:\Windows\System\eStzZai.exe
  C:\Windows\System\eStzZai.exe
  2⤵
  PID:5944
- C:\Windows\System\XxmKCaT.exe
  C:\Windows\System\XxmKCaT.exe
  2⤵
  PID:5964
- C:\Windows\System\anZnvEs.exe
  C:\Windows\System\anZnvEs.exe
  2⤵
  PID:5988
- C:\Windows\System\khhbmOf.exe
  C:\Windows\System\khhbmOf.exe
  2⤵
  PID:6008
- C:\Windows\System\snHTNEL.exe
  C:\Windows\System\snHTNEL.exe
  2⤵
  PID:6028
- C:\Windows\System\vhaaxMB.exe
  C:\Windows\System\vhaaxMB.exe
  2⤵
  PID:6048
- C:\Windows\System\EHzDHfG.exe
  C:\Windows\System\EHzDHfG.exe
  2⤵
  PID:6068
- C:\Windows\System\FcaZsUk.exe
  C:\Windows\System\FcaZsUk.exe
  2⤵
  PID:6088
- C:\Windows\System\umquVcq.exe
  C:\Windows\System\umquVcq.exe
  2⤵
  PID:6112
- C:\Windows\System\VJTWkrs.exe
  C:\Windows\System\VJTWkrs.exe
  2⤵
  PID:6136
- C:\Windows\System\rkKsAtA.exe
  C:\Windows\System\rkKsAtA.exe
  2⤵
  PID:1632
- C:\Windows\System\ZUDzeLG.exe
  C:\Windows\System\ZUDzeLG.exe
  2⤵
  PID:1588
- C:\Windows\System\sauJKRl.exe
  C:\Windows\System\sauJKRl.exe
  2⤵
  PID:5080
- C:\Windows\System\HeZCfyU.exe
  C:\Windows\System\HeZCfyU.exe
  2⤵
  PID:2756
- C:\Windows\System\SEWXNcy.exe
  C:\Windows\System\SEWXNcy.exe
  2⤵
  PID:4344
- C:\Windows\System\tQKRKuw.exe
  C:\Windows\System\tQKRKuw.exe
  2⤵
  PID:4796
- C:\Windows\System\kVPrZiR.exe
  C:\Windows\System\kVPrZiR.exe
  2⤵
  PID:5136
- C:\Windows\System\CBHLYJp.exe
  C:\Windows\System\CBHLYJp.exe
  2⤵
  PID:1704
- C:\Windows\System\scnjZGH.exe
  C:\Windows\System\scnjZGH.exe
  2⤵
  PID:2328
- C:\Windows\System\RjewXvh.exe
  C:\Windows\System\RjewXvh.exe
  2⤵
  PID:1776
- C:\Windows\System\GMaslIT.exe
  C:\Windows\System\GMaslIT.exe
  2⤵
  PID:1912
- C:\Windows\System\uunUGNk.exe
  C:\Windows\System\uunUGNk.exe
  2⤵
  PID:616
- C:\Windows\System\gqWQDOk.exe
  C:\Windows\System\gqWQDOk.exe
  2⤵
  PID:1656
- C:\Windows\System\isDSDEo.exe
  C:\Windows\System\isDSDEo.exe
  2⤵
  PID:1036
- C:\Windows\System\kBWpfOc.exe
  C:\Windows\System\kBWpfOc.exe
  2⤵
  PID:2232
- C:\Windows\System\MlDLXPo.exe
  C:\Windows\System\MlDLXPo.exe
  2⤵
  PID:1660
- C:\Windows\System\muSSRhq.exe
  C:\Windows\System\muSSRhq.exe
  2⤵
  PID:2400
- C:\Windows\System\eCSCLGx.exe
  C:\Windows\System\eCSCLGx.exe
  2⤵
  PID:1744
- C:\Windows\System\DYCgSxD.exe
  C:\Windows\System\DYCgSxD.exe
  2⤵
  PID:2568
- C:\Windows\System\RcmDOLq.exe
  C:\Windows\System\RcmDOLq.exe
  2⤵
  PID:3100
- C:\Windows\System\eDFCWIA.exe
  C:\Windows\System\eDFCWIA.exe
  2⤵
  PID:3192
- C:\Windows\System\Kfffylk.exe
  C:\Windows\System\Kfffylk.exe
  2⤵
  PID:3260
- C:\Windows\System\rhOYdSJ.exe
  C:\Windows\System\rhOYdSJ.exe
  2⤵
  PID:3352
- C:\Windows\System\vgVntVl.exe
  C:\Windows\System\vgVntVl.exe
  2⤵
  PID:3420
- C:\Windows\System\EmmoQin.exe
  C:\Windows\System\EmmoQin.exe
  2⤵
  PID:3512
- C:\Windows\System\msevefq.exe
  C:\Windows\System\msevefq.exe
  2⤵
  PID:3608
- C:\Windows\System\UusqaHT.exe
  C:\Windows\System\UusqaHT.exe
  2⤵
  PID:3672
- C:\Windows\System\gWAkZha.exe
  C:\Windows\System\gWAkZha.exe
  2⤵
  PID:3768
- C:\Windows\System\vIhOOcg.exe
  C:\Windows\System\vIhOOcg.exe
  2⤵
  PID:3836
- C:\Windows\System\gutWwAT.exe
  C:\Windows\System\gutWwAT.exe
  2⤵
  PID:3960
- C:\Windows\System\jjjgpse.exe
  C:\Windows\System\jjjgpse.exe
  2⤵
  PID:4028
- C:\Windows\System\SFaDOkN.exe
  C:\Windows\System\SFaDOkN.exe
  2⤵
  PID:4092
- C:\Windows\System\lhGStrB.exe
  C:\Windows\System\lhGStrB.exe
  2⤵
  PID:3272
- C:\Windows\System\FEfFseK.exe
  C:\Windows\System\FEfFseK.exe
  2⤵
  PID:3624
- C:\Windows\System\nUOFAMQ.exe
  C:\Windows\System\nUOFAMQ.exe
  2⤵
  PID:3880
- C:\Windows\System\UvQiqtc.exe
  C:\Windows\System\UvQiqtc.exe
  2⤵
  PID:3336
- C:\Windows\System\AKxOAXB.exe
  C:\Windows\System\AKxOAXB.exe
  2⤵
  PID:4132
- C:\Windows\System\wvExVfa.exe
  C:\Windows\System\wvExVfa.exe
  2⤵
  PID:4224
- C:\Windows\System\BlGKmfV.exe
  C:\Windows\System\BlGKmfV.exe
  2⤵
  PID:4292
- C:\Windows\System\KQTPZxy.exe
  C:\Windows\System\KQTPZxy.exe
  2⤵
  PID:4372
- C:\Windows\System\LnLuktY.exe
  C:\Windows\System\LnLuktY.exe
  2⤵
  PID:4396
- C:\Windows\System\ECZJRom.exe
  C:\Windows\System\ECZJRom.exe
  2⤵
  PID:4416
- C:\Windows\System\lmuFbyx.exe
  C:\Windows\System\lmuFbyx.exe
  2⤵
  PID:4436
- C:\Windows\System\ItsRIQr.exe
  C:\Windows\System\ItsRIQr.exe
  2⤵
  PID:4460
- C:\Windows\System\QbXSLwt.exe
  C:\Windows\System\QbXSLwt.exe
  2⤵
  PID:4480
- C:\Windows\System\sXFTjwR.exe
  C:\Windows\System\sXFTjwR.exe
  2⤵
  PID:4500
- C:\Windows\System\ANJDXQp.exe
  C:\Windows\System\ANJDXQp.exe
  2⤵
  PID:4516
- C:\Windows\System\TOVhydL.exe
  C:\Windows\System\TOVhydL.exe
  2⤵
  PID:4540
- C:\Windows\System\vHIjjYc.exe
  C:\Windows\System\vHIjjYc.exe
  2⤵
  PID:4560
- C:\Windows\System\gsKAxhk.exe
  C:\Windows\System\gsKAxhk.exe
  2⤵
  PID:4576
- C:\Windows\System\jZDFviW.exe
  C:\Windows\System\jZDFviW.exe
  2⤵
  PID:4600
- C:\Windows\System\mpYwsjY.exe
  C:\Windows\System\mpYwsjY.exe
  2⤵
  PID:4620
- C:\Windows\System\dLAXflz.exe
  C:\Windows\System\dLAXflz.exe
  2⤵
  PID:4640
- C:\Windows\System\eAHAYnf.exe
  C:\Windows\System\eAHAYnf.exe
  2⤵
  PID:4660
- C:\Windows\System\HtWUVDZ.exe
  C:\Windows\System\HtWUVDZ.exe
  2⤵
  PID:4680
- C:\Windows\System\jouFQiC.exe
  C:\Windows\System\jouFQiC.exe
  2⤵
  PID:4700
- C:\Windows\System\BKuFGeA.exe
  C:\Windows\System\BKuFGeA.exe
  2⤵
  PID:4716
- C:\Windows\System\kNGbJmE.exe
  C:\Windows\System\kNGbJmE.exe
  2⤵
  PID:4812
- C:\Windows\System\tpRdDjK.exe
  C:\Windows\System\tpRdDjK.exe
  2⤵
  PID:4868
- C:\Windows\System\IrQmOvV.exe
  C:\Windows\System\IrQmOvV.exe
  2⤵
  PID:4936
- C:\Windows\System\gnDBQfS.exe
  C:\Windows\System\gnDBQfS.exe
  2⤵
  PID:5060
- C:\Windows\System\nYYRaId.exe
  C:\Windows\System\nYYRaId.exe
  2⤵
  PID:5092
- C:\Windows\System\FLxIgsP.exe
  C:\Windows\System\FLxIgsP.exe
  2⤵
  PID:2468
- C:\Windows\System\oPcSSsP.exe
  C:\Windows\System\oPcSSsP.exe
  2⤵
  PID:1948
- C:\Windows\System\XkTyxMQ.exe
  C:\Windows\System\XkTyxMQ.exe
  2⤵
  PID:2052
- C:\Windows\System\vIiToTj.exe
  C:\Windows\System\vIiToTj.exe
  2⤵
  PID:5152
- C:\Windows\System\uzrktkt.exe
  C:\Windows\System\uzrktkt.exe
  2⤵
  PID:5248
- C:\Windows\System\PBCakBW.exe
  C:\Windows\System\PBCakBW.exe
  2⤵
  PID:5316
- C:\Windows\System\wOeCsHB.exe
  C:\Windows\System\wOeCsHB.exe
  2⤵
  PID:5408
- C:\Windows\System\KxtyMWl.exe
  C:\Windows\System\KxtyMWl.exe
  2⤵
  PID:5516
- C:\Windows\System\HEyClPQ.exe
  C:\Windows\System\HEyClPQ.exe
  2⤵
  PID:5660
- C:\Windows\System\oSGavgJ.exe
  C:\Windows\System\oSGavgJ.exe
  2⤵
  PID:5728
- C:\Windows\System\DWYrnYO.exe
  C:\Windows\System\DWYrnYO.exe
  2⤵
  PID:5816
- C:\Windows\System\cbtYnwj.exe
  C:\Windows\System\cbtYnwj.exe
  2⤵
  PID:5836
- C:\Windows\System\LSxMiYh.exe
  C:\Windows\System\LSxMiYh.exe
  2⤵
  PID:5900
- C:\Windows\System\vKRENGB.exe
  C:\Windows\System\vKRENGB.exe
  2⤵
  PID:5956
- C:\Windows\System\HHUTMpR.exe
  C:\Windows\System\HHUTMpR.exe
  2⤵
  PID:6036
- C:\Windows\System\jTJwnHn.exe
  C:\Windows\System\jTJwnHn.exe
  2⤵
  PID:6084
- C:\Windows\System\PFzROIw.exe
  C:\Windows\System\PFzROIw.exe
  2⤵
  PID:2984
- C:\Windows\System\efPBDrJ.exe
  C:\Windows\System\efPBDrJ.exe
  2⤵
  PID:3208
- C:\Windows\System\LpsnCgq.exe
  C:\Windows\System\LpsnCgq.exe
  2⤵
  PID:5172
- C:\Windows\System\SdiYZWL.exe
  C:\Windows\System\SdiYZWL.exe
  2⤵
  PID:5264
- C:\Windows\System\knukAmt.exe
  C:\Windows\System\knukAmt.exe
  2⤵
  PID:5332
- C:\Windows\System\JlgMySf.exe
  C:\Windows\System\JlgMySf.exe
  2⤵
  PID:5424
- C:\Windows\System\zMYrDWV.exe
  C:\Windows\System\zMYrDWV.exe
  2⤵
  PID:5496
- C:\Windows\System\IdkRZPa.exe
  C:\Windows\System\IdkRZPa.exe
  2⤵
  PID:5540
- C:\Windows\System\dVZwLNz.exe
  C:\Windows\System\dVZwLNz.exe
  2⤵
  PID:5588
- C:\Windows\System\VBQqmdz.exe
  C:\Windows\System\VBQqmdz.exe
  2⤵
  PID:5612
- C:\Windows\System\SkGXbUA.exe
  C:\Windows\System\SkGXbUA.exe
  2⤵
  PID:5648
- C:\Windows\System\KDicuvL.exe
  C:\Windows\System\KDicuvL.exe
  2⤵
  PID:5740
- C:\Windows\System\DBVIvdl.exe
  C:\Windows\System\DBVIvdl.exe
  2⤵
  PID:5784
- C:\Windows\System\jJwsktI.exe
  C:\Windows\System\jJwsktI.exe
  2⤵
  PID:5852
- C:\Windows\System\CSbJNvI.exe
  C:\Windows\System\CSbJNvI.exe
  2⤵
  PID:5876
- C:\Windows\System\OTEjjVV.exe
  C:\Windows\System\OTEjjVV.exe
  2⤵
  PID:5940
- C:\Windows\System\lLKYIcb.exe
  C:\Windows\System\lLKYIcb.exe
  2⤵
  PID:1824
- C:\Windows\System\oHYtZep.exe
  C:\Windows\System\oHYtZep.exe
  2⤵
  PID:2688
- C:\Windows\System\RFhwUHz.exe
  C:\Windows\System\RFhwUHz.exe
  2⤵
  PID:6096
- C:\Windows\System\cUnkJgW.exe
  C:\Windows\System\cUnkJgW.exe
  2⤵
  PID:2476
- C:\Windows\System\RhwuJwK.exe
  C:\Windows\System\RhwuJwK.exe
  2⤵
  PID:1920
- C:\Windows\System\XkwPHwG.exe
  C:\Windows\System\XkwPHwG.exe
  2⤵
  PID:4240
- C:\Windows\System\CFJvxqK.exe
  C:\Windows\System\CFJvxqK.exe
  2⤵
  PID:2724
- C:\Windows\System\jZiyWZi.exe
  C:\Windows\System\jZiyWZi.exe
  2⤵
  PID:2676
- C:\Windows\System\cJTlUGP.exe
  C:\Windows\System\cJTlUGP.exe
  2⤵
  PID:2740
- C:\Windows\System\KHADGzx.exe
  C:\Windows\System\KHADGzx.exe
  2⤵
  PID:2548
- C:\Windows\System\ucEAHut.exe
  C:\Windows\System\ucEAHut.exe
  2⤵
  PID:2916
- C:\Windows\System\StsiNMk.exe
  C:\Windows\System\StsiNMk.exe
  2⤵
  PID:1336
- C:\Windows\System\sBMOTMz.exe
  C:\Windows\System\sBMOTMz.exe
  2⤵
  PID:2844
- C:\Windows\System\ClfBtKz.exe
  C:\Windows\System\ClfBtKz.exe
  2⤵
  PID:1096
- C:\Windows\System\gLAeHBl.exe
  C:\Windows\System\gLAeHBl.exe
  2⤵
  PID:2260
- C:\Windows\System\BCvmrFp.exe
  C:\Windows\System\BCvmrFp.exe
  2⤵
  PID:1040
- C:\Windows\System\uPskCWm.exe
  C:\Windows\System\uPskCWm.exe
  2⤵
  PID:2872
- C:\Windows\System\ZnSgCyp.exe
  C:\Windows\System\ZnSgCyp.exe
  2⤵
  PID:2852
- C:\Windows\System\RDMXehi.exe
  C:\Windows\System\RDMXehi.exe
  2⤵
  PID:3128
- C:\Windows\System\xMnlBWN.exe
  C:\Windows\System\xMnlBWN.exe
  2⤵
  PID:2952
- C:\Windows\System\DMrtBRa.exe
  C:\Windows\System\DMrtBRa.exe
  2⤵
  PID:3256
- C:\Windows\System\qFtHsNy.exe
  C:\Windows\System\qFtHsNy.exe
  2⤵
  PID:3388
- C:\Windows\System\adAitUF.exe
  C:\Windows\System\adAitUF.exe
  2⤵
  PID:3544
- C:\Windows\System\zoHvlkA.exe
  C:\Windows\System\zoHvlkA.exe
  2⤵
  PID:3832
- C:\Windows\System\mmzQVEm.exe
  C:\Windows\System\mmzQVEm.exe
  2⤵
  PID:3740
- C:\Windows\System\nSvHoBY.exe
  C:\Windows\System\nSvHoBY.exe
  2⤵
  PID:2956
- C:\Windows\System\DEyuugh.exe
  C:\Windows\System\DEyuugh.exe
  2⤵
  PID:3116
- C:\Windows\System\zSiuxCx.exe
  C:\Windows\System\zSiuxCx.exe
  2⤵
  PID:3400
- C:\Windows\System\muRofEM.exe
  C:\Windows\System\muRofEM.exe
  2⤵
  PID:3500
- C:\Windows\System\sruZPpZ.exe
  C:\Windows\System\sruZPpZ.exe
  2⤵
  PID:4100
- C:\Windows\System\FKEsyot.exe
  C:\Windows\System\FKEsyot.exe
  2⤵
  PID:4256
- C:\Windows\System\JBAluKc.exe
  C:\Windows\System\JBAluKc.exe
  2⤵
  PID:4260
- C:\Windows\System\uSAqYfg.exe
  C:\Windows\System\uSAqYfg.exe
  2⤵
  PID:2960
- C:\Windows\System\nNqOGql.exe
  C:\Windows\System\nNqOGql.exe
  2⤵
  PID:4404
- C:\Windows\System\QJXbaeB.exe
  C:\Windows\System\QJXbaeB.exe
  2⤵
  PID:4452
- C:\Windows\System\AhfRiSC.exe
  C:\Windows\System\AhfRiSC.exe
  2⤵
  PID:4488
- C:\Windows\System\QTJPfEZ.exe
  C:\Windows\System\QTJPfEZ.exe
  2⤵
  PID:4512
- C:\Windows\System\FJeJFpE.exe
  C:\Windows\System\FJeJFpE.exe
  2⤵
  PID:4532
- C:\Windows\System\ClDxiMv.exe
  C:\Windows\System\ClDxiMv.exe
  2⤵
  PID:4592
- C:\Windows\System\PJSnpcJ.exe
  C:\Windows\System\PJSnpcJ.exe
  2⤵
  PID:4568
- C:\Windows\System\fUcBhsp.exe
  C:\Windows\System\fUcBhsp.exe
  2⤵
  PID:4648
- C:\Windows\System\SiJiUFb.exe
  C:\Windows\System\SiJiUFb.exe
  2⤵
  PID:4672
- C:\Windows\System\xGluuRz.exe
  C:\Windows\System\xGluuRz.exe
  2⤵
  PID:4712
- C:\Windows\System\CpsnkpC.exe
  C:\Windows\System\CpsnkpC.exe
  2⤵
  PID:4696
- C:\Windows\System\xrhmNwi.exe
  C:\Windows\System\xrhmNwi.exe
  2⤵
  PID:4780
- C:\Windows\System\GDuXJmA.exe
  C:\Windows\System\GDuXJmA.exe
  2⤵
  PID:4932
- C:\Windows\System\ZdXjPZU.exe
  C:\Windows\System\ZdXjPZU.exe
  2⤵
  PID:5064
- C:\Windows\System\IvoqxYQ.exe
  C:\Windows\System\IvoqxYQ.exe
  2⤵
  PID:5216
- C:\Windows\System\JDmYMCV.exe
  C:\Windows\System\JDmYMCV.exe
  2⤵
  PID:4952
- C:\Windows\System\fwRXgpF.exe
  C:\Windows\System\fwRXgpF.exe
  2⤵
  PID:5376
- C:\Windows\System\GOCyICD.exe
  C:\Windows\System\GOCyICD.exe
  2⤵
  PID:5444
- C:\Windows\System\ERZogJi.exe
  C:\Windows\System\ERZogJi.exe
  2⤵
  PID:5724
- C:\Windows\System\pjjufur.exe
  C:\Windows\System\pjjufur.exe
  2⤵
  PID:5756
- C:\Windows\System\AgFUKIh.exe
  C:\Windows\System\AgFUKIh.exe
  2⤵
  PID:5896
- C:\Windows\System\dhIomup.exe
  C:\Windows\System\dhIomup.exe
  2⤵
  PID:5908
- C:\Windows\System\nXbwina.exe
  C:\Windows\System\nXbwina.exe
  2⤵
  PID:5912
- C:\Windows\System\FHXbJMO.exe
  C:\Windows\System\FHXbJMO.exe
  2⤵
  PID:6044
- C:\Windows\System\XBklpGk.exe
  C:\Windows\System\XBklpGk.exe
  2⤵
  PID:5112
- C:\Windows\System\HkCmDOi.exe
  C:\Windows\System\HkCmDOi.exe
  2⤵
  PID:5296
- C:\Windows\System\cTpZeOm.exe
  C:\Windows\System\cTpZeOm.exe
  2⤵
  PID:5328
- C:\Windows\System\vsnnrMj.exe
  C:\Windows\System\vsnnrMj.exe
  2⤵
  PID:5392
- C:\Windows\System\jSnlYCr.exe
  C:\Windows\System\jSnlYCr.exe
  2⤵
  PID:5576
- C:\Windows\System\NnWYnXS.exe
  C:\Windows\System\NnWYnXS.exe
  2⤵
  PID:5604
- C:\Windows\System\wromIbv.exe
  C:\Windows\System\wromIbv.exe
  2⤵
  PID:5780
- C:\Windows\System\EAkvInW.exe
  C:\Windows\System\EAkvInW.exe
  2⤵
  PID:5868
- C:\Windows\System\fRTzfZd.exe
  C:\Windows\System\fRTzfZd.exe
  2⤵
  PID:5788
- C:\Windows\System\MPKMDDC.exe
  C:\Windows\System\MPKMDDC.exe
  2⤵
  PID:6016
- C:\Windows\System\yCSZddf.exe
  C:\Windows\System\yCSZddf.exe
  2⤵
  PID:6104
- C:\Windows\System\SZaXgIL.exe
  C:\Windows\System\SZaXgIL.exe
  2⤵
  PID:5012
- C:\Windows\System\IXMjcXJ.exe
  C:\Windows\System\IXMjcXJ.exe
  2⤵
  PID:4244
- C:\Windows\System\dTOgsYZ.exe
  C:\Windows\System\dTOgsYZ.exe
  2⤵
  PID:2416
- C:\Windows\System\CXxfByC.exe
  C:\Windows\System\CXxfByC.exe
  2⤵
  PID:1616
- C:\Windows\System\imCnalG.exe
  C:\Windows\System\imCnalG.exe
  2⤵
  PID:2636
- C:\Windows\System\WdqLeOP.exe
  C:\Windows\System\WdqLeOP.exe
  2⤵
  PID:712
- C:\Windows\System\nWsEOzO.exe
  C:\Windows\System\nWsEOzO.exe
  2⤵
  PID:2892
- C:\Windows\System\XGqmaNY.exe
  C:\Windows\System\XGqmaNY.exe
  2⤵
  PID:844
- C:\Windows\System\UwKUtEP.exe
  C:\Windows\System\UwKUtEP.exe
  2⤵
  PID:1392
- C:\Windows\System\GrSHXRZ.exe
  C:\Windows\System\GrSHXRZ.exe
  2⤵
  PID:2380
- C:\Windows\System\ZSxmRER.exe
  C:\Windows\System\ZSxmRER.exe
  2⤵
  PID:3324
- C:\Windows\System\Kdbvaqc.exe
  C:\Windows\System\Kdbvaqc.exe
  2⤵
  PID:3228
- C:\Windows\System\rjzZcoX.exe
  C:\Windows\System\rjzZcoX.exe
  2⤵
  PID:3896
- C:\Windows\System\qIAFFAX.exe
  C:\Windows\System\qIAFFAX.exe
  2⤵
  PID:4024
- C:\Windows\System\xwEtupK.exe
  C:\Windows\System\xwEtupK.exe
  2⤵
  PID:3752
- C:\Windows\System\MlgpWfq.exe
  C:\Windows\System\MlgpWfq.exe
  2⤵
  PID:5584
- C:\Windows\System\cTVAZpF.exe
  C:\Windows\System\cTVAZpF.exe
  2⤵
  PID:4192
- C:\Windows\System\wOiVljU.exe
  C:\Windows\System\wOiVljU.exe
  2⤵
  PID:4364
- C:\Windows\System\oWIOlNH.exe
  C:\Windows\System\oWIOlNH.exe
  2⤵
  PID:2268
- C:\Windows\System\MQwJRbs.exe
  C:\Windows\System\MQwJRbs.exe
  2⤵
  PID:2240
- C:\Windows\System\nJneaRn.exe
  C:\Windows\System\nJneaRn.exe
  2⤵
  PID:2504
- C:\Windows\System\HIpjCAZ.exe
  C:\Windows\System\HIpjCAZ.exe
  2⤵
  PID:4428
- C:\Windows\System\GCxuKWI.exe
  C:\Windows\System\GCxuKWI.exe
  2⤵
  PID:4552
- C:\Windows\System\BqxUFFs.exe
  C:\Windows\System\BqxUFFs.exe
  2⤵
  PID:4472
- C:\Windows\System\IXCjKuJ.exe
  C:\Windows\System\IXCjKuJ.exe
  2⤵
  PID:4112
- C:\Windows\System\CcuqxrX.exe
  C:\Windows\System\CcuqxrX.exe
  2⤵
  PID:2324
- C:\Windows\System\yJecbnv.exe
  C:\Windows\System\yJecbnv.exe
  2⤵
  PID:4116
- C:\Windows\System\jtNGlFn.exe
  C:\Windows\System\jtNGlFn.exe
  2⤵
  PID:3916
- C:\Windows\System\diminWb.exe
  C:\Windows\System\diminWb.exe
  2⤵
  PID:5220
- C:\Windows\System\qjBGkee.exe
  C:\Windows\System\qjBGkee.exe
  2⤵
  PID:5628
- C:\Windows\System\IcLajYD.exe
  C:\Windows\System\IcLajYD.exe
  2⤵
  PID:4732
- C:\Windows\System\rTsxBJV.exe
  C:\Windows\System\rTsxBJV.exe
  2⤵
  PID:4760
- C:\Windows\System\xzkTvRA.exe
  C:\Windows\System\xzkTvRA.exe
  2⤵
  PID:2944
- C:\Windows\System\GulOOYs.exe
  C:\Windows\System\GulOOYs.exe
  2⤵
  PID:5124
- C:\Windows\System\ZvZFSWY.exe
  C:\Windows\System\ZvZFSWY.exe
  2⤵
  PID:5616
- C:\Windows\System\cUzpvXw.exe
  C:\Windows\System\cUzpvXw.exe
  2⤵
  PID:5864
- C:\Windows\System\FaeyWUH.exe
  C:\Windows\System\FaeyWUH.exe
  2⤵
  PID:3032
- C:\Windows\System\Aeivyjd.exe
  C:\Windows\System\Aeivyjd.exe
  2⤵
  PID:6004
- C:\Windows\System\WLtUVBR.exe
  C:\Windows\System\WLtUVBR.exe
  2⤵
  PID:1516
- C:\Windows\System\lBGkJxi.exe
  C:\Windows\System\lBGkJxi.exe
  2⤵
  PID:5204
- C:\Windows\System\qcuAKru.exe
  C:\Windows\System\qcuAKru.exe
  2⤵
  PID:5500
- C:\Windows\System\PyKtIqI.exe
  C:\Windows\System\PyKtIqI.exe
  2⤵
  PID:2928
- C:\Windows\System\oGTYgWD.exe
  C:\Windows\System\oGTYgWD.exe
  2⤵
  PID:896
- C:\Windows\System\ypktNDN.exe
  C:\Windows\System\ypktNDN.exe
  2⤵
  PID:5772
- C:\Windows\System\cpVebYr.exe
  C:\Windows\System\cpVebYr.exe
  2⤵
  PID:6060
- C:\Windows\System\xljeMMk.exe
  C:\Windows\System\xljeMMk.exe
  2⤵
  PID:864
- C:\Windows\System\PEYkhsx.exe
  C:\Windows\System\PEYkhsx.exe
  2⤵
  PID:4320
- C:\Windows\System\BXsIuIx.exe
  C:\Windows\System\BXsIuIx.exe
  2⤵
  PID:2056
- C:\Windows\System\SuCcEzE.exe
  C:\Windows\System\SuCcEzE.exe
  2⤵
  PID:3800
- C:\Windows\System\dYtfnqc.exe
  C:\Windows\System\dYtfnqc.exe
  2⤵
  PID:2684
- C:\Windows\System\OSZaDUA.exe
  C:\Windows\System\OSZaDUA.exe
  2⤵
  PID:2484
- C:\Windows\System\WRXLtNG.exe
  C:\Windows\System\WRXLtNG.exe
  2⤵
  PID:2460
- C:\Windows\System\jiphrPC.exe
  C:\Windows\System\jiphrPC.exe
  2⤵
  PID:3804
- C:\Windows\System\hREFvwp.exe
  C:\Windows\System\hREFvwp.exe
  2⤵
  PID:3756
- C:\Windows\System\VaxPPsJ.exe
  C:\Windows\System\VaxPPsJ.exe
  2⤵
  PID:4088
- C:\Windows\System\AdUAOxF.exe
  C:\Windows\System\AdUAOxF.exe
  2⤵
  PID:2696
- C:\Windows\System\uDiuMZs.exe
  C:\Windows\System\uDiuMZs.exe
  2⤵
  PID:4492
- C:\Windows\System\mcVyfqg.exe
  C:\Windows\System\mcVyfqg.exe
  2⤵
  PID:4392
- C:\Windows\System\HwvILVL.exe
  C:\Windows\System\HwvILVL.exe
  2⤵
  PID:4508
- C:\Windows\System\fvJtQbD.exe
  C:\Windows\System\fvJtQbD.exe
  2⤵
  PID:2996
- C:\Windows\System\DstEPmR.exe
  C:\Windows\System\DstEPmR.exe
  2⤵
  PID:1296
- C:\Windows\System\yPaPOJs.exe
  C:\Windows\System\yPaPOJs.exe
  2⤵
  PID:4968
- C:\Windows\System\QfTeCTb.exe
  C:\Windows\System\QfTeCTb.exe
  2⤵
  PID:4632
- C:\Windows\System\SJwVySh.exe
  C:\Windows\System\SJwVySh.exe
  2⤵
  PID:4368
- C:\Windows\System\MFulBnH.exe
  C:\Windows\System\MFulBnH.exe
  2⤵
  PID:4608
- C:\Windows\System\zneZSGd.exe
  C:\Windows\System\zneZSGd.exe
  2⤵
  PID:4308
- C:\Windows\System\PspiszE.exe
  C:\Windows\System\PspiszE.exe
  2⤵
  PID:4456
- C:\Windows\System\ZBZizAA.exe
  C:\Windows\System\ZBZizAA.exe
  2⤵
  PID:5048
- C:\Windows\System\JtxDQbe.exe
  C:\Windows\System\JtxDQbe.exe
  2⤵
  PID:5312
- C:\Windows\System\erNIAnZ.exe
  C:\Windows\System\erNIAnZ.exe
  2⤵
  PID:2216
- C:\Windows\System\uCYflfk.exe
  C:\Windows\System\uCYflfk.exe
  2⤵
  PID:1716
- C:\Windows\System\lszxbdU.exe
  C:\Windows\System\lszxbdU.exe
  2⤵
  PID:1420
- C:\Windows\System\rCirNFW.exe
  C:\Windows\System\rCirNFW.exe
  2⤵
  PID:2060
- C:\Windows\System\tzcgoXz.exe
  C:\Windows\System\tzcgoXz.exe
  2⤵
  PID:636
- C:\Windows\System\uJUvtUD.exe
  C:\Windows\System\uJUvtUD.exe
  2⤵
  PID:2124
- C:\Windows\System\XQrkLOT.exe
  C:\Windows\System\XQrkLOT.exe
  2⤵
  PID:2624
- C:\Windows\System\xleMzCK.exe
  C:\Windows\System\xleMzCK.exe
  2⤵
  PID:3736
- C:\Windows\System\MRPuaUz.exe
  C:\Windows\System\MRPuaUz.exe
  2⤵
  PID:1308
- C:\Windows\System\kryTNUL.exe
  C:\Windows\System\kryTNUL.exe
  2⤵
  PID:1800
- C:\Windows\System\RQMsuYg.exe
  C:\Windows\System\RQMsuYg.exe
  2⤵
  PID:2196
- C:\Windows\System\hWwRsXv.exe
  C:\Windows\System\hWwRsXv.exe
  2⤵
  PID:4656
- C:\Windows\System\fhxNJpf.exe
  C:\Windows\System\fhxNJpf.exe
  2⤵
  PID:6128
- C:\Windows\System\RySKkPn.exe
  C:\Windows\System\RySKkPn.exe
  2⤵
  PID:5456
- C:\Windows\System\FrvlTIw.exe
  C:\Windows\System\FrvlTIw.exe
  2⤵
  PID:5520
- C:\Windows\System\eRtfOBK.exe
  C:\Windows\System\eRtfOBK.exe
  2⤵
  PID:5000
- C:\Windows\System\wSxvjuF.exe
  C:\Windows\System\wSxvjuF.exe
  2⤵
  PID:5572
- C:\Windows\System\ofQVqXo.exe
  C:\Windows\System\ofQVqXo.exe
  2⤵
  PID:4128
- C:\Windows\System\QWLwIAI.exe
  C:\Windows\System\QWLwIAI.exe
  2⤵
  PID:1136
- C:\Windows\System\lwwmSNO.exe
  C:\Windows\System\lwwmSNO.exe
  2⤵
  PID:5984
- C:\Windows\System\pvyBWZq.exe
  C:\Windows\System\pvyBWZq.exe
  2⤵
  PID:3644
- C:\Windows\System\WMpQWUk.exe
  C:\Windows\System\WMpQWUk.exe
  2⤵
  PID:4444
- C:\Windows\System\ywiPJuF.exe
  C:\Windows\System\ywiPJuF.exe
  2⤵
  PID:3640
- C:\Windows\System\iZzYvdn.exe
  C:\Windows\System\iZzYvdn.exe
  2⤵
  PID:5184
- C:\Windows\System\RlmIEbC.exe
  C:\Windows\System\RlmIEbC.exe
  2⤵
  PID:4900
- C:\Windows\System\GghoxZu.exe
  C:\Windows\System\GghoxZu.exe
  2⤵
  PID:2104
- C:\Windows\System\XAzJDsW.exe
  C:\Windows\System\XAzJDsW.exe
  2⤵
  PID:5936
- C:\Windows\System\vjIvpUu.exe
  C:\Windows\System\vjIvpUu.exe
  2⤵
  PID:5644
- C:\Windows\System\cCXeTOx.exe
  C:\Windows\System\cCXeTOx.exe
  2⤵
  PID:6148
- C:\Windows\System\jgQtIKI.exe
  C:\Windows\System\jgQtIKI.exe
  2⤵
  PID:6168
- C:\Windows\System\tsGwwUW.exe
  C:\Windows\System\tsGwwUW.exe
  2⤵
  PID:6184
- C:\Windows\System\SCaaatJ.exe
  C:\Windows\System\SCaaatJ.exe
  2⤵
  PID:6200
- C:\Windows\System\fGsgbPG.exe
  C:\Windows\System\fGsgbPG.exe
  2⤵
  PID:6220
- C:\Windows\System\slsscRc.exe
  C:\Windows\System\slsscRc.exe
  2⤵
  PID:6236
- C:\Windows\System\vqXEBRH.exe
  C:\Windows\System\vqXEBRH.exe
  2⤵
  PID:6256
- C:\Windows\System\AstfFfF.exe
  C:\Windows\System\AstfFfF.exe
  2⤵
  PID:6276
- C:\Windows\System\naGhUKS.exe
  C:\Windows\System\naGhUKS.exe
  2⤵
  PID:6296
- C:\Windows\System\HnUJQlF.exe
  C:\Windows\System\HnUJQlF.exe
  2⤵
  PID:6316
- C:\Windows\System\rIlczfJ.exe
  C:\Windows\System\rIlczfJ.exe
  2⤵
  PID:6332
- C:\Windows\System\KWWGVGP.exe
  C:\Windows\System\KWWGVGP.exe
  2⤵
  PID:6352
- C:\Windows\System\zZLimta.exe
  C:\Windows\System\zZLimta.exe
  2⤵
  PID:6372
- C:\Windows\System\vvsBalx.exe
  C:\Windows\System\vvsBalx.exe
  2⤵
  PID:6388
- C:\Windows\System\LThKFvm.exe
  C:\Windows\System\LThKFvm.exe
  2⤵
  PID:6412
- C:\Windows\System\XQlaglf.exe
  C:\Windows\System\XQlaglf.exe
  2⤵
  PID:6428
- C:\Windows\System\ACkZDHI.exe
  C:\Windows\System\ACkZDHI.exe
  2⤵
  PID:6448
- C:\Windows\System\AebVDDB.exe
  C:\Windows\System\AebVDDB.exe
  2⤵
  PID:6468
- C:\Windows\System\tyknWMB.exe
  C:\Windows\System\tyknWMB.exe
  2⤵
  PID:6484
- C:\Windows\System\rkJJWtL.exe
  C:\Windows\System\rkJJWtL.exe
  2⤵
  PID:6500
- C:\Windows\System\zkSBONt.exe
  C:\Windows\System\zkSBONt.exe
  2⤵
  PID:6516
- C:\Windows\System\CVOLnJF.exe
  C:\Windows\System\CVOLnJF.exe
  2⤵
  PID:6532
- C:\Windows\System\rZKZVgp.exe
  C:\Windows\System\rZKZVgp.exe
  2⤵
  PID:6548
- C:\Windows\System\GtXmwHI.exe
  C:\Windows\System\GtXmwHI.exe
  2⤵
  PID:6564
- C:\Windows\System\fPuNPCZ.exe
  C:\Windows\System\fPuNPCZ.exe
  2⤵
  PID:6580
- C:\Windows\System\KNpUNtc.exe
  C:\Windows\System\KNpUNtc.exe
  2⤵
  PID:6596
- C:\Windows\System\RecghdX.exe
  C:\Windows\System\RecghdX.exe
  2⤵
  PID:6612
- C:\Windows\System\LxecPkV.exe
  C:\Windows\System\LxecPkV.exe
  2⤵
  PID:6628
- C:\Windows\System\ZkjKPjq.exe
  C:\Windows\System\ZkjKPjq.exe
  2⤵
  PID:6644
- C:\Windows\System\rQnUGSc.exe
  C:\Windows\System\rQnUGSc.exe
  2⤵
  PID:6660
- C:\Windows\System\ruWMmys.exe
  C:\Windows\System\ruWMmys.exe
  2⤵
  PID:6676
- C:\Windows\System\GBnoITz.exe
  C:\Windows\System\GBnoITz.exe
  2⤵
  PID:6692
- C:\Windows\System\NKIWTgL.exe
  C:\Windows\System\NKIWTgL.exe
  2⤵
  PID:6708
- C:\Windows\System\GmkJHjl.exe
  C:\Windows\System\GmkJHjl.exe
  2⤵
  PID:6724
- C:\Windows\System\cWWRGfe.exe
  C:\Windows\System\cWWRGfe.exe
  2⤵
  PID:6740
- C:\Windows\System\rJEyLBI.exe
  C:\Windows\System\rJEyLBI.exe
  2⤵
  PID:6756
- C:\Windows\System\GcSWouF.exe
  C:\Windows\System\GcSWouF.exe
  2⤵
  PID:6772
- C:\Windows\System\zYTAEXk.exe
  C:\Windows\System\zYTAEXk.exe
  2⤵
  PID:6788
- C:\Windows\System\awcOwcC.exe
  C:\Windows\System\awcOwcC.exe
  2⤵
  PID:6804
- C:\Windows\System\PNnuLYF.exe
  C:\Windows\System\PNnuLYF.exe
  2⤵
  PID:6820
- C:\Windows\System\VoFgqwr.exe
  C:\Windows\System\VoFgqwr.exe
  2⤵
  PID:6836
- C:\Windows\System\fXkpcyg.exe
  C:\Windows\System\fXkpcyg.exe
  2⤵
  PID:6852
- C:\Windows\System\lWtavzY.exe
  C:\Windows\System\lWtavzY.exe
  2⤵
  PID:6868
- C:\Windows\System\GcjRavO.exe
  C:\Windows\System\GcjRavO.exe
  2⤵
  PID:6884
- C:\Windows\System\rhjwdWP.exe
  C:\Windows\System\rhjwdWP.exe
  2⤵
  PID:6900
- C:\Windows\System\gMQHIjA.exe
  C:\Windows\System\gMQHIjA.exe
  2⤵
  PID:6916
- C:\Windows\System\tgfJTEQ.exe
  C:\Windows\System\tgfJTEQ.exe
  2⤵
  PID:6932
- C:\Windows\System\qRpBVCw.exe
  C:\Windows\System\qRpBVCw.exe
  2⤵
  PID:6948
- C:\Windows\System\xSknlus.exe
  C:\Windows\System\xSknlus.exe
  2⤵
  PID:6964
- C:\Windows\System\PSVPUTX.exe
  C:\Windows\System\PSVPUTX.exe
  2⤵
  PID:6980
- C:\Windows\System\CyCpAyG.exe
  C:\Windows\System\CyCpAyG.exe
  2⤵
  PID:6996
- C:\Windows\System\fTXjnlN.exe
  C:\Windows\System\fTXjnlN.exe
  2⤵
  PID:7012
- C:\Windows\System\cXRgFVc.exe
  C:\Windows\System\cXRgFVc.exe
  2⤵
  PID:7028
- C:\Windows\System\gFtuiog.exe
  C:\Windows\System\gFtuiog.exe
  2⤵
  PID:7044
- C:\Windows\System\VpgHASp.exe
  C:\Windows\System\VpgHASp.exe
  2⤵
  PID:7060
- C:\Windows\System\jAfWFnR.exe
  C:\Windows\System\jAfWFnR.exe
  2⤵
  PID:7076
- C:\Windows\System\vgZscPm.exe
  C:\Windows\System\vgZscPm.exe
  2⤵
  PID:7092
- C:\Windows\System\XXBJjrE.exe
  C:\Windows\System\XXBJjrE.exe
  2⤵
  PID:7108
- C:\Windows\System\wQtpEAX.exe
  C:\Windows\System\wQtpEAX.exe
  2⤵
  PID:7124
- C:\Windows\System\ZELGnTk.exe
  C:\Windows\System\ZELGnTk.exe
  2⤵
  PID:7140
- C:\Windows\System\QCPCTGW.exe
  C:\Windows\System\QCPCTGW.exe
  2⤵
  PID:7156
- C:\Windows\System\RKPtKSu.exe
  C:\Windows\System\RKPtKSu.exe
  2⤵
  PID:2824
- C:\Windows\System\WumfSuM.exe
  C:\Windows\System\WumfSuM.exe
  2⤵
  PID:2808
- C:\Windows\System\VaCEpBf.exe
  C:\Windows\System\VaCEpBf.exe
  2⤵
  PID:6244
- C:\Windows\System\hLVwNdj.exe
  C:\Windows\System\hLVwNdj.exe
  2⤵
  PID:6212
- C:\Windows\System\KxECUrg.exe
  C:\Windows\System\KxECUrg.exe
  2⤵
  PID:6292
- C:\Windows\System\WvBvTGv.exe
  C:\Windows\System\WvBvTGv.exe
  2⤵
  PID:6364
- C:\Windows\System\BnuYnUB.exe
  C:\Windows\System\BnuYnUB.exe
  2⤵
  PID:6400
- C:\Windows\System\JZfiSEm.exe
  C:\Windows\System\JZfiSEm.exe
  2⤵
  PID:6436
- C:\Windows\System\MGjTodY.exe
  C:\Windows\System\MGjTodY.exe
  2⤵
  PID:6108
- C:\Windows\System\flTSGUJ.exe
  C:\Windows\System\flTSGUJ.exe
  2⤵
  PID:2264
- C:\Windows\System\eMMqKNn.exe
  C:\Windows\System\eMMqKNn.exe
  2⤵
  PID:1584
- C:\Windows\System\wEUMTRg.exe
  C:\Windows\System\wEUMTRg.exe
  2⤵
  PID:6540
- C:\Windows\System\WDDDheG.exe
  C:\Windows\System\WDDDheG.exe
  2⤵
  PID:2136
- C:\Windows\System\EKXdLZQ.exe
  C:\Windows\System\EKXdLZQ.exe
  2⤵
  PID:6572
- C:\Windows\System\CYTFwHP.exe
  C:\Windows\System\CYTFwHP.exe
  2⤵
  PID:4856
- C:\Windows\System\KBIaCLT.exe
  C:\Windows\System\KBIaCLT.exe
  2⤵
  PID:6672
- C:\Windows\System\UdjIEeJ.exe
  C:\Windows\System\UdjIEeJ.exe
  2⤵
  PID:6736
- C:\Windows\System\TIiKQBo.exe
  C:\Windows\System\TIiKQBo.exe
  2⤵
  PID:2016
- C:\Windows\System\onSeqpO.exe
  C:\Windows\System\onSeqpO.exe
  2⤵
  PID:2788
- C:\Windows\System\RJitfxp.exe
  C:\Windows\System\RJitfxp.exe
  2⤵
  PID:1664
- C:\Windows\System\qGbYEwL.exe
  C:\Windows\System\qGbYEwL.exe
  2⤵
  PID:6076
- C:\Windows\System\IzmDpNb.exe
  C:\Windows\System\IzmDpNb.exe
  2⤵
  PID:4636
- C:\Windows\System\qGVYAfR.exe
  C:\Windows\System\qGVYAfR.exe
  2⤵
  PID:4612
- C:\Windows\System\yHumobT.exe
  C:\Windows\System\yHumobT.exe
  2⤵
  PID:6588
- C:\Windows\System\RugBwxa.exe
  C:\Windows\System\RugBwxa.exe
  2⤵
  PID:6624
- C:\Windows\System\zeCxVLL.exe
  C:\Windows\System\zeCxVLL.exe
  2⤵
  PID:6160
- C:\Windows\System\OnlLOYf.exe
  C:\Windows\System\OnlLOYf.exe
  2⤵
  PID:6228
- C:\Windows\System\KROWSZo.exe
  C:\Windows\System\KROWSZo.exe
  2⤵
  PID:6272
- C:\Windows\System\hxDtVCU.exe
  C:\Windows\System\hxDtVCU.exe
  2⤵
  PID:6340
- C:\Windows\System\DlHBtod.exe
  C:\Windows\System\DlHBtod.exe
  2⤵
  PID:6384
- C:\Windows\System\hzuCbKn.exe
  C:\Windows\System\hzuCbKn.exe
  2⤵
  PID:6828
- C:\Windows\System\cpJjTDm.exe
  C:\Windows\System\cpJjTDm.exe
  2⤵
  PID:6656
- C:\Windows\System\IzbYJpb.exe
  C:\Windows\System\IzbYJpb.exe
  2⤵
  PID:6592
- C:\Windows\System\TtOtnSF.exe
  C:\Windows\System\TtOtnSF.exe
  2⤵
  PID:6524
- C:\Windows\System\MsZzdUS.exe
  C:\Windows\System\MsZzdUS.exe
  2⤵
  PID:6720
- C:\Windows\System\oGBqoyp.exe
  C:\Windows\System\oGBqoyp.exe
  2⤵
  PID:6784
- C:\Windows\System\dzRFoKK.exe
  C:\Windows\System\dzRFoKK.exe
  2⤵
  PID:6860
- C:\Windows\System\HukoAwD.exe
  C:\Windows\System\HukoAwD.exe
  2⤵
  PID:6880
- C:\Windows\System\PfRIxHa.exe
  C:\Windows\System\PfRIxHa.exe
  2⤵
  PID:6924
- C:\Windows\System\Xtvsmah.exe
  C:\Windows\System\Xtvsmah.exe
  2⤵
  PID:6944
- C:\Windows\System\DbsYnrQ.exe
  C:\Windows\System\DbsYnrQ.exe
  2⤵
  PID:6976
- C:\Windows\System\xOzGFsd.exe
  C:\Windows\System\xOzGFsd.exe
  2⤵
  PID:7008
- C:\Windows\System\zLItjlb.exe
  C:\Windows\System\zLItjlb.exe
  2⤵
  PID:7040
- C:\Windows\System\UfZGgKs.exe
  C:\Windows\System\UfZGgKs.exe
  2⤵
  PID:7068
- C:\Windows\System\ExdzQiJ.exe
  C:\Windows\System\ExdzQiJ.exe
  2⤵
  PID:7120
- C:\Windows\System\ioXAUZx.exe
  C:\Windows\System\ioXAUZx.exe
  2⤵
  PID:7148
- C:\Windows\System\BFzVFkC.exe
  C:\Windows\System\BFzVFkC.exe
  2⤵
  PID:6252
- C:\Windows\System\NVRrilt.exe
  C:\Windows\System\NVRrilt.exe
  2⤵
  PID:6408
- C:\Windows\System\emJOMqX.exe
  C:\Windows\System\emJOMqX.exe
  2⤵
  PID:6288
- C:\Windows\System\WSGFEYI.exe
  C:\Windows\System\WSGFEYI.exe
  2⤵
  PID:6284
- C:\Windows\System\PDajcft.exe
  C:\Windows\System\PDajcft.exe
  2⤵
  PID:6444
- C:\Windows\System\JIelqfG.exe
  C:\Windows\System\JIelqfG.exe
  2⤵
  PID:6480
- C:\Windows\System\dGxBrZZ.exe
  C:\Windows\System\dGxBrZZ.exe
  2⤵
  PID:3164
- C:\Windows\System\EJLGCdk.exe
  C:\Windows\System\EJLGCdk.exe
  2⤵
  PID:6668
- C:\Windows\System\muoxndG.exe
  C:\Windows\System\muoxndG.exe
  2⤵
  PID:6732
- C:\Windows\System\xUDhWuS.exe
  C:\Windows\System\xUDhWuS.exe
  2⤵
  PID:4652
- C:\Windows\System\ysuirlW.exe
  C:\Windows\System\ysuirlW.exe
  2⤵
  PID:3480
- C:\Windows\System\RtRoFVL.exe
  C:\Windows\System\RtRoFVL.exe
  2⤵
  PID:4860
- C:\Windows\System\ZwLjaOg.exe
  C:\Windows\System\ZwLjaOg.exe
  2⤵
  PID:5380
- C:\Windows\System\sinIKgf.exe
  C:\Windows\System\sinIKgf.exe
  2⤵
  PID:6156
- C:\Windows\System\RJXCivb.exe
  C:\Windows\System\RJXCivb.exe
  2⤵
  PID:6192
- C:\Windows\System\nKFjVIn.exe
  C:\Windows\System\nKFjVIn.exe
  2⤵
  PID:6312
- C:\Windows\System\WWyObty.exe
  C:\Windows\System\WWyObty.exe
  2⤵
  PID:6556
- C:\Windows\System\zWygrTk.exe
  C:\Windows\System\zWygrTk.exe
  2⤵
  PID:6528
- C:\Windows\System\fGvgkDH.exe
  C:\Windows\System\fGvgkDH.exe
  2⤵
  PID:6892
- C:\Windows\System\fZAHtgv.exe
  C:\Windows\System\fZAHtgv.exe
  2⤵
  PID:6816
- C:\Windows\System\MFoagMX.exe
  C:\Windows\System\MFoagMX.exe
  2⤵
  PID:6960
- C:\Windows\System\fKFdmOW.exe
  C:\Windows\System\fKFdmOW.exe
  2⤵
  PID:6908
- C:\Windows\System\ViBAKqK.exe
  C:\Windows\System\ViBAKqK.exe
  2⤵
  PID:7100
- C:\Windows\System\LRaXXmg.exe
  C:\Windows\System\LRaXXmg.exe
  2⤵
  PID:7088
- C:\Windows\System\qmlVHca.exe
  C:\Windows\System\qmlVHca.exe
  2⤵
  PID:6328
- C:\Windows\System\QYvAznp.exe
  C:\Windows\System\QYvAznp.exe
  2⤵
  PID:6208
- C:\Windows\System\fwIYLJp.exe
  C:\Windows\System\fwIYLJp.exe
  2⤵
  PID:2900
- C:\Windows\System\NmGXwnA.exe
  C:\Windows\System\NmGXwnA.exe
  2⤵
  PID:6064
- C:\Windows\System\kAAOikI.exe
  C:\Windows\System\kAAOikI.exe
  2⤵
  PID:2508
- C:\Windows\System\kwOmPtz.exe
  C:\Windows\System\kwOmPtz.exe
  2⤵
  PID:6308
- C:\Windows\System\lzbORxi.exe
  C:\Windows\System\lzbORxi.exe
  2⤵
  PID:6940
- C:\Windows\System\WkGJJca.exe
  C:\Windows\System\WkGJJca.exe
  2⤵
  PID:6896
- C:\Windows\System\jEDCfrY.exe
  C:\Windows\System\jEDCfrY.exe
  2⤵
  PID:6464
- C:\Windows\System\wouHsTr.exe
  C:\Windows\System\wouHsTr.exe
  2⤵
  PID:7036
- C:\Windows\System\bMaSFrD.exe
  C:\Windows\System\bMaSFrD.exe
  2⤵
  PID:6780
- C:\Windows\System\azmJDDY.exe
  C:\Windows\System\azmJDDY.exe
  2⤵
  PID:6176
- C:\Windows\System\FtMCizo.exe
  C:\Windows\System\FtMCizo.exe
  2⤵
  PID:6396
- C:\Windows\System\smDjApz.exe
  C:\Windows\System\smDjApz.exe
  2⤵
  PID:6620
- C:\Windows\System\smzwwiH.exe
  C:\Windows\System\smzwwiH.exe
  2⤵
  PID:6440
- C:\Windows\System\wrlcCPE.exe
  C:\Windows\System\wrlcCPE.exe
  2⤵
  PID:2988
- C:\Windows\System\KejSTkR.exe
  C:\Windows\System\KejSTkR.exe
  2⤵
  PID:6992
- C:\Windows\System\EKCMrWZ.exe
  C:\Windows\System\EKCMrWZ.exe
  2⤵
  PID:5792
- C:\Windows\System\Kosywat.exe
  C:\Windows\System\Kosywat.exe
  2⤵
  PID:7172
- C:\Windows\System\SdygSNl.exe
  C:\Windows\System\SdygSNl.exe
  2⤵
  PID:7188
- C:\Windows\System\GlfcCth.exe
  C:\Windows\System\GlfcCth.exe
  2⤵
  PID:7204
- C:\Windows\System\zYyqagX.exe
  C:\Windows\System\zYyqagX.exe
  2⤵
  PID:7220
- C:\Windows\System\lNbnfVG.exe
  C:\Windows\System\lNbnfVG.exe
  2⤵
  PID:7236
- C:\Windows\System\qgIVPBv.exe
  C:\Windows\System\qgIVPBv.exe
  2⤵
  PID:7252
- C:\Windows\System\xAwvTTu.exe
  C:\Windows\System\xAwvTTu.exe
  2⤵
  PID:7268
- C:\Windows\System\wJRwgNb.exe
  C:\Windows\System\wJRwgNb.exe
  2⤵
  PID:7284
- C:\Windows\System\ffJSpUD.exe
  C:\Windows\System\ffJSpUD.exe
  2⤵
  PID:7300
- C:\Windows\System\BtRpIuO.exe
  C:\Windows\System\BtRpIuO.exe
  2⤵
  PID:7316
- C:\Windows\System\PvYLlPL.exe
  C:\Windows\System\PvYLlPL.exe
  2⤵
  PID:7332
- C:\Windows\System\ujRoOgp.exe
  C:\Windows\System\ujRoOgp.exe
  2⤵
  PID:7348
- C:\Windows\System\MHPNMZC.exe
  C:\Windows\System\MHPNMZC.exe
  2⤵
  PID:7364
- C:\Windows\System\XbwMEjv.exe
  C:\Windows\System\XbwMEjv.exe
  2⤵
  PID:7380
- C:\Windows\System\FzNcowi.exe
  C:\Windows\System\FzNcowi.exe
  2⤵
  PID:7396
- C:\Windows\System\bKOCGAb.exe
  C:\Windows\System\bKOCGAb.exe
  2⤵
  PID:7412
- C:\Windows\System\MQtHXye.exe
  C:\Windows\System\MQtHXye.exe
  2⤵
  PID:7428
- C:\Windows\System\qdyIWyE.exe
  C:\Windows\System\qdyIWyE.exe
  2⤵
  PID:7444
- C:\Windows\System\TcwWSvE.exe
  C:\Windows\System\TcwWSvE.exe
  2⤵
  PID:7460
- C:\Windows\System\YHYLiCC.exe
  C:\Windows\System\YHYLiCC.exe
  2⤵
  PID:7476
- C:\Windows\System\BHPKXXQ.exe
  C:\Windows\System\BHPKXXQ.exe
  2⤵
  PID:7492
- C:\Windows\System\ARvPbKw.exe
  C:\Windows\System\ARvPbKw.exe
  2⤵
  PID:7508
- C:\Windows\System\SQHgQQV.exe
  C:\Windows\System\SQHgQQV.exe
  2⤵
  PID:7524
- C:\Windows\System\XgbGFSP.exe
  C:\Windows\System\XgbGFSP.exe
  2⤵
  PID:7540
- C:\Windows\System\XatrUdQ.exe
  C:\Windows\System\XatrUdQ.exe
  2⤵
  PID:7556
- C:\Windows\System\OiDflUW.exe
  C:\Windows\System\OiDflUW.exe
  2⤵
  PID:7572
- C:\Windows\System\MIYFcac.exe
  C:\Windows\System\MIYFcac.exe
  2⤵
  PID:7588
- C:\Windows\System\EIixuHt.exe
  C:\Windows\System\EIixuHt.exe
  2⤵
  PID:7604
- C:\Windows\System\PGevUQz.exe
  C:\Windows\System\PGevUQz.exe
  2⤵
  PID:7620
- C:\Windows\System\NLQjWmh.exe
  C:\Windows\System\NLQjWmh.exe
  2⤵
  PID:7636
- C:\Windows\System\EPZiYck.exe
  C:\Windows\System\EPZiYck.exe
  2⤵
  PID:7652
- C:\Windows\System\FRqjwso.exe
  C:\Windows\System\FRqjwso.exe
  2⤵
  PID:7668
- C:\Windows\System\uqxkHBV.exe
  C:\Windows\System\uqxkHBV.exe
  2⤵
  PID:7684
- C:\Windows\System\KfMIlyG.exe
  C:\Windows\System\KfMIlyG.exe
  2⤵
  PID:7700
- C:\Windows\System\DXFJdyR.exe
  C:\Windows\System\DXFJdyR.exe
  2⤵
  PID:7716
- C:\Windows\System\aCAYApV.exe
  C:\Windows\System\aCAYApV.exe
  2⤵
  PID:7732
- C:\Windows\System\mSxgIgS.exe
  C:\Windows\System\mSxgIgS.exe
  2⤵
  PID:7748
- C:\Windows\System\VFmLUKa.exe
  C:\Windows\System\VFmLUKa.exe
  2⤵
  PID:7764
- C:\Windows\System\SdcAXCa.exe
  C:\Windows\System\SdcAXCa.exe
  2⤵
  PID:7780
- C:\Windows\System\DKOcGZm.exe
  C:\Windows\System\DKOcGZm.exe
  2⤵
  PID:7796
- C:\Windows\System\PzbOxAG.exe
  C:\Windows\System\PzbOxAG.exe
  2⤵
  PID:7812
- C:\Windows\System\OmVOopb.exe
  C:\Windows\System\OmVOopb.exe
  2⤵
  PID:7828
- C:\Windows\System\eQkUIEO.exe
  C:\Windows\System\eQkUIEO.exe
  2⤵
  PID:7844
- C:\Windows\System\EKtcAMu.exe
  C:\Windows\System\EKtcAMu.exe
  2⤵
  PID:7860
- C:\Windows\System\QSHfiPP.exe
  C:\Windows\System\QSHfiPP.exe
  2⤵
  PID:7876
- C:\Windows\System\BToAakb.exe
  C:\Windows\System\BToAakb.exe
  2⤵
  PID:7892
- C:\Windows\System\NyDokDd.exe
  C:\Windows\System\NyDokDd.exe
  2⤵
  PID:7912
- C:\Windows\System\uuoPDwT.exe
  C:\Windows\System\uuoPDwT.exe
  2⤵
  PID:7928
- C:\Windows\System\jQEEiAf.exe
  C:\Windows\System\jQEEiAf.exe
  2⤵
  PID:7944
- C:\Windows\System\xMQbBON.exe
  C:\Windows\System\xMQbBON.exe
  2⤵
  PID:7960
- C:\Windows\System\GbuvztZ.exe
  C:\Windows\System\GbuvztZ.exe
  2⤵
  PID:7976
- C:\Windows\System\aBbCTrE.exe
  C:\Windows\System\aBbCTrE.exe
  2⤵
  PID:7992
- C:\Windows\System\hyvlXVN.exe
  C:\Windows\System\hyvlXVN.exe
  2⤵
  PID:8008
- C:\Windows\System\wVWbutX.exe
  C:\Windows\System\wVWbutX.exe
  2⤵
  PID:8024
- C:\Windows\System\nOmnWIT.exe
  C:\Windows\System\nOmnWIT.exe
  2⤵
  PID:8040
- C:\Windows\System\CHRAoJG.exe
  C:\Windows\System\CHRAoJG.exe
  2⤵
  PID:8056
- C:\Windows\System\lcTLzvS.exe
  C:\Windows\System\lcTLzvS.exe
  2⤵
  PID:8072
- C:\Windows\System\ugVXSII.exe
  C:\Windows\System\ugVXSII.exe
  2⤵
  PID:8088
- C:\Windows\System\GurWoHh.exe
  C:\Windows\System\GurWoHh.exe
  2⤵
  PID:8104
- C:\Windows\System\FtHtVGn.exe
  C:\Windows\System\FtHtVGn.exe
  2⤵
  PID:8120
- C:\Windows\System\ORFpmiK.exe
  C:\Windows\System\ORFpmiK.exe
  2⤵
  PID:8136
- C:\Windows\System\rHNWGLh.exe
  C:\Windows\System\rHNWGLh.exe
  2⤵
  PID:8152
- C:\Windows\System\UQZeedV.exe
  C:\Windows\System\UQZeedV.exe
  2⤵
  PID:8168
- C:\Windows\System\jxLSRTq.exe
  C:\Windows\System\jxLSRTq.exe
  2⤵
  PID:8184
- C:\Windows\System\lkHytSs.exe
  C:\Windows\System\lkHytSs.exe
  2⤵
  PID:7212
- C:\Windows\System\qeNBSaZ.exe
  C:\Windows\System\qeNBSaZ.exe
  2⤵
  PID:7276
- C:\Windows\System\KyPOQVe.exe
  C:\Windows\System\KyPOQVe.exe
  2⤵
  PID:6348
- C:\Windows\System\nZstOqk.exe
  C:\Windows\System\nZstOqk.exe
  2⤵
  PID:7344
- C:\Windows\System\cEEVfBg.exe
  C:\Windows\System\cEEVfBg.exe
  2⤵
  PID:4384
- C:\Windows\System\xiBbLQw.exe
  C:\Windows\System\xiBbLQw.exe
  2⤵
  PID:7376
- C:\Windows\System\geSrvdm.exe
  C:\Windows\System\geSrvdm.exe
  2⤵
  PID:7196
- C:\Windows\System\rtNRgEG.exe
  C:\Windows\System\rtNRgEG.exe
  2⤵
  PID:7260
- C:\Windows\System\INiYZuI.exe
  C:\Windows\System\INiYZuI.exe
  2⤵
  PID:7296
- C:\Windows\System\CfkXFJt.exe
  C:\Windows\System\CfkXFJt.exe
  2⤵
  PID:7392
- C:\Windows\System\RlMoyEo.exe
  C:\Windows\System\RlMoyEo.exe
  2⤵
  PID:7424
- C:\Windows\System\OKktkRl.exe
  C:\Windows\System\OKktkRl.exe
  2⤵
  PID:7472
- C:\Windows\System\PvyGhvh.exe
  C:\Windows\System\PvyGhvh.exe
  2⤵
  PID:7536
- C:\Windows\System\WvolqUC.exe
  C:\Windows\System\WvolqUC.exe
  2⤵
  PID:7516
- C:\Windows\System\hsRnPFH.exe
  C:\Windows\System\hsRnPFH.exe
  2⤵
  PID:7568
- C:\Windows\System\gGpiYsF.exe
  C:\Windows\System\gGpiYsF.exe
  2⤵
  PID:7612
- C:\Windows\System\YTJAqtJ.exe
  C:\Windows\System\YTJAqtJ.exe
  2⤵
  PID:7664
- C:\Windows\System\Rewhwxm.exe
  C:\Windows\System\Rewhwxm.exe
  2⤵
  PID:7728
- C:\Windows\System\zNUnqLs.exe
  C:\Windows\System\zNUnqLs.exe
  2⤵
  PID:7792
- C:\Windows\System\zdCKcrh.exe
  C:\Windows\System\zdCKcrh.exe
  2⤵
  PID:7852
- C:\Windows\System\zpTeAur.exe
  C:\Windows\System\zpTeAur.exe
  2⤵
  PID:7888
- C:\Windows\System\KrInxQP.exe
  C:\Windows\System\KrInxQP.exe
  2⤵
  PID:7924
- C:\Windows\System\hsiarVM.exe
  C:\Windows\System\hsiarVM.exe
  2⤵
  PID:7956
- C:\Windows\System\ijXBqcg.exe
  C:\Windows\System\ijXBqcg.exe
  2⤵
  PID:7740
- C:\Windows\System\qHEfHvB.exe
  C:\Windows\System\qHEfHvB.exe
  2⤵
  PID:7988
- C:\Windows\System\DDflWjl.exe
  C:\Windows\System\DDflWjl.exe
  2⤵
  PID:7940
- C:\Windows\System\meowMiL.exe
  C:\Windows\System\meowMiL.exe
  2⤵
  PID:7872
- C:\Windows\System\cuKjrwF.exe
  C:\Windows\System\cuKjrwF.exe
  2⤵
  PID:7968
- C:\Windows\System\lBseyVA.exe
  C:\Windows\System\lBseyVA.exe
  2⤵
  PID:5776
- C:\Windows\System\DFztpNx.exe
  C:\Windows\System\DFztpNx.exe
  2⤵
  PID:8112
- C:\Windows\System\ciUudfH.exe
  C:\Windows\System\ciUudfH.exe
  2⤵
  PID:8176
- C:\Windows\System\ihaRlMJ.exe
  C:\Windows\System\ihaRlMJ.exe
  2⤵
  PID:6248
- C:\Windows\System\gNMBgdB.exe
  C:\Windows\System\gNMBgdB.exe
  2⤵
  PID:7292
- C:\Windows\System\GizfNQW.exe
  C:\Windows\System\GizfNQW.exe
  2⤵
  PID:8068
- C:\Windows\System\dWTPuVe.exe
  C:\Windows\System\dWTPuVe.exe
  2⤵
  PID:7180
- C:\Windows\System\KbMmWpo.exe
  C:\Windows\System\KbMmWpo.exe
  2⤵
  PID:7116
- C:\Windows\System\nMZjPcf.exe
  C:\Windows\System\nMZjPcf.exe
  2⤵
  PID:7328
- C:\Windows\System\sDgqpFR.exe
  C:\Windows\System\sDgqpFR.exe
  2⤵
  PID:7468
- C:\Windows\System\gSSZfrm.exe
  C:\Windows\System\gSSZfrm.exe
  2⤵
  PID:7600
- C:\Windows\System\euzMDdb.exe
  C:\Windows\System\euzMDdb.exe
  2⤵
  PID:7824
- C:\Windows\System\qKyLzHZ.exe
  C:\Windows\System\qKyLzHZ.exe
  2⤵
  PID:7712
- C:\Windows\System\wpiYzmw.exe
  C:\Windows\System\wpiYzmw.exe
  2⤵
  PID:8020
- C:\Windows\System\oSFzXZN.exe
  C:\Windows\System\oSFzXZN.exe
  2⤵
  PID:7552
- C:\Windows\System\HgMnOZz.exe
  C:\Windows\System\HgMnOZz.exe
  2⤵
  PID:7532
- C:\Windows\System\DqnSkNo.exe
  C:\Windows\System\DqnSkNo.exe
  2⤵
  PID:7788
- C:\Windows\System\GpLFTvq.exe
  C:\Windows\System\GpLFTvq.exe
  2⤵
  PID:7772
- C:\Windows\System\WJEvFmc.exe
  C:\Windows\System\WJEvFmc.exe
  2⤵
  PID:8052
- C:\Windows\System\RYmfgDB.exe
  C:\Windows\System\RYmfgDB.exe
  2⤵
  PID:6268
- C:\Windows\System\GhEzSiD.exe
  C:\Windows\System\GhEzSiD.exe
  2⤵
  PID:8116
- C:\Windows\System\vLpCikm.exe
  C:\Windows\System\vLpCikm.exe
  2⤵
  PID:8160
- C:\Windows\System\ceNEnYl.exe
  C:\Windows\System\ceNEnYl.exe
  2⤵
  PID:7308
- C:\Windows\System\tcLRXpV.exe
  C:\Windows\System\tcLRXpV.exe
  2⤵
  PID:8132
- C:\Windows\System\saBNffD.exe
  C:\Windows\System\saBNffD.exe
  2⤵
  PID:6768
- C:\Windows\System\KOEBAkn.exe
  C:\Windows\System\KOEBAkn.exe
  2⤵
  PID:7580
- C:\Windows\System\mpVJxIP.exe
  C:\Windows\System\mpVJxIP.exe
  2⤵
  PID:7760
- C:\Windows\System\pKtCTYh.exe
  C:\Windows\System\pKtCTYh.exe
  2⤵
  PID:7504
- C:\Windows\System\JPYqFDt.exe
  C:\Windows\System\JPYqFDt.exe
  2⤵
  PID:7660
- C:\Windows\System\RmzcZdB.exe
  C:\Windows\System\RmzcZdB.exe
  2⤵
  PID:7436
- C:\Windows\System\QfzzUEV.exe
  C:\Windows\System\QfzzUEV.exe
  2⤵
  PID:8100
- C:\Windows\System\MZvEqWP.exe
  C:\Windows\System\MZvEqWP.exe
  2⤵
  PID:8084
- C:\Windows\System\sMIquoZ.exe
  C:\Windows\System\sMIquoZ.exe
  2⤵
  PID:7776
- C:\Windows\System\PDmozNU.exe
  C:\Windows\System\PDmozNU.exe
  2⤵
  PID:7904
- C:\Windows\System\BAuxFSv.exe
  C:\Windows\System\BAuxFSv.exe
  2⤵
  PID:7420
- C:\Windows\System\ybatdyT.exe
  C:\Windows\System\ybatdyT.exe
  2⤵
  PID:7884
- C:\Windows\System\WCZophl.exe
  C:\Windows\System\WCZophl.exe
  2⤵
  PID:7920
- C:\Windows\System\BIkWODS.exe
  C:\Windows\System\BIkWODS.exe
  2⤵
  PID:8000
- C:\Windows\System\yPoMUWO.exe
  C:\Windows\System\yPoMUWO.exe
  2⤵
  PID:7908
- C:\Windows\System\gHazKhC.exe
  C:\Windows\System\gHazKhC.exe
  2⤵
  PID:8208
- C:\Windows\System\sUysybu.exe
  C:\Windows\System\sUysybu.exe
  2⤵
  PID:8224
- C:\Windows\System\EkINBAc.exe
  C:\Windows\System\EkINBAc.exe
  2⤵
  PID:8240
- C:\Windows\System\xJreLpr.exe
  C:\Windows\System\xJreLpr.exe
  2⤵
  PID:8260
- C:\Windows\System\XNqvaxM.exe
  C:\Windows\System\XNqvaxM.exe
  2⤵
  PID:8284
- C:\Windows\System\gpzzlsS.exe
  C:\Windows\System\gpzzlsS.exe
  2⤵
  PID:8300
- C:\Windows\System\cbyZqgt.exe
  C:\Windows\System\cbyZqgt.exe
  2⤵
  PID:8320
- C:\Windows\System\oLeNaHA.exe
  C:\Windows\System\oLeNaHA.exe
  2⤵
  PID:8336
- C:\Windows\System\nXHteiv.exe
  C:\Windows\System\nXHteiv.exe
  2⤵
  PID:8352
- C:\Windows\System\OrebUGQ.exe
  C:\Windows\System\OrebUGQ.exe
  2⤵
  PID:8372
- C:\Windows\System\CGirOuI.exe
  C:\Windows\System\CGirOuI.exe
  2⤵
  PID:8388
- C:\Windows\System\HTMYOhp.exe
  C:\Windows\System\HTMYOhp.exe
  2⤵
  PID:8404
- C:\Windows\System\dqKeVBK.exe
  C:\Windows\System\dqKeVBK.exe
  2⤵
  PID:8436
- C:\Windows\System\qnpESoB.exe
  C:\Windows\System\qnpESoB.exe
  2⤵
  PID:8488
- C:\Windows\System\DcVxlHE.exe
  C:\Windows\System\DcVxlHE.exe
  2⤵
  PID:8504
- C:\Windows\System\buNUhID.exe
  C:\Windows\System\buNUhID.exe
  2⤵
  PID:8520
- C:\Windows\System\gJkxuHp.exe
  C:\Windows\System\gJkxuHp.exe
  2⤵
  PID:8536
- C:\Windows\System\ECbijrp.exe
  C:\Windows\System\ECbijrp.exe
  2⤵
  PID:8552
- C:\Windows\System\cnOHMvx.exe
  C:\Windows\System\cnOHMvx.exe
  2⤵
  PID:8568
- C:\Windows\System\GeziagU.exe
  C:\Windows\System\GeziagU.exe
  2⤵
  PID:8584
- C:\Windows\System\gJDCiYU.exe
  C:\Windows\System\gJDCiYU.exe
  2⤵
  PID:8600
- C:\Windows\System\WSDRDgf.exe
  C:\Windows\System\WSDRDgf.exe
  2⤵
  PID:8616
- C:\Windows\System\juHEjyh.exe
  C:\Windows\System\juHEjyh.exe
  2⤵
  PID:8632
- C:\Windows\System\fnpflUd.exe
  C:\Windows\System\fnpflUd.exe
  2⤵
  PID:8648
- C:\Windows\System\SJhcwfO.exe
  C:\Windows\System\SJhcwfO.exe
  2⤵
  PID:8664
- C:\Windows\System\vMIFfHc.exe
  C:\Windows\System\vMIFfHc.exe
  2⤵
  PID:8680
- C:\Windows\System\gOvsxew.exe
  C:\Windows\System\gOvsxew.exe
  2⤵
  PID:8696
- C:\Windows\System\lqyYepv.exe
  C:\Windows\System\lqyYepv.exe
  2⤵
  PID:8712
- C:\Windows\System\fdbNYSg.exe
  C:\Windows\System\fdbNYSg.exe
  2⤵
  PID:8728
- C:\Windows\System\ApyYtMH.exe
  C:\Windows\System\ApyYtMH.exe
  2⤵
  PID:8748
- C:\Windows\System\srcVqFo.exe
  C:\Windows\System\srcVqFo.exe
  2⤵
  PID:8764
- C:\Windows\System\oNvSRoe.exe
  C:\Windows\System\oNvSRoe.exe
  2⤵
  PID:8780
- C:\Windows\System\NLTDwVt.exe
  C:\Windows\System\NLTDwVt.exe
  2⤵
  PID:8796
- C:\Windows\System\dUleQRk.exe
  C:\Windows\System\dUleQRk.exe
  2⤵
  PID:8928
- C:\Windows\System\bVEvwWX.exe
  C:\Windows\System\bVEvwWX.exe
  2⤵
  PID:8952
- C:\Windows\System\XYTVDAg.exe
  C:\Windows\System\XYTVDAg.exe
  2⤵
  PID:8968
- C:\Windows\System\qeREOXW.exe
  C:\Windows\System\qeREOXW.exe
  2⤵
  PID:8984
- C:\Windows\System\qKAqFfa.exe
  C:\Windows\System\qKAqFfa.exe
  2⤵
  PID:9000
- C:\Windows\System\vdNBPDq.exe
  C:\Windows\System\vdNBPDq.exe
  2⤵
  PID:9016
- C:\Windows\System\vszPwJK.exe
  C:\Windows\System\vszPwJK.exe
  2⤵
  PID:9032
- C:\Windows\System\MfCkUWl.exe
  C:\Windows\System\MfCkUWl.exe
  2⤵
  PID:9048
- C:\Windows\System\nafFBdw.exe
  C:\Windows\System\nafFBdw.exe
  2⤵
  PID:9064
- C:\Windows\System\UDsvHcw.exe
  C:\Windows\System\UDsvHcw.exe
  2⤵
  PID:9080
- C:\Windows\System\lwcHCYM.exe
  C:\Windows\System\lwcHCYM.exe
  2⤵
  PID:9096
- C:\Windows\System\wqRzjrZ.exe
  C:\Windows\System\wqRzjrZ.exe
  2⤵
  PID:9112
- C:\Windows\System\XEbUiVr.exe
  C:\Windows\System\XEbUiVr.exe
  2⤵
  PID:9128
- C:\Windows\System\AZqyMml.exe
  C:\Windows\System\AZqyMml.exe
  2⤵
  PID:9144
- C:\Windows\System\eZhaIAH.exe
  C:\Windows\System\eZhaIAH.exe
  2⤵
  PID:9160
- C:\Windows\System\AMaOnfo.exe
  C:\Windows\System\AMaOnfo.exe
  2⤵
  PID:9176
- C:\Windows\System\gtwZRGd.exe
  C:\Windows\System\gtwZRGd.exe
  2⤵
  PID:9192
- C:\Windows\System\ofjfZND.exe
  C:\Windows\System\ofjfZND.exe
  2⤵
  PID:9208
- C:\Windows\System\utqnljg.exe
  C:\Windows\System\utqnljg.exe
  2⤵
  PID:8248
- C:\Windows\System\ANWRvBf.exe
  C:\Windows\System\ANWRvBf.exe
  2⤵
  PID:8256
- C:\Windows\System\TvwofXa.exe
  C:\Windows\System\TvwofXa.exe
  2⤵
  PID:8400
- C:\Windows\System\uFwfwOU.exe
  C:\Windows\System\uFwfwOU.exe
  2⤵
  PID:8424
- C:\Windows\System\tsIlOfJ.exe
  C:\Windows\System\tsIlOfJ.exe
  2⤵
  PID:8452
- C:\Windows\System\iLOnTth.exe
  C:\Windows\System\iLOnTth.exe
  2⤵
  PID:8472
- C:\Windows\System\TvokQLO.exe
  C:\Windows\System\TvokQLO.exe
  2⤵
  PID:8512
- C:\Windows\System\vmdrLEL.exe
  C:\Windows\System\vmdrLEL.exe
  2⤵
  PID:8528
- C:\Windows\System\kZuysCJ.exe
  C:\Windows\System\kZuysCJ.exe
  2⤵
  PID:8628
- C:\Windows\System\FgGcvKG.exe
  C:\Windows\System\FgGcvKG.exe
  2⤵
  PID:8580
- C:\Windows\System\KFjZepv.exe
  C:\Windows\System\KFjZepv.exe
  2⤵
  PID:8676
- C:\Windows\System\aHZsDUU.exe
  C:\Windows\System\aHZsDUU.exe
  2⤵
  PID:8740
- C:\Windows\System\qbCnaVu.exe
  C:\Windows\System\qbCnaVu.exe
  2⤵
  PID:8804
- C:\Windows\System\Ebvvjuh.exe
  C:\Windows\System\Ebvvjuh.exe
  2⤵
  PID:8816
- C:\Windows\System\zumAuDa.exe
  C:\Windows\System\zumAuDa.exe
  2⤵
  PID:8836
- C:\Windows\System\bNwYZpI.exe
  C:\Windows\System\bNwYZpI.exe
  2⤵
  PID:8856
- C:\Windows\System\TKrfLKh.exe
  C:\Windows\System\TKrfLKh.exe
  2⤵
  PID:8864
- C:\Windows\System\roJyKnO.exe
  C:\Windows\System\roJyKnO.exe
  2⤵
  PID:8888
- C:\Windows\System\JOzCpVd.exe
  C:\Windows\System\JOzCpVd.exe
  2⤵
  PID:8912
- C:\Windows\System\csHsUbJ.exe
  C:\Windows\System\csHsUbJ.exe
  2⤵
  PID:8936
- C:\Windows\System\SBkXcLX.exe
  C:\Windows\System\SBkXcLX.exe
  2⤵
  PID:8960
- C:\Windows\System\wZEnYrW.exe
  C:\Windows\System\wZEnYrW.exe
  2⤵
  PID:9008
- C:\Windows\System\xXHhyPR.exe
  C:\Windows\System\xXHhyPR.exe
  2⤵
  PID:9108
- C:\Windows\System\latVkOq.exe
  C:\Windows\System\latVkOq.exe
  2⤵
  PID:9188
- C:\Windows\System\jQxgJuc.exe
  C:\Windows\System\jQxgJuc.exe
  2⤵
  PID:9088
- C:\Windows\System\WhIjnoy.exe
  C:\Windows\System\WhIjnoy.exe
  2⤵
  PID:9060
- C:\Windows\System\qcLDqSm.exe
  C:\Windows\System\qcLDqSm.exe
  2⤵
  PID:9200
- C:\Windows\System\qoRznNH.exe
  C:\Windows\System\qoRznNH.exe
  2⤵
  PID:7724
- C:\Windows\System\cavTqzR.exe
  C:\Windows\System\cavTqzR.exe
  2⤵
  PID:8272
- C:\Windows\System\LuEpkDO.exe
  C:\Windows\System\LuEpkDO.exe
  2⤵
  PID:9124
- C:\Windows\System\SKRXYZK.exe
  C:\Windows\System\SKRXYZK.exe
  2⤵
  PID:8232
- C:\Windows\System\WshAqMS.exe
  C:\Windows\System\WshAqMS.exe
  2⤵
  PID:8384
- C:\Windows\System\JaMUNkh.exe
  C:\Windows\System\JaMUNkh.exe
  2⤵
  PID:8688
- C:\Windows\System\XANXTiU.exe
  C:\Windows\System\XANXTiU.exe
  2⤵
  PID:8428
- C:\Windows\System\NnwqPOH.exe
  C:\Windows\System\NnwqPOH.exe
  2⤵
  PID:8460
- C:\Windows\System\VDWnUgO.exe
  C:\Windows\System\VDWnUgO.exe
  2⤵
  PID:8444
- C:\Windows\System\hDGDoDa.exe
  C:\Windows\System\hDGDoDa.exe
  2⤵
  PID:8480
- C:\Windows\System\zJccBjo.exe
  C:\Windows\System\zJccBjo.exe
  2⤵
  PID:8756
- C:\Windows\System\CGQpHwP.exe
  C:\Windows\System\CGQpHwP.exe
  2⤵
  PID:8772
- C:\Windows\System\CnYTsAa.exe
  C:\Windows\System\CnYTsAa.exe
  2⤵
  PID:9040
- C:\Windows\System\VEEFLbt.exe
  C:\Windows\System\VEEFLbt.exe
  2⤵
  PID:9140
- C:\Windows\System\EUhQNtv.exe
  C:\Windows\System\EUhQNtv.exe
  2⤵
  PID:8544
- C:\Windows\System\DXDnRXp.exe
  C:\Windows\System\DXDnRXp.exe
  2⤵
  PID:9056
- C:\Windows\System\EhJkKxy.exe
  C:\Windows\System\EhJkKxy.exe
  2⤵
  PID:8592
- C:\Windows\System\abbpSWx.exe
  C:\Windows\System\abbpSWx.exe
  2⤵
  PID:8720
- C:\Windows\System\pXNCyBH.exe
  C:\Windows\System\pXNCyBH.exe
  2⤵
  PID:8760
- C:\Windows\System\GhbiYLQ.exe
  C:\Windows\System\GhbiYLQ.exe
  2⤵
  PID:8576
- C:\Windows\System\OmkgJdL.exe
  C:\Windows\System\OmkgJdL.exe
  2⤵
  PID:8820
- C:\Windows\System\FUijgEy.exe
  C:\Windows\System\FUijgEy.exe
  2⤵
  PID:8880
- C:\Windows\System\ilwRPaR.exe
  C:\Windows\System\ilwRPaR.exe
  2⤵
  PID:8900
- C:\Windows\System\oEyALCo.exe
  C:\Windows\System\oEyALCo.exe
  2⤵
  PID:8948
- C:\Windows\System\QncEKfG.exe
  C:\Windows\System\QncEKfG.exe
  2⤵
  PID:8964
- C:\Windows\System\xxSHGqr.exe
  C:\Windows\System\xxSHGqr.exe
  2⤵
  PID:9028
- C:\Windows\System\HZjPemd.exe
  C:\Windows\System\HZjPemd.exe
  2⤵
  PID:8316
- C:\Windows\System\qVhiQDb.exe
  C:\Windows\System\qVhiQDb.exe
  2⤵
  PID:8268
- C:\Windows\System\KExhULp.exe
  C:\Windows\System\KExhULp.exe
  2⤵
  PID:8220
- C:\Windows\System\KCHPnGu.exe
  C:\Windows\System\KCHPnGu.exe
  2⤵
  PID:8992
- C:\Windows\System\DTGQZIl.exe
  C:\Windows\System\DTGQZIl.exe
  2⤵
  PID:8944
- C:\Windows\System\SMpgmrJ.exe
  C:\Windows\System\SMpgmrJ.exe
  2⤵
  PID:8908
- C:\Windows\System\KAxilcx.exe
  C:\Windows\System\KAxilcx.exe
  2⤵
  PID:8380
- C:\Windows\System\hfWRwyR.exe
  C:\Windows\System\hfWRwyR.exe
  2⤵
  PID:8640
- C:\Windows\System\MuYacVU.exe
  C:\Windows\System\MuYacVU.exe
  2⤵
  PID:8368
- C:\Windows\System\jLIPtXZ.exe
  C:\Windows\System\jLIPtXZ.exe
  2⤵
  PID:8200
- C:\Windows\System\urqygPW.exe
  C:\Windows\System\urqygPW.exe
  2⤵
  PID:8812
- C:\Windows\System\UorjoeS.exe
  C:\Windows\System\UorjoeS.exe
  2⤵
  PID:9168
- C:\Windows\System\XHZcaQn.exe
  C:\Windows\System\XHZcaQn.exe
  2⤵
  PID:8292
- C:\Windows\System\PIjkhGk.exe
  C:\Windows\System\PIjkhGk.exe
  2⤵
  PID:8484
- C:\Windows\System\FHYAwKA.exe
  C:\Windows\System\FHYAwKA.exe
  2⤵
  PID:8792
- C:\Windows\System\zAvnLzX.exe
  C:\Windows\System\zAvnLzX.exe
  2⤵
  PID:8164
- C:\Windows\System\uvvgooc.exe
  C:\Windows\System\uvvgooc.exe
  2⤵
  PID:8296
- C:\Windows\System\hZRCQUX.exe
  C:\Windows\System\hZRCQUX.exe
  2⤵
  PID:8692
- C:\Windows\System\aJdvtxp.exe
  C:\Windows\System\aJdvtxp.exe
  2⤵
  PID:8348
- C:\Windows\System\JMlvrWV.exe
  C:\Windows\System\JMlvrWV.exe
  2⤵
  PID:9224
- C:\Windows\System\IRqobYw.exe
  C:\Windows\System\IRqobYw.exe
  2⤵
  PID:9240
- C:\Windows\System\PGQlvXe.exe
  C:\Windows\System\PGQlvXe.exe
  2⤵
  PID:9256
- C:\Windows\System\hhtdYlT.exe
  C:\Windows\System\hhtdYlT.exe
  2⤵
  PID:9272
- C:\Windows\System\vDqfapw.exe
  C:\Windows\System\vDqfapw.exe
  2⤵
  PID:9288
- C:\Windows\System\FInGDwd.exe
  C:\Windows\System\FInGDwd.exe
  2⤵
  PID:9304
- C:\Windows\System\zNiktVV.exe
  C:\Windows\System\zNiktVV.exe
  2⤵
  PID:9320
- C:\Windows\System\qmtnwNe.exe
  C:\Windows\System\qmtnwNe.exe
  2⤵
  PID:9336
- C:\Windows\System\wJDesGU.exe
  C:\Windows\System\wJDesGU.exe
  2⤵
  PID:9352
- C:\Windows\System\HfBWsjC.exe
  C:\Windows\System\HfBWsjC.exe
  2⤵
  PID:9368
- C:\Windows\System\EFdrpGx.exe
  C:\Windows\System\EFdrpGx.exe
  2⤵
  PID:9384
- C:\Windows\System\jDPvZxf.exe
  C:\Windows\System\jDPvZxf.exe
  2⤵
  PID:9400
- C:\Windows\System\RaUuwZq.exe
  C:\Windows\System\RaUuwZq.exe
  2⤵
  PID:9416
- C:\Windows\System\WtxUeHe.exe
  C:\Windows\System\WtxUeHe.exe
  2⤵
  PID:9432
- C:\Windows\System\hipsqpp.exe
  C:\Windows\System\hipsqpp.exe
  2⤵
  PID:9448
- C:\Windows\System\JotvFvG.exe
  C:\Windows\System\JotvFvG.exe
  2⤵
  PID:9464
- C:\Windows\System\aWmzYVM.exe
  C:\Windows\System\aWmzYVM.exe
  2⤵
  PID:9480
- C:\Windows\System\nlvYkAO.exe
  C:\Windows\System\nlvYkAO.exe
  2⤵
  PID:9496
- C:\Windows\System\QcEYGcA.exe
  C:\Windows\System\QcEYGcA.exe
  2⤵
  PID:9512
- C:\Windows\System\oqAsoSX.exe
  C:\Windows\System\oqAsoSX.exe
  2⤵
  PID:9528
- C:\Windows\System\kGPhtIf.exe
  C:\Windows\System\kGPhtIf.exe
  2⤵
  PID:9544
- C:\Windows\System\IhkNeGN.exe
  C:\Windows\System\IhkNeGN.exe
  2⤵
  PID:9560
- C:\Windows\System\QXPIzNm.exe
  C:\Windows\System\QXPIzNm.exe
  2⤵
  PID:9576
- C:\Windows\System\oQWamDK.exe
  C:\Windows\System\oQWamDK.exe
  2⤵
  PID:9592
- C:\Windows\System\vbsOpfU.exe
  C:\Windows\System\vbsOpfU.exe
  2⤵
  PID:9608
- C:\Windows\System\eqskrKi.exe
  C:\Windows\System\eqskrKi.exe
  2⤵
  PID:9624
- C:\Windows\System\GdtagPD.exe
  C:\Windows\System\GdtagPD.exe
  2⤵
  PID:9640
- C:\Windows\System\tVfEiGt.exe
  C:\Windows\System\tVfEiGt.exe
  2⤵
  PID:9656
- C:\Windows\System\bvBIGpW.exe
  C:\Windows\System\bvBIGpW.exe
  2⤵
  PID:9672
- C:\Windows\System\CctLGWv.exe
  C:\Windows\System\CctLGWv.exe
  2⤵
  PID:9688
- C:\Windows\System\gwqWQpt.exe
  C:\Windows\System\gwqWQpt.exe
  2⤵
  PID:9704
- C:\Windows\System\wciHVAD.exe
  C:\Windows\System\wciHVAD.exe
  2⤵
  PID:9720
- C:\Windows\System\votUkZf.exe
  C:\Windows\System\votUkZf.exe
  2⤵
  PID:9736
- C:\Windows\System\pjpNRmx.exe
  C:\Windows\System\pjpNRmx.exe
  2⤵
  PID:9756
- C:\Windows\System\LbUkWqp.exe
  C:\Windows\System\LbUkWqp.exe
  2⤵
  PID:9944
- C:\Windows\System\aeZLfuO.exe
  C:\Windows\System\aeZLfuO.exe
  2⤵
  PID:9972
- C:\Windows\System\VVxVStX.exe
  C:\Windows\System\VVxVStX.exe
  2⤵
  PID:10020
- C:\Windows\System\AyjcdAx.exe
  C:\Windows\System\AyjcdAx.exe
  2⤵
  PID:10036
- C:\Windows\System\UduPefe.exe
  C:\Windows\System\UduPefe.exe
  2⤵
  PID:10052
- C:\Windows\System\ZTWCRtr.exe
  C:\Windows\System\ZTWCRtr.exe
  2⤵
  PID:10068
- C:\Windows\System\ptFwIoW.exe
  C:\Windows\System\ptFwIoW.exe
  2⤵
  PID:10084
- C:\Windows\System\RAcHeyg.exe
  C:\Windows\System\RAcHeyg.exe
  2⤵
  PID:10100
- C:\Windows\System\RIasGNr.exe
  C:\Windows\System\RIasGNr.exe
  2⤵
  PID:10116
- C:\Windows\System\IPZpljy.exe
  C:\Windows\System\IPZpljy.exe
  2⤵
  PID:10132
- C:\Windows\System\suuQbIj.exe
  C:\Windows\System\suuQbIj.exe
  2⤵
  PID:10148
- C:\Windows\System\IrrtMmC.exe
  C:\Windows\System\IrrtMmC.exe
  2⤵
  PID:10164
- C:\Windows\System\WAUzIWR.exe
  C:\Windows\System\WAUzIWR.exe
  2⤵
  PID:10180
- C:\Windows\System\kAQQHvx.exe
  C:\Windows\System\kAQQHvx.exe
  2⤵
  PID:10208
- C:\Windows\System\qVahxMh.exe
  C:\Windows\System\qVahxMh.exe
  2⤵
  PID:10224
- C:\Windows\System\uUQelbg.exe
  C:\Windows\System\uUQelbg.exe
  2⤵
  PID:9504
- C:\Windows\System\jXKWesM.exe
  C:\Windows\System\jXKWesM.exe
  2⤵
  PID:9568
- C:\Windows\System\zMMgHhe.exe
  C:\Windows\System\zMMgHhe.exe
  2⤵
  PID:9744
- C:\Windows\System\HtkkapG.exe
  C:\Windows\System\HtkkapG.exe
  2⤵
  PID:9776
- C:\Windows\System\GCxZIiV.exe
  C:\Windows\System\GCxZIiV.exe
  2⤵
  PID:9840
- C:\Windows\System\ndWwzmx.exe
  C:\Windows\System\ndWwzmx.exe
  2⤵
  PID:9968
- C:\Windows\System\QXfCNuT.exe
  C:\Windows\System\QXfCNuT.exe
  2⤵
  PID:9912
- C:\Windows\System\NQuFkBd.exe
  C:\Windows\System\NQuFkBd.exe
  2⤵
  PID:9880
- C:\Windows\System\hoEkfAL.exe
  C:\Windows\System\hoEkfAL.exe
  2⤵
  PID:9916
- C:\Windows\System\lvJwzEE.exe
  C:\Windows\System\lvJwzEE.exe
  2⤵
  PID:9932
- C:\Windows\System\yWURjSp.exe
  C:\Windows\System\yWURjSp.exe
  2⤵
  PID:10028
- C:\Windows\System\tsKupxB.exe
  C:\Windows\System\tsKupxB.exe
  2⤵
  PID:10092
- C:\Windows\System\fEgsBvr.exe
  C:\Windows\System\fEgsBvr.exe
  2⤵
  PID:10000
- C:\Windows\System\wXTNWLv.exe
  C:\Windows\System\wXTNWLv.exe
  2⤵
  PID:9988
- C:\Windows\System\icBTFEl.exe
  C:\Windows\System\icBTFEl.exe
  2⤵
  PID:10080
- C:\Windows\System\gAvRqVK.exe
  C:\Windows\System\gAvRqVK.exe
  2⤵
  PID:10112
- C:\Windows\System\ryUxhci.exe
  C:\Windows\System\ryUxhci.exe
  2⤵
  PID:10188
- C:\Windows\System\bFDvUui.exe
  C:\Windows\System\bFDvUui.exe
  2⤵
  PID:10220
- C:\Windows\System\mgBJstr.exe
  C:\Windows\System\mgBJstr.exe
  2⤵
  PID:8656
- C:\Windows\System\PzmjRjW.exe
  C:\Windows\System\PzmjRjW.exe
  2⤵
  PID:8724
- C:\Windows\System\lLuzHZr.exe
  C:\Windows\System\lLuzHZr.exe
  2⤵
  PID:9296
- C:\Windows\System\zDEducs.exe
  C:\Windows\System\zDEducs.exe
  2⤵
  PID:9396
- C:\Windows\System\lTPTsej.exe
  C:\Windows\System\lTPTsej.exe
  2⤵
  PID:9552
- C:\Windows\System\npZpleV.exe
  C:\Windows\System\npZpleV.exe
  2⤵
  PID:9456
- C:\Windows\System\GOtuNUi.exe
  C:\Windows\System\GOtuNUi.exe
  2⤵
  PID:9280
- C:\Windows\System\KtDPpzD.exe
  C:\Windows\System\KtDPpzD.exe
  2⤵
  PID:9412
- C:\Windows\System\ADSgHDH.exe
  C:\Windows\System\ADSgHDH.exe
  2⤵
  PID:9220
- C:\Windows\System\QvVNWIn.exe
  C:\Windows\System\QvVNWIn.exe
  2⤵
  PID:9348
- C:\Windows\System\SfQTInP.exe
  C:\Windows\System\SfQTInP.exe
  2⤵
  PID:8360
- C:\Windows\System\AsJXAhh.exe
  C:\Windows\System\AsJXAhh.exe
  2⤵
  PID:9540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EEsptnE.exe

Filesize
2.7MB

MD5
8f365015dbfc5661b175c2e78152116a

SHA1
1b61419b2c4cd54561c8c2904c2d0758c83a84a1

SHA256
704b4cde5f3530ffa067a228f377de3cdef01fd5f89b34f12852ee42e4bf3bff

SHA512
f5eb396bcf00b96d8cc427bbbbe93332b754bfd09aec7aee5b737bb5963ec3b76e1c2919990635f95ca95a038845cccad7beb008987b84d7e6a51f21ea4336cd

Download Submit
C:\Windows\system\ILZYUBm.exe

Filesize
2.7MB

MD5
e80f8964a2012b35ccda4427381334aa

SHA1
4969ae13c8ab2cd1dca07d8562d672b547b907e4

SHA256
174c3238d23761de38dcfb7731e99f17788f57af8251b475f36a906a2f2d4663

SHA512
690694d6fc0436cc11cdf9f2f4145f1485b96c9bc01e6c4f0e1cd0557934a69c4922c59ad91b90d889ed7ba65da5776d1916d1cec1e036af3c84f652e1f26a1d

Download Submit
C:\Windows\system\KYhuQUS.exe

Filesize
2.7MB

MD5
e0ba58022273e5699aae0f703d6ee861

SHA1
9927bde6936f4aa86ad25861148bbaff9227a94b

SHA256
4beef0b128705edeebd2b8fe811eedb871cb50393a561852827cd859425e8eef

SHA512
59380bd470fe985282ac0d7b5f26fa632a51cbc77079f2641b2e08c1c06e05335307789e3a1270f1fc2ec9becd3eb8ee0b2b3af0ec0c89bdc86523d5ee648b61

Download Submit
C:\Windows\system\LasqkWA.exe

Filesize
2.7MB

MD5
25a109eb5915d5f0f32a78f481f10601

SHA1
821c8ecd6a2e41f06d0129c412c1bfe6cc2ab1b3

SHA256
85d83d457c0e9e189dabe3f19b1e92ad922bb8c88d48a6673333d9d0a07c1094

SHA512
2588386c758657947be1207c888631e1c39f139ae0052e462bb5e00a1babfddfce402061adbf3e86e6a441aca62ffeb1be597ba041e12dcbc6340d9528ff29f9

Download Submit
C:\Windows\system\MPYoPzA.exe

Filesize
2.7MB

MD5
46edb588b4cae3261d665b6964ffc2b4

SHA1
659c5ccbf784ce83db185dd63a5a5445639bf5b2

SHA256
1b6d0b65a79c5f30230f92f0b2cf52363c672c2f1f2acbcd737d91b3961379e1

SHA512
19fb26e28cee83f8a50e2ead56202da7aa68f16000a89e3f224334d9bbc04f70bc217a45e5acdb17cf6873ad3e67137292d4d4c2ccf592b2729a2a6b820287ca

Download Submit
C:\Windows\system\MbiKlVE.exe

Filesize
2.7MB

MD5
406825649801f8f420a0a1658f3a021f

SHA1
53e49d9334e6d24d5ab3e295e4a6f1a73b231d70

SHA256
86226e3e768698b8308d9fd08e603d35ebc0426a15a4c75a7da90c95fddc937a

SHA512
e125e6220c1793c7edf373c23330536718be83f3decef46db6fed1636b0481ade4d317322a5d28d8e350f53d4efba40b3d9755279de8a52ce5803d94b9c9f69c

Download Submit
C:\Windows\system\OZAeKYe.exe

Filesize
2.7MB

MD5
8c0941d2a83209b75660b473197907ae

SHA1
ecb9632d3800335eda55e940289703547dcae672

SHA256
e9fe31333ef8137dc1c7d8013af1d5812ef050108cb8dba8d918d966b3ef9463

SHA512
2d14f628c222e21ffaf5df6863ba8a57bba044c09beb9f06e2198a586bcbe8e2811986353494c1bcc1710daeaea4d2f29f0025721e1c9b015b1b4a6ecee6154e

Download Submit
C:\Windows\system\RnNoqoE.exe

Filesize
2.7MB

MD5
2f1ed7df500e75bf6e93e143a02dea95

SHA1
c21c6cdfa29ba2239c1fa18ad9abe975b237c521

SHA256
db7e6b5bd8b056f5225a0b747b812a71faa58587d48088c26687e1349ac15693

SHA512
5f44c2a2d055e22eebf312f36ee371dd7232def04db45ee9e417bb8232784ffed8ecbc37110ba8cad0c87cf34b8cd7187dd14932b495bf970aababab40712f2d

Download Submit
C:\Windows\system\SNgliVo.exe

Filesize
2.7MB

MD5
e58733a4e50dd96f80657ba28e50144d

SHA1
1d19fa2cd316095990b5705968d5157547e8acc3

SHA256
d0b3059b49d5f28c44f7b9b793cf5fc120002c445318f4c7220cf7ce4ebcc3e3

SHA512
35817a36d40123d02274e3bd2ad50a8b06eea8bbecc85cbb452a2497d2cedcddf90cab1a8ad2e63463d56ff8bd9bb683a2c10770939d0dd5bd920eba9de87005

Download Submit
C:\Windows\system\THVdyOw.exe

Filesize
2.7MB

MD5
60ecfc1f4342c6b3a255e0eebfb1fb9e

SHA1
2b340a5800300b8e1e864d968399f27120d1264f

SHA256
a4ca33c86bfc43ae7b5f825c6a67293bdfc32f42b45791087a3f9f54b9325ea8

SHA512
14d17b3f5bb47bd61916e2778e5e4986f9bff499b249dcabd2dac47328b612e1725208e2a9dbf8d2a4501ecfa62296d86beddf8e95b7eef566f4a3151182f3e4

Download Submit
C:\Windows\system\USbiWQm.exe

Filesize
2.7MB

MD5
d79bb1fda42276380d17a4d97498ffd2

SHA1
54c8f5b007140bd66f17842e5750f2c51363e290

SHA256
e7bf9f27999eac47f82759e66dba369fd4fbd6943d16cc159db89cae18ee7aee

SHA512
fcbb66a40c3e89f6fc2a0250ec56e572c37c4587534d1959edad45276428a4bbcd701039e04fce434db375ff4b052a6e51291a1738e799afcc762a2e958e52c1

Download Submit
C:\Windows\system\XuQUxAM.exe

Filesize
2.7MB

MD5
620bdf054ca100ac1797826692ec2cc8

SHA1
371c4188fb9fe48e34cb142520f654597e9f616a

SHA256
a3a28ab62114557def706f58108fca8345056f06889d04ffbef5907a4866e94d

SHA512
291e740a313806cc41d379c65233df8ebc230e019c860e5b42ef4783f51daacbbc954ad374c18e43bf7a1f40583305a9ce54bb327798b1db87ec308c76e441f4

Download Submit
C:\Windows\system\ZZLsDqF.exe

Filesize
2.7MB

MD5
b21f786f29822e9dbc5ea87f6d9a4f6f

SHA1
859567d048ef99437768b57ac2cbdff0dc38c7e0

SHA256
ddcd09b0119653df8d77635a5117a3a0c8bd2bc6ab8ee0dff01e87aa189f5ce7

SHA512
1e46ad9c69511fc550445a3e5a849407bbf0cfac651a95efb4c21e7376be6976c145df4aed138554ddb17c153525fabb15e240e327150693b2fc05a0ac83dd79

Download Submit
C:\Windows\system\ZpuYZiN.exe

Filesize
2.7MB

MD5
f94a8403455a4bec44db06b70c1f4575

SHA1
e08889feaceeaa640aaea802e2ba4aed2f80d285

SHA256
80cc006f00ec624d210ab370308011904e15f94732c369c658f19c2fdffcd149

SHA512
c5bdc2b5427fe68d4f6844b2e59ce1951f362dc1d8657e025b0aa4410af5bac39b880d9b982251c1e5b045896d3e86b6984834b6ec90ca2f95d6d244d4b092fc

Download Submit
C:\Windows\system\bRGwvto.exe

Filesize
2.7MB

MD5
f68ced688feb9bdc25ea2022b8903ab0

SHA1
aefdd20e4442ee23b0dda4e09ec15dd34ce09c4d

SHA256
a8c3ec2d727b5937e13b6b5019e614ef3b4c3f75a3d1dee3d3512dc4bffb2d53

SHA512
1ab996b8d86b531fe12cd222f98b9c07310129b8e616fc9654cd2a501e6bffc48cdfc9e1b1f81a38cf47fbbd6e90060f936baef4fc8cc25bbb64117179563e4b

Download Submit
C:\Windows\system\cprOWOU.exe

Filesize
2.7MB

MD5
6f17a2ecc80a243375f5506743c7f9aa

SHA1
4dfba593f604c4c82d0a32c1281018e7011781c8

SHA256
8c5ed1b29ed261cd076b091305007bf5377b34b5d5875bc69486175daf5ff162

SHA512
5077bff9d37970ea96e48f8733ea7bc132b7f234d09544a819c1c6707d7efdff00d4d917c2632564932b43cbb54d8124029ef698d47bf42b0ab04c7c2b2562e7

Download Submit
C:\Windows\system\cvRSypT.exe

Filesize
2.7MB

MD5
9c293ba16f605280119054b3d4493d40

SHA1
9c007dbc6b4a025b8307a1765f4de10abcae2350

SHA256
12107ca8847c0852c79219e9596d6d73257dce514b68ceeb7d06a957d2ae4f36

SHA512
df656ccdef4c0a412bee39d30618a6853d85b4be2bcdaf7d72250d4f70d59a258840413c244a08144e6173c2b3e78f81f474c54499c954b8d3b79b678eb0e5f7

Download Submit
C:\Windows\system\gPwZwWI.exe

Filesize
2.7MB

MD5
24e0dfb51e6d37ef72fab04473b03e85

SHA1
4ddc633485bf746ca2673a38c1bdeec2920ba084

SHA256
ff1175679ecb28f583b95694c3f7424d9582314504f5b6ea9f34b71abcba3840

SHA512
6ef906a47cc4e1391abd1a35b50ae05740c22998e640f69619b7598e301951bd26aa7a97ae025175b70f8ef9f502584904e48fb1ac957bf89aac5df9aa057cd0

Download Submit
C:\Windows\system\iTMYsEO.exe

Filesize
2.7MB

MD5
0243e42b7a9ff48aded34100cd3e5c35

SHA1
ebf816dee11dd3d45980a5d59a966cc94329c034

SHA256
8410c2659cdf97334d40fb7c0f548a54865064d0d3e8a2471d8018e15cf373b4

SHA512
3357db11bf7075eaa6d4784caf6a86fff969a80daedc0488b8435e7b968efca2d6c6b28ea47cbedeb8a6377814ef1a0ca516bb87d7e78f4ec0ce2b6c7b542147

Download Submit
C:\Windows\system\tUPUfMQ.exe

Filesize
2.7MB

MD5
f7906683f89aec98910ef6f0edd3eab1

SHA1
5df618b3225b39aa3512d3c0eee83990557dff66

SHA256
6d124b2d1f21836b33ccc23dc248a251b88f0b51ade10eee87a73956be53eb76

SHA512
3d01182532f9a3042729ad86dd7a8fce60af4c12ab6cd8367c947ca393830c7604bf045a2668fcdc50274dd2334cbb213401e599a8e7b2860fcead4a5bae7347

Download Submit
C:\Windows\system\wWuqDRz.exe

Filesize
2.7MB

MD5
a72ebe8214ce7f8c96e6a21a479cac9b

SHA1
fe35119496a1c953abb6a91395152bbbe8a1f116

SHA256
372e70096883a41dbc5c590d48cf4f0d5395fb88a9b67c5843c2d6d2623306b6

SHA512
a1465598110857f8c4ba0e2c68275864f51332908701b6f028d2ca7cf4410df348889db89cb923f99936d434fcc5194e0236390420f502575ba13579e34553e7

Download Submit
C:\Windows\system\xoFhEve.exe

Filesize
2.7MB

MD5
090cd5a6a7ca228f3b2124c317d0b0dd

SHA1
e8c23773178ef545799a655ae623ff557c64e42d

SHA256
714f966ee916e52db6322a1a296ff2996bfce1c4d210a43306888e58abd06841

SHA512
f1f984a614599ff81ff36e9f7a88ac5229c0f8f4a09b76bab68e7fb25f70fd0be0af41eebf9b19f94ed85dc28cccd2321d4d7a6a95a9eb33704a0b0bbe8d37b0

Download Submit
C:\Windows\system\zBMyYFt.exe

Filesize
2.7MB

MD5
04ebffea804e35e0305dc2dd4c5587b0

SHA1
7f904115a2d3e07dabe7730bc1347faab97b1735

SHA256
2462ceacacb3e8b5de2c35be6e2b14615b3c91c3b8698adfcfa7b4962036ce1e

SHA512
89b5b6733bf7dd449203c8411b57d1280d0ec8eecf15510a929cab94c0a1ec8ac7ed020f786b9621cb3a158b062e539b321b29889ab92ec1c6c53302100e1ada

Download Submit
\Windows\system\DrwYivv.exe

Filesize
2.7MB

MD5
002151e120e8a4b8f5b1f6b8ce331785

SHA1
46192cc2f8aec115b7daf46ce87203da605154e2

SHA256
413caca62c93f8086e13c900ee788cffccf86f52929bfe9668bd6c8c72f6f4ed

SHA512
ddfa501e7691a2e9cc3fa0605bb2fe0ca270cf44747e9f1c1648e3290bc7a1c8e46c540fda23292d7334ed6d3c506440719d9d1a4e412cd1bae361ba10fe13d4

Download Submit
\Windows\system\IlnVpGz.exe

Filesize
2.7MB

MD5
b08617a5f99f37f50de371d209896efe

SHA1
28595f880371a44f59f25fa3e0822e9d0c222cb4

SHA256
62fbf38d8b6ffbc3df99595272926188e2d69943de6bd8946dd17c6fbf54055c

SHA512
d35009b3363b2ef2a9423e9608f61c0af7da714b4c9e7e472e1526602fc1d7edc35989a3522a4b97dda6747db537e1408040a852d0189230b4d91a69abebac94

Download Submit
\Windows\system\LmNYwtC.exe

Filesize
2.7MB

MD5
ff3b1fbf8c6f96d0f9d8f3e6fd41a370

SHA1
3ada21142607fb3ec331a3235010b30c89510d3b

SHA256
32ba92c66344932f7f6744b42007e18d72a295c97eee1c6a13c8942f4eb56f0c

SHA512
2145044f114569f6b26bfcc475747aff1dba379118ebd0a8991ae62b10e89a6b96720fbc417b8ccdcbee00465a622bd0f178bd1121cdbe2041e69b19ebd94e6b

Download Submit
\Windows\system\QxYfFdn.exe

Filesize
2.7MB

MD5
db92d8d288e50838b99e2c7e60b78c07

SHA1
57e2a980ef4a82390ad4a3d38d22567f84129371

SHA256
a50f338893ceb16ad32185b3ec2579e00b11f66a53b558916050039c43896406

SHA512
081fc95ea38f87ed204b69781d7547dbae58cf3b79056123c92e10bf915a0a0780c797ba91604e96dece363986d3189cd73e320d2fcb18435b46efcb28bea21e

Download Submit
\Windows\system\TXhZgEy.exe

Filesize
2.7MB

MD5
ba33f84dcc072163ffc13ec09faf3853

SHA1
f860963a03def47d87244ba9b05f84f237a83f8c

SHA256
3469c6885f13c8af7d5e9ae5168a8019db928a26c1324988b181369d71ed8694

SHA512
4484a1cc1d809cdbc2d56985b19ef5ac9925a53de435c381b18a647c7687a6e747caa1ae6a0c06a891519a1d7cefd2e7e001e07dadc8d4ca4317418d08833386

Download Submit
\Windows\system\WBQOReq.exe

Filesize
2.7MB

MD5
973858c962678fb0185f426989b955fc

SHA1
d958812010054ce4b766cea6b71c0530da49d078

SHA256
ac9d47db7b0432dfaef4d5998e4b1697af8f96f3c046b5df5986a5be3adf6952

SHA512
39814c6fef492700903264d7c3740fc2972482a22afd084f55cf6eacd02273cc9b6b0133c991513c906f588647d6d454784f7ea2cd5c51d45229298e3f537b75

Download Submit
\Windows\system\Wmymzrs.exe

Filesize
2.7MB

MD5
f5b889597780efdd3835c9b5824a6b49

SHA1
07cf9ca698029ed98aed7cbeb446fa8eb3a9cb8b

SHA256
8f75e02242c95d27fdcd87fce7a657460ad47f51e0247891f8e3afe1a83ab366

SHA512
9dccb86f0d2d33a9bcae83e47ecad00623578798feb9c3fb344f9712616cdd01360824536851e41881568a49507bef06a2519ef88a9671269e2aab5e3dbb7b05

Download Submit
\Windows\system\ZMKhqkN.exe

Filesize
2.7MB

MD5
37d69305971f9d390bc5487967c833a5

SHA1
8dce407c64f5b3ee208439ec3c54de2cb163afee

SHA256
a1e6b622e266700d5f5087f7d039fde975ddb72b4200cd031e4ff23b01094e64

SHA512
c494ad64a7f885cca6d7a060946b61d4a5f67a96bcfe388a36745aebab8e4d1a603500fe93014280dbcc5d7946d10cd7132c71ecbc7138d217983c8c141466b5

Download Submit
\Windows\system\aCvrItW.exe

Filesize
2.7MB

MD5
9b82d4796d5cbae61c0378772bf705cc

SHA1
59a5fbd7d3f60fca24684552da8b0076374ddc2f

SHA256
a47326e0c110debb2aa1f50cea0e370c09c5d6faac5d758d3915c51c10860e09

SHA512
5130ce6b779a0573499b52d527f2ed0a822c0811bec0e819ddf25a8119a0094527bb107f1ee4ea7dfd5e8f30c99371422c337f35f71cb9ca7cb3b42d87aa5234

Download Submit
\Windows\system\leMQfcz.exe

Filesize
2.7MB

MD5
46fe5f286011064e1ac3649865c6e44b

SHA1
1035ce09097e1620bf6e9bcfce9b9b0e1a27d280

SHA256
a4324f1ccf0fe2fe521157a8376334780ab546099cf5ba7c06e39fa523b79f14

SHA512
c28f7c81776e1876facb38baa1db496cdfedf17b230e0842bed3235406f8ecda491f201e21e041adaf324e53a93b0b8adb7e42ecb052ec5ee4ffb9088028c4e9

Download Submit
\Windows\system\lixSyAq.exe

Filesize
2.7MB

MD5
1c65f683f0539b663a1e02ddc3a00b61

SHA1
26909c003250d6bc59e5c236460bd59af6d21077

SHA256
b0af36e42471accdaac426940b71df9d8f089b99ec64ebd0b7fc3f1560033738

SHA512
ca6a07a4a71403c15da3df8ef774ee021c5bffb35f4d47bec1db329adda5d959f2f0c1f3aa56000b02b0e01b68135b7f532662fca61297c0bb5f3d84bab97469

Download Submit
\Windows\system\lxPsPtc.exe

Filesize
2.7MB

MD5
bd093ac920aa9449c5fc5cf276bc5234

SHA1
c4d7964d85cc67d1a8043f5f28a40207b57bae36

SHA256
af078228e544ae0d40227f65266f862787af0660f4b2cf741f68655b159f31c5

SHA512
2c88f27a389e1f2786c3a7aea2a5e1fb2f170265fd0157ae393d51e15ed77a6ea9c32743ba8e90d057671db6a663b06ef65bed0b00136a2904e7c0c4e4192083

Download Submit
\Windows\system\oKjmVAC.exe

Filesize
2.7MB

MD5
37aae80c5f7a21610be1d99b90534656

SHA1
245222af3ac2c2ffffdeb7d54d5c654adac9c3c8

SHA256
0f4bc5cd12be554c338f1312fc5559fc5176c39210fb33f3b69a53274d32b6f6

SHA512
a8f71dc1fa43a3ddc04389eaa927d4344ac8e6de538dd4efb624484ba495ef248526bce06d0394f7d1569315d36153400751daa7fa9ab8ee3b367f37869ec628

Download Submit
\Windows\system\owLOoOJ.exe

Filesize
2.7MB

MD5
d2ff1ea636c0af359910cf6c96108156

SHA1
b5fd9e354da689a0d83dc76ebb2e5821df300178

SHA256
b9f0361ea3318265e141883971257bec61b863b6e3f23c24c5427d71f7d35c74

SHA512
46779f5f5710b72b6657dfc5cd173680a9abe7f6b6a4bc1fc7e3a09e40e6c57f8485d4c86141c037573ccfb9f09bdefa4134653f80089a13164236f927c60898

Download Submit
\Windows\system\zbVdlTh.exe

Filesize
2.7MB

MD5
105b069d8000137dda35d14c5ec04ff7

SHA1
02087ca113b95e43fa320f209339e2c01f739d58

SHA256
1ce4788d60af26bf9c985dd5d3c50493bafc95788ede1bd1694d845de84f2c3f

SHA512
b8287e9cd372bcb680859fc9ffba2e161054a9b2af4271775f701eab092e00965ee240fcda6eb3c9e2fe2b021a51c78afecec7973fd521f68dd91b06b4a95f1e

Download Submit
memory/1156-69-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/1156-8-0x000000013F2D0000-0x000000013F6C6000-memory.dmp

Filesize
4.0MB

Download
memory/2112-79-0x000000013F6A0000-0x000000013FA96000-memory.dmp

Filesize
4.0MB

Download
memory/2112-14-0x000000013F6A0000-0x000000013FA96000-memory.dmp

Filesize
4.0MB

Download
memory/2128-100-0x00000000027F0000-0x00000000027F8000-memory.dmp

Filesize
32KB

Download
memory/2128-98-0x000000001B790000-0x000000001BA72000-memory.dmp

Filesize
2.9MB

Download
memory/2128-33-0x0000000002EA0000-0x0000000002F20000-memory.dmp

Filesize
512KB

Download
memory/2344-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2344-78-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-4-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-598-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-1-0x000000013F3C0000-0x000000013F7B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-6402-0x000000013FD90000-0x0000000140186000-memory.dmp

Filesize
4.0MB

Download
memory/2344-20-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-13-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-42-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2344-30-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-49-0x000000013F3C0000-0x000000013F7B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-4917-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-73-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-80-0x000000013FD90000-0x0000000140186000-memory.dmp

Filesize
4.0MB

Download
memory/2344-4670-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-38-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-77-0x00000000031C0000-0x00000000035B6000-memory.dmp

Filesize
4.0MB

Download
memory/2408-4638-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2408-88-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2432-4698-0x000000013F4B0000-0x000000013F8A6000-memory.dmp

Filesize
4.0MB

Download
memory/2432-86-0x000000013F4B0000-0x000000013F8A6000-memory.dmp

Filesize
4.0MB

Download
memory/2456-54-0x000000013FC10000-0x0000000140006000-memory.dmp

Filesize
4.0MB

Download
memory/2492-87-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2492-4624-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2564-599-0x000000013F100000-0x000000013F4F6000-memory.dmp

Filesize
4.0MB

Download
memory/2564-4335-0x000000013F100000-0x000000013F4F6000-memory.dmp

Filesize
4.0MB

Download
memory/2564-39-0x000000013F100000-0x000000013F4F6000-memory.dmp

Filesize
4.0MB

Download
memory/2572-25-0x000000013F040000-0x000000013F436000-memory.dmp

Filesize
4.0MB

Download
memory/2572-84-0x000000013F040000-0x000000013F436000-memory.dmp

Filesize
4.0MB

Download
memory/2596-93-0x000000013F260000-0x000000013F656000-memory.dmp

Filesize
4.0MB

Download
memory/2596-4623-0x000000013F260000-0x000000013F656000-memory.dmp

Filesize
4.0MB

Download
memory/2728-85-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-4534-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-32-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2732-4570-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2732-1379-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2732-45-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download