xmrig | 6815db4bd26a7ac45425f81fdcac76b14d1a96942392cb87041bb0c8cee6a56c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
Size

2.8MB
MD5

4a69f4f474964523b6ee6042dafbad80
SHA1

45dde59ed00637e55b196fd1df79a5c70e20eb0e
SHA256

6815db4bd26a7ac45425f81fdcac76b14d1a96942392cb87041bb0c8cee6a56c
SHA512

9c077c37236da902964b5df8c65030ccd11483f3893420b0146b7db6d3aa886e4fa60e2c96a39860136b74e67f0fb9f5e5e3b5b59b1aa495beed608b3035c08f
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pHP0:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/memory/1968-1-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x000c0000000122ee-3.dat	xmrig
behavioral1/files/0x0007000000016c57-22.dat	xmrig
behavioral1/memory/2656-19-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c3a-26.dat	xmrig
behavioral1/files/0x0006000000016d79-49.dat	xmrig
behavioral1/files/0x0007000000016d73-76.dat	xmrig
behavioral1/memory/2736-83-0x000000013F5A0000-0x000000013F996000-memory.dmp	xmrig
behavioral1/files/0x0006000000017603-143.dat	xmrig
behavioral1/files/0x000500000001878f-166.dat	xmrig
behavioral1/files/0x003700000001650f-178.dat	xmrig
behavioral1/memory/2700-1666-0x000000013F500000-0x000000013F8F6000-memory.dmp	xmrig
behavioral1/memory/2496-1673-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/files/0x0005000000019254-188.dat	xmrig
behavioral1/files/0x000600000001902f-183.dat	xmrig
behavioral1/files/0x0005000000018749-163.dat	xmrig
behavioral1/files/0x000500000001870e-156.dat	xmrig
behavioral1/files/0x000500000001871c-161.dat	xmrig
behavioral1/files/0x000d000000018689-148.dat	xmrig
behavioral1/files/0x00050000000186a2-153.dat	xmrig
behavioral1/files/0x00060000000175fd-139.dat	xmrig
behavioral1/files/0x0006000000017577-137.dat	xmrig
behavioral1/files/0x0006000000017436-135.dat	xmrig
behavioral1/files/0x00060000000173e2-133.dat	xmrig
behavioral1/files/0x000600000001738e-131.dat	xmrig
behavioral1/files/0x00130000000054a8-129.dat	xmrig
behavioral1/files/0x0006000000016fa9-126.dat	xmrig
behavioral1/files/0x00060000000174ef-113.dat	xmrig
behavioral1/memory/1968-111-0x000000013FC90000-0x0000000140086000-memory.dmp	xmrig
behavioral1/memory/1968-98-0x000000013F600000-0x000000013F9F6000-memory.dmp	xmrig
behavioral1/files/0x000700000001708c-87.dat	xmrig
behavioral1/files/0x0008000000016ccd-46.dat	xmrig
behavioral1/files/0x00060000000175f7-116.dat	xmrig
behavioral1/files/0x00060000000173e5-107.dat	xmrig
behavioral1/files/0x0009000000016ca1-33.dat	xmrig
behavioral1/memory/2700-28-0x000000013F500000-0x000000013F8F6000-memory.dmp	xmrig
behavioral1/memory/2604-27-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/memory/2488-92-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/files/0x000600000001738f-91.dat	xmrig
behavioral1/memory/376-72-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/memory/2336-24-0x000000013F520000-0x000000013F916000-memory.dmp	xmrig
behavioral1/memory/2592-71-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/files/0x00060000000171ad-68.dat	xmrig
behavioral1/memory/2432-52-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/memory/2496-38-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/files/0x0007000000016c5b-32.dat	xmrig
behavioral1/files/0x003700000001640f-12.dat	xmrig
behavioral1/memory/2432-2409-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/memory/376-3338-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/memory/2488-3710-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig
behavioral1/memory/2336-6792-0x000000013F520000-0x000000013F916000-memory.dmp	xmrig
behavioral1/memory/2656-6793-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	xmrig
behavioral1/memory/2604-6794-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/memory/2592-6796-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/memory/376-6795-0x000000013FB50000-0x000000013FF46000-memory.dmp	xmrig
behavioral1/memory/2496-6799-0x000000013FB10000-0x000000013FF06000-memory.dmp	xmrig
behavioral1/memory/2736-6798-0x000000013F5A0000-0x000000013F996000-memory.dmp	xmrig
behavioral1/memory/2700-6797-0x000000013F500000-0x000000013F8F6000-memory.dmp	xmrig
behavioral1/memory/2432-6800-0x000000013F930000-0x000000013FD26000-memory.dmp	xmrig
behavioral1/memory/2488-6801-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2160	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2336	XPVJkVL.exe
2656	twodRYz.exe
2604	HPBlBvM.exe
2700	FBGbEgZ.exe
2496	KpcadLD.exe
2432	NfHOPjk.exe
2592	DhrStvw.exe
376	NVyqPib.exe
2736	ATGUqic.exe
2488	piJmQmW.exe
1912	eeiHRTh.exe
2384	igfASkP.exe
324	HpAtsBS.exe
1860	OHPAycm.exe
236	pANTnBm.exe
2108	fdXjdaU.exe
2764	eSWnvSn.exe
2380	Pmouufv.exe
544	ZpbypJu.exe
556	odZqPQt.exe
2800	uvpHAmy.exe
1248	fEpUQXA.exe
2888	szIlkBx.exe
2236	eHGyaWp.exe
2572	clvyNCw.exe
2856	uMvlUtq.exe
1796	UBijoNI.exe
964	RFcqaaf.exe
1292	awrCHVB.exe
2332	HtWEbNp.exe
1100	AqKwHDg.exe
2120	DKtEFAL.exe
1284	yhftZDG.exe
1604	jwWyjCO.exe
292	mpoTdRl.exe
1552	WATLXZA.exe
340	tGrBJTL.exe
3040	PDLDBHm.exe
908	uwoQmmS.exe
1112	LioTCZG.exe
3016	lUoRbwc.exe
1712	RDdhzRF.exe
1652	wfdFqqp.exe
2052	aPiOGhE.exe
2076	ouaSTZG.exe
2028	TAdcGBL.exe
2116	JJJMQvM.exe
1444	KnkGcBc.exe
2084	xoUACCR.exe
1648	NkVZwOQ.exe
2272	kPxMDWz.exe
1532	MOeOLIn.exe
2680	OrJgfAm.exe
2600	YKtvCOZ.exe
984	eeSnyQV.exe
2124	YiZaWoU.exe
2908	FkDPHgj.exe
2356	zhSmvvH.exe
2716	rXlhCwr.exe
2396	cNnbrSi.exe
2584	eBRBZKM.exe
2804	jspSWXj.exe
2412	EsGwhyF.exe
2192	amuDBXV.exe

Loads dropped DLL 64 IoCs

pid	Process
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1968-1-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x000c0000000122ee-3.dat	upx
behavioral1/files/0x0007000000016c57-22.dat	upx
behavioral1/memory/2656-19-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/files/0x0007000000016c3a-26.dat	upx
behavioral1/files/0x0006000000016d79-49.dat	upx
behavioral1/files/0x0007000000016d73-76.dat	upx
behavioral1/memory/2736-83-0x000000013F5A0000-0x000000013F996000-memory.dmp	upx
behavioral1/files/0x0006000000017603-143.dat	upx
behavioral1/files/0x000500000001878f-166.dat	upx
behavioral1/files/0x003700000001650f-178.dat	upx
behavioral1/memory/2700-1666-0x000000013F500000-0x000000013F8F6000-memory.dmp	upx
behavioral1/memory/2496-1673-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/files/0x0005000000019254-188.dat	upx
behavioral1/files/0x000600000001902f-183.dat	upx
behavioral1/files/0x0005000000018749-163.dat	upx
behavioral1/files/0x000500000001870e-156.dat	upx
behavioral1/files/0x000500000001871c-161.dat	upx
behavioral1/files/0x000d000000018689-148.dat	upx
behavioral1/files/0x00050000000186a2-153.dat	upx
behavioral1/files/0x00060000000175fd-139.dat	upx
behavioral1/files/0x0006000000017577-137.dat	upx
behavioral1/files/0x0006000000017436-135.dat	upx
behavioral1/files/0x00060000000173e2-133.dat	upx
behavioral1/files/0x000600000001738e-131.dat	upx
behavioral1/files/0x00130000000054a8-129.dat	upx
behavioral1/files/0x0006000000016fa9-126.dat	upx
behavioral1/files/0x00060000000174ef-113.dat	upx
behavioral1/memory/1968-98-0x000000013F600000-0x000000013F9F6000-memory.dmp	upx
behavioral1/files/0x000700000001708c-87.dat	upx
behavioral1/files/0x0008000000016ccd-46.dat	upx
behavioral1/files/0x00060000000175f7-116.dat	upx
behavioral1/files/0x00060000000173e5-107.dat	upx
behavioral1/files/0x0009000000016ca1-33.dat	upx
behavioral1/memory/2700-28-0x000000013F500000-0x000000013F8F6000-memory.dmp	upx
behavioral1/memory/2604-27-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/memory/2488-92-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx
behavioral1/files/0x000600000001738f-91.dat	upx
behavioral1/memory/376-72-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/memory/2336-24-0x000000013F520000-0x000000013F916000-memory.dmp	upx
behavioral1/memory/2592-71-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/files/0x00060000000171ad-68.dat	upx
behavioral1/memory/2432-52-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/memory/2496-38-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/files/0x0007000000016c5b-32.dat	upx
behavioral1/files/0x003700000001640f-12.dat	upx
behavioral1/memory/2432-2409-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/memory/376-3338-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/memory/2488-3710-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx
behavioral1/memory/2336-6792-0x000000013F520000-0x000000013F916000-memory.dmp	upx
behavioral1/memory/2656-6793-0x000000013F3F0000-0x000000013F7E6000-memory.dmp	upx
behavioral1/memory/2604-6794-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/memory/2592-6796-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/memory/376-6795-0x000000013FB50000-0x000000013FF46000-memory.dmp	upx
behavioral1/memory/2496-6799-0x000000013FB10000-0x000000013FF06000-memory.dmp	upx
behavioral1/memory/2736-6798-0x000000013F5A0000-0x000000013F996000-memory.dmp	upx
behavioral1/memory/2700-6797-0x000000013F500000-0x000000013F8F6000-memory.dmp	upx
behavioral1/memory/2432-6800-0x000000013F930000-0x000000013FD26000-memory.dmp	upx
behavioral1/memory/2488-6801-0x000000013F9D0000-0x000000013FDC6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YmrcGOI.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\moVwxXf.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\zkIjWvw.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\ovONDJm.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\HPxGJGp.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\gLLobAJ.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\QyaILSw.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\HwuxCdm.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\xWbkxog.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\vojnNaJ.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\YtXGfnI.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\pocdRwy.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\VnntMrw.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\UhYPuky.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\GMAmkSV.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\okIVffj.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\PfpOgEF.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\USPAdUM.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\nOQLseb.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\bGLRrbv.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\YXXxlJL.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\liFjENP.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\HXKKYPu.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\szfEena.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\RtkiJGE.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\uEQCBZc.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\vPlxnos.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\sdoAICr.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\hreNflH.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\uCBXwFh.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\stXUHnU.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\hbWSjls.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\pbfBsao.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\MYlBmvK.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\VccUDEH.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\jAxCxem.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\xVelnKs.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\opeosoY.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\zBlhzWV.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\eJPvQiv.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\YGUASPL.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\QJeDtov.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\bTwtWEI.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\ryxKLdV.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\AxpdTAY.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\uAqmyWg.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\wsyBfOf.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\tWOmmni.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\krhOXaA.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\eTAesSL.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\FlWnJJT.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\Qzctuhq.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\ZAKhahV.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\pNBdnay.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\pQNrEdm.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\NDSQCNv.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\hPpEwEY.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\ErymfWl.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\dWdunsJ.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\cLQOuzR.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\YURpIUA.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\pcbCBsT.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\KEaDzuX.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
File created	C:\Windows\System\bcybvFE.exe	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2160	powershell.exe
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
Token: SeDebugPrivilege	2160	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2160	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	29
PID 1968 wrote to memory of 2160	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	29
PID 1968 wrote to memory of 2160	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	29
PID 1968 wrote to memory of 2336	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	30
PID 1968 wrote to memory of 2336	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	30
PID 1968 wrote to memory of 2336	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	30
PID 1968 wrote to memory of 2656	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	31
PID 1968 wrote to memory of 2656	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	31
PID 1968 wrote to memory of 2656	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	31
PID 1968 wrote to memory of 2700	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	32
PID 1968 wrote to memory of 2700	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	32
PID 1968 wrote to memory of 2700	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	32
PID 1968 wrote to memory of 2604	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	33
PID 1968 wrote to memory of 2604	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	33
PID 1968 wrote to memory of 2604	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	33
PID 1968 wrote to memory of 2496	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	34
PID 1968 wrote to memory of 2496	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	34
PID 1968 wrote to memory of 2496	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	34
PID 1968 wrote to memory of 2736	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	35
PID 1968 wrote to memory of 2736	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	35
PID 1968 wrote to memory of 2736	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	35
PID 1968 wrote to memory of 2432	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	36
PID 1968 wrote to memory of 2432	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	36
PID 1968 wrote to memory of 2432	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	36
PID 1968 wrote to memory of 2488	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	37
PID 1968 wrote to memory of 2488	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	37
PID 1968 wrote to memory of 2488	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	37
PID 1968 wrote to memory of 2592	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	38
PID 1968 wrote to memory of 2592	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	38
PID 1968 wrote to memory of 2592	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	38
PID 1968 wrote to memory of 2108	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	39
PID 1968 wrote to memory of 2108	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	39
PID 1968 wrote to memory of 2108	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	39
PID 1968 wrote to memory of 376	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	40
PID 1968 wrote to memory of 376	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	40
PID 1968 wrote to memory of 376	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	40
PID 1968 wrote to memory of 2764	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	41
PID 1968 wrote to memory of 2764	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	41
PID 1968 wrote to memory of 2764	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	41
PID 1968 wrote to memory of 1912	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	42
PID 1968 wrote to memory of 1912	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	42
PID 1968 wrote to memory of 1912	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	42
PID 1968 wrote to memory of 2380	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	43
PID 1968 wrote to memory of 2380	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	43
PID 1968 wrote to memory of 2380	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	43
PID 1968 wrote to memory of 2384	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	44
PID 1968 wrote to memory of 2384	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	44
PID 1968 wrote to memory of 2384	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	44
PID 1968 wrote to memory of 544	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	45
PID 1968 wrote to memory of 544	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	45
PID 1968 wrote to memory of 544	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	45
PID 1968 wrote to memory of 324	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	46
PID 1968 wrote to memory of 324	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	46
PID 1968 wrote to memory of 324	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	46
PID 1968 wrote to memory of 556	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	47
PID 1968 wrote to memory of 556	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	47
PID 1968 wrote to memory of 556	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	47
PID 1968 wrote to memory of 1860	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	48
PID 1968 wrote to memory of 1860	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	48
PID 1968 wrote to memory of 1860	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	48
PID 1968 wrote to memory of 2800	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	49
PID 1968 wrote to memory of 2800	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	49
PID 1968 wrote to memory of 2800	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	49
PID 1968 wrote to memory of 236	1968	4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a69f4f474964523b6ee6042dafbad80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\System\XPVJkVL.exe
  C:\Windows\System\XPVJkVL.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\twodRYz.exe
  C:\Windows\System\twodRYz.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\FBGbEgZ.exe
  C:\Windows\System\FBGbEgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\HPBlBvM.exe
  C:\Windows\System\HPBlBvM.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\KpcadLD.exe
  C:\Windows\System\KpcadLD.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ATGUqic.exe
  C:\Windows\System\ATGUqic.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\NfHOPjk.exe
  C:\Windows\System\NfHOPjk.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\piJmQmW.exe
  C:\Windows\System\piJmQmW.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\DhrStvw.exe
  C:\Windows\System\DhrStvw.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\fdXjdaU.exe
  C:\Windows\System\fdXjdaU.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\NVyqPib.exe
  C:\Windows\System\NVyqPib.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\eSWnvSn.exe
  C:\Windows\System\eSWnvSn.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\eeiHRTh.exe
  C:\Windows\System\eeiHRTh.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\Pmouufv.exe
  C:\Windows\System\Pmouufv.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\igfASkP.exe
  C:\Windows\System\igfASkP.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ZpbypJu.exe
  C:\Windows\System\ZpbypJu.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\HpAtsBS.exe
  C:\Windows\System\HpAtsBS.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\odZqPQt.exe
  C:\Windows\System\odZqPQt.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\OHPAycm.exe
  C:\Windows\System\OHPAycm.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\uvpHAmy.exe
  C:\Windows\System\uvpHAmy.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\pANTnBm.exe
  C:\Windows\System\pANTnBm.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\fEpUQXA.exe
  C:\Windows\System\fEpUQXA.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\szIlkBx.exe
  C:\Windows\System\szIlkBx.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\eHGyaWp.exe
  C:\Windows\System\eHGyaWp.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\clvyNCw.exe
  C:\Windows\System\clvyNCw.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\RFcqaaf.exe
  C:\Windows\System\RFcqaaf.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\uMvlUtq.exe
  C:\Windows\System\uMvlUtq.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\awrCHVB.exe
  C:\Windows\System\awrCHVB.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\UBijoNI.exe
  C:\Windows\System\UBijoNI.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\HtWEbNp.exe
  C:\Windows\System\HtWEbNp.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\AqKwHDg.exe
  C:\Windows\System\AqKwHDg.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\DKtEFAL.exe
  C:\Windows\System\DKtEFAL.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\yhftZDG.exe
  C:\Windows\System\yhftZDG.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\jwWyjCO.exe
  C:\Windows\System\jwWyjCO.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\mpoTdRl.exe
  C:\Windows\System\mpoTdRl.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\WATLXZA.exe
  C:\Windows\System\WATLXZA.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\tGrBJTL.exe
  C:\Windows\System\tGrBJTL.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\PDLDBHm.exe
  C:\Windows\System\PDLDBHm.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\uwoQmmS.exe
  C:\Windows\System\uwoQmmS.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\LioTCZG.exe
  C:\Windows\System\LioTCZG.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\lUoRbwc.exe
  C:\Windows\System\lUoRbwc.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\RDdhzRF.exe
  C:\Windows\System\RDdhzRF.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\wfdFqqp.exe
  C:\Windows\System\wfdFqqp.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\aPiOGhE.exe
  C:\Windows\System\aPiOGhE.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ouaSTZG.exe
  C:\Windows\System\ouaSTZG.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\TAdcGBL.exe
  C:\Windows\System\TAdcGBL.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\JJJMQvM.exe
  C:\Windows\System\JJJMQvM.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KnkGcBc.exe
  C:\Windows\System\KnkGcBc.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\xoUACCR.exe
  C:\Windows\System\xoUACCR.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\NkVZwOQ.exe
  C:\Windows\System\NkVZwOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\kPxMDWz.exe
  C:\Windows\System\kPxMDWz.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\MOeOLIn.exe
  C:\Windows\System\MOeOLIn.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\OrJgfAm.exe
  C:\Windows\System\OrJgfAm.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\YKtvCOZ.exe
  C:\Windows\System\YKtvCOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\eeSnyQV.exe
  C:\Windows\System\eeSnyQV.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\YiZaWoU.exe
  C:\Windows\System\YiZaWoU.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\FkDPHgj.exe
  C:\Windows\System\FkDPHgj.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\zhSmvvH.exe
  C:\Windows\System\zhSmvvH.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\rXlhCwr.exe
  C:\Windows\System\rXlhCwr.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\cNnbrSi.exe
  C:\Windows\System\cNnbrSi.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\eBRBZKM.exe
  C:\Windows\System\eBRBZKM.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\jspSWXj.exe
  C:\Windows\System\jspSWXj.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\EsGwhyF.exe
  C:\Windows\System\EsGwhyF.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\amuDBXV.exe
  C:\Windows\System\amuDBXV.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\KinFIQU.exe
  C:\Windows\System\KinFIQU.exe
  2⤵
  PID:1764
- C:\Windows\System\qOChPRC.exe
  C:\Windows\System\qOChPRC.exe
  2⤵
  PID:1864
- C:\Windows\System\BoRisnJ.exe
  C:\Windows\System\BoRisnJ.exe
  2⤵
  PID:1376
- C:\Windows\System\iFbHiSb.exe
  C:\Windows\System\iFbHiSb.exe
  2⤵
  PID:2280
- C:\Windows\System\thcdZGd.exe
  C:\Windows\System\thcdZGd.exe
  2⤵
  PID:2244
- C:\Windows\System\jHWPpnI.exe
  C:\Windows\System\jHWPpnI.exe
  2⤵
  PID:2568
- C:\Windows\System\QUPpGTG.exe
  C:\Windows\System\QUPpGTG.exe
  2⤵
  PID:1492
- C:\Windows\System\hvdhPbL.exe
  C:\Windows\System\hvdhPbL.exe
  2⤵
  PID:2808
- C:\Windows\System\ahkmkkE.exe
  C:\Windows\System\ahkmkkE.exe
  2⤵
  PID:448
- C:\Windows\System\SxwvYSu.exe
  C:\Windows\System\SxwvYSu.exe
  2⤵
  PID:1236
- C:\Windows\System\kPhRenE.exe
  C:\Windows\System\kPhRenE.exe
  2⤵
  PID:1280
- C:\Windows\System\qkYZmDj.exe
  C:\Windows\System\qkYZmDj.exe
  2⤵
  PID:1320
- C:\Windows\System\HOydmIv.exe
  C:\Windows\System\HOydmIv.exe
  2⤵
  PID:1240
- C:\Windows\System\IimEVYM.exe
  C:\Windows\System\IimEVYM.exe
  2⤵
  PID:1556
- C:\Windows\System\mYobFoi.exe
  C:\Windows\System\mYobFoi.exe
  2⤵
  PID:712
- C:\Windows\System\ORpjTGm.exe
  C:\Windows\System\ORpjTGm.exe
  2⤵
  PID:3044
- C:\Windows\System\JtdGnMw.exe
  C:\Windows\System\JtdGnMw.exe
  2⤵
  PID:2060
- C:\Windows\System\TTDaMAF.exe
  C:\Windows\System\TTDaMAF.exe
  2⤵
  PID:2040
- C:\Windows\System\PIsGQYt.exe
  C:\Windows\System\PIsGQYt.exe
  2⤵
  PID:3088
- C:\Windows\System\aHAQZLQ.exe
  C:\Windows\System\aHAQZLQ.exe
  2⤵
  PID:3108
- C:\Windows\System\BCpqGtT.exe
  C:\Windows\System\BCpqGtT.exe
  2⤵
  PID:3128
- C:\Windows\System\kqlRBXz.exe
  C:\Windows\System\kqlRBXz.exe
  2⤵
  PID:3148
- C:\Windows\System\WLcjmGl.exe
  C:\Windows\System\WLcjmGl.exe
  2⤵
  PID:3168
- C:\Windows\System\sYyyIpe.exe
  C:\Windows\System\sYyyIpe.exe
  2⤵
  PID:3188
- C:\Windows\System\ensNDYd.exe
  C:\Windows\System\ensNDYd.exe
  2⤵
  PID:3204
- C:\Windows\System\HSirlJy.exe
  C:\Windows\System\HSirlJy.exe
  2⤵
  PID:3224
- C:\Windows\System\aaDxDyh.exe
  C:\Windows\System\aaDxDyh.exe
  2⤵
  PID:3248
- C:\Windows\System\hvaSOva.exe
  C:\Windows\System\hvaSOva.exe
  2⤵
  PID:3268
- C:\Windows\System\QRtxhkG.exe
  C:\Windows\System\QRtxhkG.exe
  2⤵
  PID:3288
- C:\Windows\System\jDJdefX.exe
  C:\Windows\System\jDJdefX.exe
  2⤵
  PID:3308
- C:\Windows\System\yuGFFjs.exe
  C:\Windows\System\yuGFFjs.exe
  2⤵
  PID:3328
- C:\Windows\System\atGQOzR.exe
  C:\Windows\System\atGQOzR.exe
  2⤵
  PID:3348
- C:\Windows\System\bVVudMy.exe
  C:\Windows\System\bVVudMy.exe
  2⤵
  PID:3368
- C:\Windows\System\awKsaGc.exe
  C:\Windows\System\awKsaGc.exe
  2⤵
  PID:3388
- C:\Windows\System\SXBVyLV.exe
  C:\Windows\System\SXBVyLV.exe
  2⤵
  PID:3408
- C:\Windows\System\MqqLqOm.exe
  C:\Windows\System\MqqLqOm.exe
  2⤵
  PID:3428
- C:\Windows\System\OdbMLjt.exe
  C:\Windows\System\OdbMLjt.exe
  2⤵
  PID:3444
- C:\Windows\System\AIkXeqk.exe
  C:\Windows\System\AIkXeqk.exe
  2⤵
  PID:3460
- C:\Windows\System\JMXzmap.exe
  C:\Windows\System\JMXzmap.exe
  2⤵
  PID:3480
- C:\Windows\System\GputMEh.exe
  C:\Windows\System\GputMEh.exe
  2⤵
  PID:3508
- C:\Windows\System\RTnUvMI.exe
  C:\Windows\System\RTnUvMI.exe
  2⤵
  PID:3524
- C:\Windows\System\NvfNweQ.exe
  C:\Windows\System\NvfNweQ.exe
  2⤵
  PID:3544
- C:\Windows\System\ZsMAWNK.exe
  C:\Windows\System\ZsMAWNK.exe
  2⤵
  PID:3560
- C:\Windows\System\fUrvPuU.exe
  C:\Windows\System\fUrvPuU.exe
  2⤵
  PID:3580
- C:\Windows\System\pkQPkoK.exe
  C:\Windows\System\pkQPkoK.exe
  2⤵
  PID:3608
- C:\Windows\System\QHyqjaV.exe
  C:\Windows\System\QHyqjaV.exe
  2⤵
  PID:3624
- C:\Windows\System\TtToKtV.exe
  C:\Windows\System\TtToKtV.exe
  2⤵
  PID:3644
- C:\Windows\System\Unecpaw.exe
  C:\Windows\System\Unecpaw.exe
  2⤵
  PID:3660
- C:\Windows\System\kJCrELM.exe
  C:\Windows\System\kJCrELM.exe
  2⤵
  PID:3692
- C:\Windows\System\IkiUNJD.exe
  C:\Windows\System\IkiUNJD.exe
  2⤵
  PID:3712
- C:\Windows\System\hzMIRhJ.exe
  C:\Windows\System\hzMIRhJ.exe
  2⤵
  PID:3732
- C:\Windows\System\ysmtnba.exe
  C:\Windows\System\ysmtnba.exe
  2⤵
  PID:3752
- C:\Windows\System\slAIQhE.exe
  C:\Windows\System\slAIQhE.exe
  2⤵
  PID:3768
- C:\Windows\System\HNVlTdf.exe
  C:\Windows\System\HNVlTdf.exe
  2⤵
  PID:3784
- C:\Windows\System\MlyJGhB.exe
  C:\Windows\System\MlyJGhB.exe
  2⤵
  PID:3804
- C:\Windows\System\mQHFoik.exe
  C:\Windows\System\mQHFoik.exe
  2⤵
  PID:3820
- C:\Windows\System\spqCPWR.exe
  C:\Windows\System\spqCPWR.exe
  2⤵
  PID:3844
- C:\Windows\System\DqAbQcU.exe
  C:\Windows\System\DqAbQcU.exe
  2⤵
  PID:3860
- C:\Windows\System\UFppjjr.exe
  C:\Windows\System\UFppjjr.exe
  2⤵
  PID:3884
- C:\Windows\System\hgcbrgS.exe
  C:\Windows\System\hgcbrgS.exe
  2⤵
  PID:3900
- C:\Windows\System\iWSiFAJ.exe
  C:\Windows\System\iWSiFAJ.exe
  2⤵
  PID:3924
- C:\Windows\System\sOanaRy.exe
  C:\Windows\System\sOanaRy.exe
  2⤵
  PID:3944
- C:\Windows\System\VCLeaTi.exe
  C:\Windows\System\VCLeaTi.exe
  2⤵
  PID:3976
- C:\Windows\System\qVzcbfE.exe
  C:\Windows\System\qVzcbfE.exe
  2⤵
  PID:3996
- C:\Windows\System\qTennDK.exe
  C:\Windows\System\qTennDK.exe
  2⤵
  PID:4016
- C:\Windows\System\VpJKOsq.exe
  C:\Windows\System\VpJKOsq.exe
  2⤵
  PID:4036
- C:\Windows\System\oMYDFtg.exe
  C:\Windows\System\oMYDFtg.exe
  2⤵
  PID:4052
- C:\Windows\System\mQngQuj.exe
  C:\Windows\System\mQngQuj.exe
  2⤵
  PID:4072
- C:\Windows\System\rUsmTns.exe
  C:\Windows\System\rUsmTns.exe
  2⤵
  PID:2104
- C:\Windows\System\imgUePM.exe
  C:\Windows\System\imgUePM.exe
  2⤵
  PID:2184
- C:\Windows\System\LntMPjh.exe
  C:\Windows\System\LntMPjh.exe
  2⤵
  PID:892
- C:\Windows\System\rcIWeJV.exe
  C:\Windows\System\rcIWeJV.exe
  2⤵
  PID:2032
- C:\Windows\System\GGdlpxk.exe
  C:\Windows\System\GGdlpxk.exe
  2⤵
  PID:1264
- C:\Windows\System\japbboK.exe
  C:\Windows\System\japbboK.exe
  2⤵
  PID:2668
- C:\Windows\System\TMIlgDT.exe
  C:\Windows\System\TMIlgDT.exe
  2⤵
  PID:2520
- C:\Windows\System\IjLmVTv.exe
  C:\Windows\System\IjLmVTv.exe
  2⤵
  PID:1468
- C:\Windows\System\UKVEIal.exe
  C:\Windows\System\UKVEIal.exe
  2⤵
  PID:1944
- C:\Windows\System\CUpqvBy.exe
  C:\Windows\System\CUpqvBy.exe
  2⤵
  PID:2368
- C:\Windows\System\XZmganx.exe
  C:\Windows\System\XZmganx.exe
  2⤵
  PID:2156
- C:\Windows\System\uxjVmVP.exe
  C:\Windows\System\uxjVmVP.exe
  2⤵
  PID:2276
- C:\Windows\System\nEIXVLJ.exe
  C:\Windows\System\nEIXVLJ.exe
  2⤵
  PID:860
- C:\Windows\System\cixjadW.exe
  C:\Windows\System\cixjadW.exe
  2⤵
  PID:2900
- C:\Windows\System\eGlgGWu.exe
  C:\Windows\System\eGlgGWu.exe
  2⤵
  PID:2096
- C:\Windows\System\SmJtQhZ.exe
  C:\Windows\System\SmJtQhZ.exe
  2⤵
  PID:2428
- C:\Windows\System\VQESFEp.exe
  C:\Windows\System\VQESFEp.exe
  2⤵
  PID:996
- C:\Windows\System\BqeQMkb.exe
  C:\Windows\System\BqeQMkb.exe
  2⤵
  PID:968
- C:\Windows\System\MoTBzfk.exe
  C:\Windows\System\MoTBzfk.exe
  2⤵
  PID:3020
- C:\Windows\System\ZECfqFt.exe
  C:\Windows\System\ZECfqFt.exe
  2⤵
  PID:316
- C:\Windows\System\hvyTsiO.exe
  C:\Windows\System\hvyTsiO.exe
  2⤵
  PID:2064
- C:\Windows\System\zPUZEPz.exe
  C:\Windows\System\zPUZEPz.exe
  2⤵
  PID:1640
- C:\Windows\System\IQjqyCJ.exe
  C:\Windows\System\IQjqyCJ.exe
  2⤵
  PID:1728
- C:\Windows\System\OdGmUsy.exe
  C:\Windows\System\OdGmUsy.exe
  2⤵
  PID:3136
- C:\Windows\System\bNwgaZB.exe
  C:\Windows\System\bNwgaZB.exe
  2⤵
  PID:3212
- C:\Windows\System\YUgFnlq.exe
  C:\Windows\System\YUgFnlq.exe
  2⤵
  PID:3156
- C:\Windows\System\VpHsFHH.exe
  C:\Windows\System\VpHsFHH.exe
  2⤵
  PID:3240
- C:\Windows\System\vgOVXbu.exe
  C:\Windows\System\vgOVXbu.exe
  2⤵
  PID:3260
- C:\Windows\System\qTmWjlF.exe
  C:\Windows\System\qTmWjlF.exe
  2⤵
  PID:3300
- C:\Windows\System\RoOTZck.exe
  C:\Windows\System\RoOTZck.exe
  2⤵
  PID:3324
- C:\Windows\System\UVlkDEa.exe
  C:\Windows\System\UVlkDEa.exe
  2⤵
  PID:3356
- C:\Windows\System\KqGBgcX.exe
  C:\Windows\System\KqGBgcX.exe
  2⤵
  PID:3420
- C:\Windows\System\tNbJvlF.exe
  C:\Windows\System\tNbJvlF.exe
  2⤵
  PID:3404
- C:\Windows\System\BsvCTcC.exe
  C:\Windows\System\BsvCTcC.exe
  2⤵
  PID:3436
- C:\Windows\System\JicqRiD.exe
  C:\Windows\System\JicqRiD.exe
  2⤵
  PID:3540
- C:\Windows\System\QEfsIJr.exe
  C:\Windows\System\QEfsIJr.exe
  2⤵
  PID:3572
- C:\Windows\System\tgbzSFU.exe
  C:\Windows\System\tgbzSFU.exe
  2⤵
  PID:3620
- C:\Windows\System\PYLKldg.exe
  C:\Windows\System\PYLKldg.exe
  2⤵
  PID:3600
- C:\Windows\System\hJiEQCS.exe
  C:\Windows\System\hJiEQCS.exe
  2⤵
  PID:3656
- C:\Windows\System\tSNInHb.exe
  C:\Windows\System\tSNInHb.exe
  2⤵
  PID:3704
- C:\Windows\System\QWVQrSc.exe
  C:\Windows\System\QWVQrSc.exe
  2⤵
  PID:3740
- C:\Windows\System\ecAXyQm.exe
  C:\Windows\System\ecAXyQm.exe
  2⤵
  PID:3780
- C:\Windows\System\PYWfvjy.exe
  C:\Windows\System\PYWfvjy.exe
  2⤵
  PID:3632
- C:\Windows\System\CDcyCCG.exe
  C:\Windows\System\CDcyCCG.exe
  2⤵
  PID:3728
- C:\Windows\System\ppqpxwX.exe
  C:\Windows\System\ppqpxwX.exe
  2⤵
  PID:3932
- C:\Windows\System\BpesQdf.exe
  C:\Windows\System\BpesQdf.exe
  2⤵
  PID:3800
- C:\Windows\System\zXuaXyw.exe
  C:\Windows\System\zXuaXyw.exe
  2⤵
  PID:3984
- C:\Windows\System\BfoIlTl.exe
  C:\Windows\System\BfoIlTl.exe
  2⤵
  PID:3960
- C:\Windows\System\EAfEhVT.exe
  C:\Windows\System\EAfEhVT.exe
  2⤵
  PID:3876
- C:\Windows\System\SekiJEs.exe
  C:\Windows\System\SekiJEs.exe
  2⤵
  PID:3972
- C:\Windows\System\PpDjwmY.exe
  C:\Windows\System\PpDjwmY.exe
  2⤵
  PID:4068
- C:\Windows\System\mjMUqqG.exe
  C:\Windows\System\mjMUqqG.exe
  2⤵
  PID:1940
- C:\Windows\System\rEPfZIi.exe
  C:\Windows\System\rEPfZIi.exe
  2⤵
  PID:2004
- C:\Windows\System\FLmqVuO.exe
  C:\Windows\System\FLmqVuO.exe
  2⤵
  PID:4084
- C:\Windows\System\vnQTATj.exe
  C:\Windows\System\vnQTATj.exe
  2⤵
  PID:4092
- C:\Windows\System\JBffvhC.exe
  C:\Windows\System\JBffvhC.exe
  2⤵
  PID:2364
- C:\Windows\System\IgLfLVX.exe
  C:\Windows\System\IgLfLVX.exe
  2⤵
  PID:900
- C:\Windows\System\tKsiVMI.exe
  C:\Windows\System\tKsiVMI.exe
  2⤵
  PID:2672
- C:\Windows\System\XmefKxX.exe
  C:\Windows\System\XmefKxX.exe
  2⤵
  PID:872
- C:\Windows\System\RcXmPEy.exe
  C:\Windows\System\RcXmPEy.exe
  2⤵
  PID:1956
- C:\Windows\System\KfnBFCD.exe
  C:\Windows\System\KfnBFCD.exe
  2⤵
  PID:1384
- C:\Windows\System\uPSYGFZ.exe
  C:\Windows\System\uPSYGFZ.exe
  2⤵
  PID:2860
- C:\Windows\System\KEKxPEb.exe
  C:\Windows\System\KEKxPEb.exe
  2⤵
  PID:380
- C:\Windows\System\HdkAOlK.exe
  C:\Windows\System\HdkAOlK.exe
  2⤵
  PID:3216
- C:\Windows\System\zwAHkLV.exe
  C:\Windows\System\zwAHkLV.exe
  2⤵
  PID:2288
- C:\Windows\System\lCkBFwP.exe
  C:\Windows\System\lCkBFwP.exe
  2⤵
  PID:3264
- C:\Windows\System\zYcbInX.exe
  C:\Windows\System\zYcbInX.exe
  2⤵
  PID:3416
- C:\Windows\System\owLsuRR.exe
  C:\Windows\System\owLsuRR.exe
  2⤵
  PID:1988
- C:\Windows\System\CyVrlSA.exe
  C:\Windows\System\CyVrlSA.exe
  2⤵
  PID:3076
- C:\Windows\System\CCFdXkL.exe
  C:\Windows\System\CCFdXkL.exe
  2⤵
  PID:3176
- C:\Windows\System\IVDagVf.exe
  C:\Windows\System\IVDagVf.exe
  2⤵
  PID:3568
- C:\Windows\System\esEOJsK.exe
  C:\Windows\System\esEOJsK.exe
  2⤵
  PID:3284
- C:\Windows\System\zRUgbfO.exe
  C:\Windows\System\zRUgbfO.exe
  2⤵
  PID:3320
- C:\Windows\System\pIOGkbT.exe
  C:\Windows\System\pIOGkbT.exe
  2⤵
  PID:3708
- C:\Windows\System\ZJSVzrk.exe
  C:\Windows\System\ZJSVzrk.exe
  2⤵
  PID:3452
- C:\Windows\System\MBdYVet.exe
  C:\Windows\System\MBdYVet.exe
  2⤵
  PID:3952
- C:\Windows\System\FUQqpuS.exe
  C:\Windows\System\FUQqpuS.exe
  2⤵
  PID:3440
- C:\Windows\System\pQHFFBl.exe
  C:\Windows\System\pQHFFBl.exe
  2⤵
  PID:3652
- C:\Windows\System\IlVkFqw.exe
  C:\Windows\System\IlVkFqw.exe
  2⤵
  PID:2220
- C:\Windows\System\vbwNaWC.exe
  C:\Windows\System\vbwNaWC.exe
  2⤵
  PID:2620
- C:\Windows\System\zvuuxAy.exe
  C:\Windows\System\zvuuxAy.exe
  2⤵
  PID:3764
- C:\Windows\System\vsRuipm.exe
  C:\Windows\System\vsRuipm.exe
  2⤵
  PID:1872
- C:\Windows\System\rMzmrMX.exe
  C:\Windows\System\rMzmrMX.exe
  2⤵
  PID:1544
- C:\Windows\System\VltxlAa.exe
  C:\Windows\System\VltxlAa.exe
  2⤵
  PID:3920
- C:\Windows\System\lViUrsH.exe
  C:\Windows\System\lViUrsH.exe
  2⤵
  PID:3052
- C:\Windows\System\LJRFwqC.exe
  C:\Windows\System\LJRFwqC.exe
  2⤵
  PID:4028
- C:\Windows\System\haasJAe.exe
  C:\Windows\System\haasJAe.exe
  2⤵
  PID:4048
- C:\Windows\System\bxbRYmS.exe
  C:\Windows\System\bxbRYmS.exe
  2⤵
  PID:1340
- C:\Windows\System\tFzUEYK.exe
  C:\Windows\System\tFzUEYK.exe
  2⤵
  PID:3236
- C:\Windows\System\mrSogAk.exe
  C:\Windows\System\mrSogAk.exe
  2⤵
  PID:2468
- C:\Windows\System\NeDvAXh.exe
  C:\Windows\System\NeDvAXh.exe
  2⤵
  PID:2264
- C:\Windows\System\bnjQcWg.exe
  C:\Windows\System\bnjQcWg.exe
  2⤵
  PID:3180
- C:\Windows\System\kvTFcSY.exe
  C:\Windows\System\kvTFcSY.exe
  2⤵
  PID:3276
- C:\Windows\System\eFCgtcF.exe
  C:\Windows\System\eFCgtcF.exe
  2⤵
  PID:3376
- C:\Windows\System\FXREluA.exe
  C:\Windows\System\FXREluA.exe
  2⤵
  PID:3380
- C:\Windows\System\NRkzlNY.exe
  C:\Windows\System\NRkzlNY.exe
  2⤵
  PID:4108
- C:\Windows\System\OFvQbdj.exe
  C:\Windows\System\OFvQbdj.exe
  2⤵
  PID:4128
- C:\Windows\System\zGYECvH.exe
  C:\Windows\System\zGYECvH.exe
  2⤵
  PID:4148
- C:\Windows\System\JmerbDJ.exe
  C:\Windows\System\JmerbDJ.exe
  2⤵
  PID:4164
- C:\Windows\System\oWgRYJK.exe
  C:\Windows\System\oWgRYJK.exe
  2⤵
  PID:4180
- C:\Windows\System\dOaRTeA.exe
  C:\Windows\System\dOaRTeA.exe
  2⤵
  PID:4196
- C:\Windows\System\cUERreW.exe
  C:\Windows\System\cUERreW.exe
  2⤵
  PID:4220
- C:\Windows\System\nvxOBdL.exe
  C:\Windows\System\nvxOBdL.exe
  2⤵
  PID:4252
- C:\Windows\System\rSpQFra.exe
  C:\Windows\System\rSpQFra.exe
  2⤵
  PID:4272
- C:\Windows\System\qoqLmWb.exe
  C:\Windows\System\qoqLmWb.exe
  2⤵
  PID:4292
- C:\Windows\System\BDAzsJL.exe
  C:\Windows\System\BDAzsJL.exe
  2⤵
  PID:4308
- C:\Windows\System\zkHtyVz.exe
  C:\Windows\System\zkHtyVz.exe
  2⤵
  PID:4324
- C:\Windows\System\VXBCIoN.exe
  C:\Windows\System\VXBCIoN.exe
  2⤵
  PID:4340
- C:\Windows\System\VXLGRta.exe
  C:\Windows\System\VXLGRta.exe
  2⤵
  PID:4356
- C:\Windows\System\MxRUDgQ.exe
  C:\Windows\System\MxRUDgQ.exe
  2⤵
  PID:4372
- C:\Windows\System\BfoAyFh.exe
  C:\Windows\System\BfoAyFh.exe
  2⤵
  PID:4388
- C:\Windows\System\sOrxbXk.exe
  C:\Windows\System\sOrxbXk.exe
  2⤵
  PID:4404
- C:\Windows\System\niNpnjZ.exe
  C:\Windows\System\niNpnjZ.exe
  2⤵
  PID:4420
- C:\Windows\System\yhbKzSF.exe
  C:\Windows\System\yhbKzSF.exe
  2⤵
  PID:4436
- C:\Windows\System\mICDZLL.exe
  C:\Windows\System\mICDZLL.exe
  2⤵
  PID:4452
- C:\Windows\System\tGhBRgB.exe
  C:\Windows\System\tGhBRgB.exe
  2⤵
  PID:4492
- C:\Windows\System\XGyEqWW.exe
  C:\Windows\System\XGyEqWW.exe
  2⤵
  PID:4512
- C:\Windows\System\tEbWgLx.exe
  C:\Windows\System\tEbWgLx.exe
  2⤵
  PID:4532
- C:\Windows\System\BOgueym.exe
  C:\Windows\System\BOgueym.exe
  2⤵
  PID:4564
- C:\Windows\System\PQTltPa.exe
  C:\Windows\System\PQTltPa.exe
  2⤵
  PID:4580
- C:\Windows\System\lCMyZPW.exe
  C:\Windows\System\lCMyZPW.exe
  2⤵
  PID:4608
- C:\Windows\System\PTNBbKt.exe
  C:\Windows\System\PTNBbKt.exe
  2⤵
  PID:4632
- C:\Windows\System\ZkunQXP.exe
  C:\Windows\System\ZkunQXP.exe
  2⤵
  PID:4648
- C:\Windows\System\qjkJPcw.exe
  C:\Windows\System\qjkJPcw.exe
  2⤵
  PID:4664
- C:\Windows\System\PMilaNs.exe
  C:\Windows\System\PMilaNs.exe
  2⤵
  PID:4684
- C:\Windows\System\riIXKEZ.exe
  C:\Windows\System\riIXKEZ.exe
  2⤵
  PID:4704
- C:\Windows\System\eJADxWh.exe
  C:\Windows\System\eJADxWh.exe
  2⤵
  PID:4720
- C:\Windows\System\YVnbeJY.exe
  C:\Windows\System\YVnbeJY.exe
  2⤵
  PID:4740
- C:\Windows\System\KTnCnUX.exe
  C:\Windows\System\KTnCnUX.exe
  2⤵
  PID:4760
- C:\Windows\System\KFJpbxu.exe
  C:\Windows\System\KFJpbxu.exe
  2⤵
  PID:4816
- C:\Windows\System\LbJMCgB.exe
  C:\Windows\System\LbJMCgB.exe
  2⤵
  PID:4832
- C:\Windows\System\gdGXWQH.exe
  C:\Windows\System\gdGXWQH.exe
  2⤵
  PID:4856
- C:\Windows\System\nYCYHrA.exe
  C:\Windows\System\nYCYHrA.exe
  2⤵
  PID:4872
- C:\Windows\System\VeKcfia.exe
  C:\Windows\System\VeKcfia.exe
  2⤵
  PID:4892
- C:\Windows\System\XHpIEed.exe
  C:\Windows\System\XHpIEed.exe
  2⤵
  PID:4916
- C:\Windows\System\kATVdJN.exe
  C:\Windows\System\kATVdJN.exe
  2⤵
  PID:4936
- C:\Windows\System\YlKRqyA.exe
  C:\Windows\System\YlKRqyA.exe
  2⤵
  PID:4956
- C:\Windows\System\kXJlrMT.exe
  C:\Windows\System\kXJlrMT.exe
  2⤵
  PID:4976
- C:\Windows\System\fyIFhrO.exe
  C:\Windows\System\fyIFhrO.exe
  2⤵
  PID:4996
- C:\Windows\System\RxypJxZ.exe
  C:\Windows\System\RxypJxZ.exe
  2⤵
  PID:5016
- C:\Windows\System\NDiokNv.exe
  C:\Windows\System\NDiokNv.exe
  2⤵
  PID:5036
- C:\Windows\System\MXEpkqR.exe
  C:\Windows\System\MXEpkqR.exe
  2⤵
  PID:5056
- C:\Windows\System\BXptgIg.exe
  C:\Windows\System\BXptgIg.exe
  2⤵
  PID:5076
- C:\Windows\System\YOwwTUD.exe
  C:\Windows\System\YOwwTUD.exe
  2⤵
  PID:5096
- C:\Windows\System\DewAtLc.exe
  C:\Windows\System\DewAtLc.exe
  2⤵
  PID:5116
- C:\Windows\System\lMuwvdR.exe
  C:\Windows\System\lMuwvdR.exe
  2⤵
  PID:3748
- C:\Windows\System\bhYWKKq.exe
  C:\Windows\System\bhYWKKq.exe
  2⤵
  PID:3496
- C:\Windows\System\negsINU.exe
  C:\Windows\System\negsINU.exe
  2⤵
  PID:3616
- C:\Windows\System\VeQENmn.exe
  C:\Windows\System\VeQENmn.exe
  2⤵
  PID:3840
- C:\Windows\System\FauZBcn.exe
  C:\Windows\System\FauZBcn.exe
  2⤵
  PID:2224
- C:\Windows\System\MFNIary.exe
  C:\Windows\System\MFNIary.exe
  2⤵
  PID:276
- C:\Windows\System\RbGrsYy.exe
  C:\Windows\System\RbGrsYy.exe
  2⤵
  PID:3492
- C:\Windows\System\VhZVuhM.exe
  C:\Windows\System\VhZVuhM.exe
  2⤵
  PID:3120
- C:\Windows\System\gDBafCZ.exe
  C:\Windows\System\gDBafCZ.exe
  2⤵
  PID:3828
- C:\Windows\System\iCIAmrw.exe
  C:\Windows\System\iCIAmrw.exe
  2⤵
  PID:3912
- C:\Windows\System\iCuATqP.exe
  C:\Windows\System\iCuATqP.exe
  2⤵
  PID:2044
- C:\Windows\System\YBHzknj.exe
  C:\Windows\System\YBHzknj.exe
  2⤵
  PID:4144
- C:\Windows\System\dWFqBOw.exe
  C:\Windows\System\dWFqBOw.exe
  2⤵
  PID:4212
- C:\Windows\System\URRGMzB.exe
  C:\Windows\System\URRGMzB.exe
  2⤵
  PID:4268
- C:\Windows\System\ZNEssDg.exe
  C:\Windows\System\ZNEssDg.exe
  2⤵
  PID:1716
- C:\Windows\System\vsKHozi.exe
  C:\Windows\System\vsKHozi.exe
  2⤵
  PID:4300
- C:\Windows\System\OxOenqU.exe
  C:\Windows\System\OxOenqU.exe
  2⤵
  PID:3316
- C:\Windows\System\NUOsDTi.exe
  C:\Windows\System\NUOsDTi.exe
  2⤵
  PID:4188
- C:\Windows\System\PZJToeG.exe
  C:\Windows\System\PZJToeG.exe
  2⤵
  PID:4120
- C:\Windows\System\HXmqzrj.exe
  C:\Windows\System\HXmqzrj.exe
  2⤵
  PID:4240
- C:\Windows\System\QlsAmFe.exe
  C:\Windows\System\QlsAmFe.exe
  2⤵
  PID:4460
- C:\Windows\System\wonJUTd.exe
  C:\Windows\System\wonJUTd.exe
  2⤵
  PID:4484
- C:\Windows\System\uJarGsR.exe
  C:\Windows\System\uJarGsR.exe
  2⤵
  PID:4528
- C:\Windows\System\PCaKVYA.exe
  C:\Windows\System\PCaKVYA.exe
  2⤵
  PID:4316
- C:\Windows\System\tExOhPD.exe
  C:\Windows\System\tExOhPD.exe
  2⤵
  PID:4380
- C:\Windows\System\XPxDIDH.exe
  C:\Windows\System\XPxDIDH.exe
  2⤵
  PID:4576
- C:\Windows\System\cDiPiMy.exe
  C:\Windows\System\cDiPiMy.exe
  2⤵
  PID:4624
- C:\Windows\System\XWOOvvx.exe
  C:\Windows\System\XWOOvvx.exe
  2⤵
  PID:4660
- C:\Windows\System\KaAiKhr.exe
  C:\Windows\System\KaAiKhr.exe
  2⤵
  PID:4736
- C:\Windows\System\ZbasGeY.exe
  C:\Windows\System\ZbasGeY.exe
  2⤵
  PID:4540
- C:\Windows\System\EqYZbyy.exe
  C:\Windows\System\EqYZbyy.exe
  2⤵
  PID:4780
- C:\Windows\System\tlfYKrD.exe
  C:\Windows\System\tlfYKrD.exe
  2⤵
  PID:4644
- C:\Windows\System\fmZVjBS.exe
  C:\Windows\System\fmZVjBS.exe
  2⤵
  PID:4712
- C:\Windows\System\SRGXpgR.exe
  C:\Windows\System\SRGXpgR.exe
  2⤵
  PID:4552
- C:\Windows\System\LthLhYG.exe
  C:\Windows\System\LthLhYG.exe
  2⤵
  PID:4844
- C:\Windows\System\TxSDyQG.exe
  C:\Windows\System\TxSDyQG.exe
  2⤵
  PID:4880
- C:\Windows\System\FWICPKK.exe
  C:\Windows\System\FWICPKK.exe
  2⤵
  PID:4904
- C:\Windows\System\SEnyUni.exe
  C:\Windows\System\SEnyUni.exe
  2⤵
  PID:4928
- C:\Windows\System\FFJvRBO.exe
  C:\Windows\System\FFJvRBO.exe
  2⤵
  PID:4948
- C:\Windows\System\IQIGkPr.exe
  C:\Windows\System\IQIGkPr.exe
  2⤵
  PID:4988
- C:\Windows\System\mzTTTtf.exe
  C:\Windows\System\mzTTTtf.exe
  2⤵
  PID:5032
- C:\Windows\System\wEUCFtn.exe
  C:\Windows\System\wEUCFtn.exe
  2⤵
  PID:2576
- C:\Windows\System\eLjtfNx.exe
  C:\Windows\System\eLjtfNx.exe
  2⤵
  PID:5092
- C:\Windows\System\ZjKVJoY.exe
  C:\Windows\System\ZjKVJoY.exe
  2⤵
  PID:5104
- C:\Windows\System\GRpbnyi.exe
  C:\Windows\System\GRpbnyi.exe
  2⤵
  PID:3552
- C:\Windows\System\phxXMSM.exe
  C:\Windows\System\phxXMSM.exe
  2⤵
  PID:3836
- C:\Windows\System\yzrBwZj.exe
  C:\Windows\System\yzrBwZj.exe
  2⤵
  PID:2208
- C:\Windows\System\sXWGiLU.exe
  C:\Windows\System\sXWGiLU.exe
  2⤵
  PID:2688
- C:\Windows\System\bOEvguc.exe
  C:\Windows\System\bOEvguc.exe
  2⤵
  PID:3116
- C:\Windows\System\YQIoYIG.exe
  C:\Windows\System\YQIoYIG.exe
  2⤵
  PID:1092
- C:\Windows\System\KSljrlD.exe
  C:\Windows\System\KSljrlD.exe
  2⤵
  PID:4172
- C:\Windows\System\IQZBNYb.exe
  C:\Windows\System\IQZBNYb.exe
  2⤵
  PID:1656
- C:\Windows\System\KHpMcKi.exe
  C:\Windows\System\KHpMcKi.exe
  2⤵
  PID:3184
- C:\Windows\System\SYmrlYA.exe
  C:\Windows\System\SYmrlYA.exe
  2⤵
  PID:3796
- C:\Windows\System\ISvYfWf.exe
  C:\Windows\System\ISvYfWf.exe
  2⤵
  PID:4364
- C:\Windows\System\gaIHWXr.exe
  C:\Windows\System\gaIHWXr.exe
  2⤵
  PID:4156
- C:\Windows\System\zbZYZCH.exe
  C:\Windows\System\zbZYZCH.exe
  2⤵
  PID:4472
- C:\Windows\System\CObUfUw.exe
  C:\Windows\System\CObUfUw.exe
  2⤵
  PID:4284
- C:\Windows\System\BNuauuT.exe
  C:\Windows\System\BNuauuT.exe
  2⤵
  PID:4412
- C:\Windows\System\kESSSpz.exe
  C:\Windows\System\kESSSpz.exe
  2⤵
  PID:4628
- C:\Windows\System\JWRxQer.exe
  C:\Windows\System\JWRxQer.exe
  2⤵
  PID:4500
- C:\Windows\System\AFMvwoh.exe
  C:\Windows\System\AFMvwoh.exe
  2⤵
  PID:4556
- C:\Windows\System\qcWaiaj.exe
  C:\Windows\System\qcWaiaj.exe
  2⤵
  PID:4640
- C:\Windows\System\SFmguwj.exe
  C:\Windows\System\SFmguwj.exe
  2⤵
  PID:4808
- C:\Windows\System\QHkUTmX.exe
  C:\Windows\System\QHkUTmX.exe
  2⤵
  PID:4840
- C:\Windows\System\bJvlfrQ.exe
  C:\Windows\System\bJvlfrQ.exe
  2⤵
  PID:4852
- C:\Windows\System\UnmFQtI.exe
  C:\Windows\System\UnmFQtI.exe
  2⤵
  PID:4944
- C:\Windows\System\pgDTqwH.exe
  C:\Windows\System\pgDTqwH.exe
  2⤵
  PID:5012
- C:\Windows\System\ZILmaEQ.exe
  C:\Windows\System\ZILmaEQ.exe
  2⤵
  PID:5064
- C:\Windows\System\usUQaVH.exe
  C:\Windows\System\usUQaVH.exe
  2⤵
  PID:2612
- C:\Windows\System\XMbFpaK.exe
  C:\Windows\System\XMbFpaK.exe
  2⤵
  PID:3592
- C:\Windows\System\ntTgdVw.exe
  C:\Windows\System\ntTgdVw.exe
  2⤵
  PID:3724
- C:\Windows\System\TeKHoRu.exe
  C:\Windows\System\TeKHoRu.exe
  2⤵
  PID:2420
- C:\Windows\System\vjKZOTy.exe
  C:\Windows\System\vjKZOTy.exe
  2⤵
  PID:3880
- C:\Windows\System\fZSxltR.exe
  C:\Windows\System\fZSxltR.exe
  2⤵
  PID:4176
- C:\Windows\System\oOoMXBN.exe
  C:\Windows\System\oOoMXBN.exe
  2⤵
  PID:5132
- C:\Windows\System\QzUwSvU.exe
  C:\Windows\System\QzUwSvU.exe
  2⤵
  PID:5152
- C:\Windows\System\CokUzOS.exe
  C:\Windows\System\CokUzOS.exe
  2⤵
  PID:5172
- C:\Windows\System\xIlviZQ.exe
  C:\Windows\System\xIlviZQ.exe
  2⤵
  PID:5192
- C:\Windows\System\FQUrdED.exe
  C:\Windows\System\FQUrdED.exe
  2⤵
  PID:5212
- C:\Windows\System\JXhqnNQ.exe
  C:\Windows\System\JXhqnNQ.exe
  2⤵
  PID:5232
- C:\Windows\System\PYPUpLL.exe
  C:\Windows\System\PYPUpLL.exe
  2⤵
  PID:5252
- C:\Windows\System\YsdxOqw.exe
  C:\Windows\System\YsdxOqw.exe
  2⤵
  PID:5272
- C:\Windows\System\sqLqhoG.exe
  C:\Windows\System\sqLqhoG.exe
  2⤵
  PID:5292
- C:\Windows\System\SBrdlCf.exe
  C:\Windows\System\SBrdlCf.exe
  2⤵
  PID:5312
- C:\Windows\System\weAQzmG.exe
  C:\Windows\System\weAQzmG.exe
  2⤵
  PID:5332
- C:\Windows\System\aqCttKf.exe
  C:\Windows\System\aqCttKf.exe
  2⤵
  PID:5352
- C:\Windows\System\HoynxEi.exe
  C:\Windows\System\HoynxEi.exe
  2⤵
  PID:5368
- C:\Windows\System\hMtYARj.exe
  C:\Windows\System\hMtYARj.exe
  2⤵
  PID:5384
- C:\Windows\System\oQZMBZb.exe
  C:\Windows\System\oQZMBZb.exe
  2⤵
  PID:5408
- C:\Windows\System\hUiSRXR.exe
  C:\Windows\System\hUiSRXR.exe
  2⤵
  PID:5424
- C:\Windows\System\RQGlQcL.exe
  C:\Windows\System\RQGlQcL.exe
  2⤵
  PID:5452
- C:\Windows\System\zLnpmjU.exe
  C:\Windows\System\zLnpmjU.exe
  2⤵
  PID:5472
- C:\Windows\System\QgXcGKg.exe
  C:\Windows\System\QgXcGKg.exe
  2⤵
  PID:5492
- C:\Windows\System\gQXRdeg.exe
  C:\Windows\System\gQXRdeg.exe
  2⤵
  PID:5508
- C:\Windows\System\qclAuNI.exe
  C:\Windows\System\qclAuNI.exe
  2⤵
  PID:5532
- C:\Windows\System\gOUbWFO.exe
  C:\Windows\System\gOUbWFO.exe
  2⤵
  PID:5552
- C:\Windows\System\jTwWDSz.exe
  C:\Windows\System\jTwWDSz.exe
  2⤵
  PID:5572
- C:\Windows\System\DItyGfl.exe
  C:\Windows\System\DItyGfl.exe
  2⤵
  PID:5592
- C:\Windows\System\gHkSoyW.exe
  C:\Windows\System\gHkSoyW.exe
  2⤵
  PID:5612
- C:\Windows\System\vMIgyzt.exe
  C:\Windows\System\vMIgyzt.exe
  2⤵
  PID:5632
- C:\Windows\System\BjdnAWg.exe
  C:\Windows\System\BjdnAWg.exe
  2⤵
  PID:5652
- C:\Windows\System\gwMcErB.exe
  C:\Windows\System\gwMcErB.exe
  2⤵
  PID:5672
- C:\Windows\System\mWMjnCy.exe
  C:\Windows\System\mWMjnCy.exe
  2⤵
  PID:5692
- C:\Windows\System\tdmUmwg.exe
  C:\Windows\System\tdmUmwg.exe
  2⤵
  PID:5712
- C:\Windows\System\nefBcor.exe
  C:\Windows\System\nefBcor.exe
  2⤵
  PID:5728
- C:\Windows\System\BafCBFr.exe
  C:\Windows\System\BafCBFr.exe
  2⤵
  PID:5752
- C:\Windows\System\ftcoSIc.exe
  C:\Windows\System\ftcoSIc.exe
  2⤵
  PID:5768
- C:\Windows\System\zEqxsta.exe
  C:\Windows\System\zEqxsta.exe
  2⤵
  PID:5792
- C:\Windows\System\aFjYkws.exe
  C:\Windows\System\aFjYkws.exe
  2⤵
  PID:5812
- C:\Windows\System\JqFfJgE.exe
  C:\Windows\System\JqFfJgE.exe
  2⤵
  PID:5832
- C:\Windows\System\sjVHFRt.exe
  C:\Windows\System\sjVHFRt.exe
  2⤵
  PID:5852
- C:\Windows\System\sZZiEjK.exe
  C:\Windows\System\sZZiEjK.exe
  2⤵
  PID:5872
- C:\Windows\System\uwIcYJL.exe
  C:\Windows\System\uwIcYJL.exe
  2⤵
  PID:5892
- C:\Windows\System\nvPxorI.exe
  C:\Windows\System\nvPxorI.exe
  2⤵
  PID:5912
- C:\Windows\System\TqZUoli.exe
  C:\Windows\System\TqZUoli.exe
  2⤵
  PID:5932
- C:\Windows\System\toNyahd.exe
  C:\Windows\System\toNyahd.exe
  2⤵
  PID:5952
- C:\Windows\System\fiwEKQV.exe
  C:\Windows\System\fiwEKQV.exe
  2⤵
  PID:5972
- C:\Windows\System\YCNtsXl.exe
  C:\Windows\System\YCNtsXl.exe
  2⤵
  PID:5992
- C:\Windows\System\PCuWPmt.exe
  C:\Windows\System\PCuWPmt.exe
  2⤵
  PID:6012
- C:\Windows\System\IiDpWIP.exe
  C:\Windows\System\IiDpWIP.exe
  2⤵
  PID:6028
- C:\Windows\System\WIkObEm.exe
  C:\Windows\System\WIkObEm.exe
  2⤵
  PID:6052
- C:\Windows\System\vuiNDGP.exe
  C:\Windows\System\vuiNDGP.exe
  2⤵
  PID:6072
- C:\Windows\System\NLnnOAr.exe
  C:\Windows\System\NLnnOAr.exe
  2⤵
  PID:6092
- C:\Windows\System\hFajRUH.exe
  C:\Windows\System\hFajRUH.exe
  2⤵
  PID:6112
- C:\Windows\System\GAfPVHo.exe
  C:\Windows\System\GAfPVHo.exe
  2⤵
  PID:6132
- C:\Windows\System\BvBHYUm.exe
  C:\Windows\System\BvBHYUm.exe
  2⤵
  PID:4304
- C:\Windows\System\wwgwcTt.exe
  C:\Windows\System\wwgwcTt.exe
  2⤵
  PID:4368
- C:\Windows\System\gXMwhwZ.exe
  C:\Windows\System\gXMwhwZ.exe
  2⤵
  PID:4396
- C:\Windows\System\IbMIKFa.exe
  C:\Windows\System\IbMIKFa.exe
  2⤵
  PID:4572
- C:\Windows\System\DgIDNGR.exe
  C:\Windows\System\DgIDNGR.exe
  2⤵
  PID:4656
- C:\Windows\System\zlvlqyj.exe
  C:\Windows\System\zlvlqyj.exe
  2⤵
  PID:2692
- C:\Windows\System\VObpsyE.exe
  C:\Windows\System\VObpsyE.exe
  2⤵
  PID:4676
- C:\Windows\System\nSWCkJJ.exe
  C:\Windows\System\nSWCkJJ.exe
  2⤵
  PID:4756
- C:\Windows\System\GCJxmoM.exe
  C:\Windows\System\GCJxmoM.exe
  2⤵
  PID:4964
- C:\Windows\System\xNJAdei.exe
  C:\Windows\System\xNJAdei.exe
  2⤵
  PID:5048
- C:\Windows\System\jzMcQMz.exe
  C:\Windows\System\jzMcQMz.exe
  2⤵
  PID:5068
- C:\Windows\System\suKtovz.exe
  C:\Windows\System\suKtovz.exe
  2⤵
  PID:3532
- C:\Windows\System\PVNjBuk.exe
  C:\Windows\System\PVNjBuk.exe
  2⤵
  PID:3104
- C:\Windows\System\YgyhUef.exe
  C:\Windows\System\YgyhUef.exe
  2⤵
  PID:2148
- C:\Windows\System\owSsoRS.exe
  C:\Windows\System\owSsoRS.exe
  2⤵
  PID:5140
- C:\Windows\System\zODErby.exe
  C:\Windows\System\zODErby.exe
  2⤵
  PID:5184
- C:\Windows\System\iFYaSPs.exe
  C:\Windows\System\iFYaSPs.exe
  2⤵
  PID:5168
- C:\Windows\System\LwjpTOe.exe
  C:\Windows\System\LwjpTOe.exe
  2⤵
  PID:5224
- C:\Windows\System\pLTOaEs.exe
  C:\Windows\System\pLTOaEs.exe
  2⤵
  PID:5248
- C:\Windows\System\RjuPToM.exe
  C:\Windows\System\RjuPToM.exe
  2⤵
  PID:5288
- C:\Windows\System\JYFlvww.exe
  C:\Windows\System\JYFlvww.exe
  2⤵
  PID:5340
- C:\Windows\System\nXqFyyp.exe
  C:\Windows\System\nXqFyyp.exe
  2⤵
  PID:5348
- C:\Windows\System\zOezFyC.exe
  C:\Windows\System\zOezFyC.exe
  2⤵
  PID:5420
- C:\Windows\System\qIFNXHQ.exe
  C:\Windows\System\qIFNXHQ.exe
  2⤵
  PID:5432
- C:\Windows\System\ilaeLDp.exe
  C:\Windows\System\ilaeLDp.exe
  2⤵
  PID:5448
- C:\Windows\System\NrVxqCG.exe
  C:\Windows\System\NrVxqCG.exe
  2⤵
  PID:5480
- C:\Windows\System\FhdBWDf.exe
  C:\Windows\System\FhdBWDf.exe
  2⤵
  PID:5516
- C:\Windows\System\ijfHcYu.exe
  C:\Windows\System\ijfHcYu.exe
  2⤵
  PID:5580
- C:\Windows\System\RcmNJfl.exe
  C:\Windows\System\RcmNJfl.exe
  2⤵
  PID:5588
- C:\Windows\System\UVkDsSZ.exe
  C:\Windows\System\UVkDsSZ.exe
  2⤵
  PID:5624
- C:\Windows\System\TsSSDsz.exe
  C:\Windows\System\TsSSDsz.exe
  2⤵
  PID:5644
- C:\Windows\System\FAwKLLG.exe
  C:\Windows\System\FAwKLLG.exe
  2⤵
  PID:5680
- C:\Windows\System\lgvkGCG.exe
  C:\Windows\System\lgvkGCG.exe
  2⤵
  PID:5736
- C:\Windows\System\ZryUGti.exe
  C:\Windows\System\ZryUGti.exe
  2⤵
  PID:5720
- C:\Windows\System\iPZUrEe.exe
  C:\Windows\System\iPZUrEe.exe
  2⤵
  PID:5784
- C:\Windows\System\Qgjjksp.exe
  C:\Windows\System\Qgjjksp.exe
  2⤵
  PID:5788
- C:\Windows\System\yvNazTN.exe
  C:\Windows\System\yvNazTN.exe
  2⤵
  PID:5824
- C:\Windows\System\yGgcsQO.exe
  C:\Windows\System\yGgcsQO.exe
  2⤵
  PID:5868
- C:\Windows\System\zpYImul.exe
  C:\Windows\System\zpYImul.exe
  2⤵
  PID:5908
- C:\Windows\System\jGrxnLH.exe
  C:\Windows\System\jGrxnLH.exe
  2⤵
  PID:5920
- C:\Windows\System\POaYKmU.exe
  C:\Windows\System\POaYKmU.exe
  2⤵
  PID:5964
- C:\Windows\System\DtztLGH.exe
  C:\Windows\System\DtztLGH.exe
  2⤵
  PID:6000
- C:\Windows\System\stXUHnU.exe
  C:\Windows\System\stXUHnU.exe
  2⤵
  PID:6036
- C:\Windows\System\LzgOumm.exe
  C:\Windows\System\LzgOumm.exe
  2⤵
  PID:6048
- C:\Windows\System\SRKlbbX.exe
  C:\Windows\System\SRKlbbX.exe
  2⤵
  PID:6100
- C:\Windows\System\qQLCDXE.exe
  C:\Windows\System\qQLCDXE.exe
  2⤵
  PID:6120
- C:\Windows\System\THireDb.exe
  C:\Windows\System\THireDb.exe
  2⤵
  PID:4336
- C:\Windows\System\eanCAEb.exe
  C:\Windows\System\eanCAEb.exe
  2⤵
  PID:4480
- C:\Windows\System\EwNXxci.exe
  C:\Windows\System\EwNXxci.exe
  2⤵
  PID:4696
- C:\Windows\System\TfvhaZF.exe
  C:\Windows\System\TfvhaZF.exe
  2⤵
  PID:4560
- C:\Windows\System\auLrSYM.exe
  C:\Windows\System\auLrSYM.exe
  2⤵
  PID:4864
- C:\Windows\System\ARWiKJn.exe
  C:\Windows\System\ARWiKJn.exe
  2⤵
  PID:4992
- C:\Windows\System\elIbrcy.exe
  C:\Windows\System\elIbrcy.exe
  2⤵
  PID:3988
- C:\Windows\System\BCLrbjk.exe
  C:\Windows\System\BCLrbjk.exe
  2⤵
  PID:5072
- C:\Windows\System\oMIMcdQ.exe
  C:\Windows\System\oMIMcdQ.exe
  2⤵
  PID:4264
- C:\Windows\System\yMVpEjU.exe
  C:\Windows\System\yMVpEjU.exe
  2⤵
  PID:5228
- C:\Windows\System\IYtSHkn.exe
  C:\Windows\System\IYtSHkn.exe
  2⤵
  PID:2724
- C:\Windows\System\ACfHULg.exe
  C:\Windows\System\ACfHULg.exe
  2⤵
  PID:5284
- C:\Windows\System\xevapSz.exe
  C:\Windows\System\xevapSz.exe
  2⤵
  PID:5360
- C:\Windows\System\qgKDSQn.exe
  C:\Windows\System\qgKDSQn.exe
  2⤵
  PID:5440
- C:\Windows\System\gCSBpPE.exe
  C:\Windows\System\gCSBpPE.exe
  2⤵
  PID:5404
- C:\Windows\System\SIqTJUL.exe
  C:\Windows\System\SIqTJUL.exe
  2⤵
  PID:5540
- C:\Windows\System\Ywiqeoo.exe
  C:\Windows\System\Ywiqeoo.exe
  2⤵
  PID:2608
- C:\Windows\System\naabqzF.exe
  C:\Windows\System\naabqzF.exe
  2⤵
  PID:5600
- C:\Windows\System\wgmPIuS.exe
  C:\Windows\System\wgmPIuS.exe
  2⤵
  PID:5668
- C:\Windows\System\djJNDpb.exe
  C:\Windows\System\djJNDpb.exe
  2⤵
  PID:5704
- C:\Windows\System\oqqXGFH.exe
  C:\Windows\System\oqqXGFH.exe
  2⤵
  PID:5748
- C:\Windows\System\CnKxdyo.exe
  C:\Windows\System\CnKxdyo.exe
  2⤵
  PID:5828
- C:\Windows\System\NhhJeKg.exe
  C:\Windows\System\NhhJeKg.exe
  2⤵
  PID:5864
- C:\Windows\System\xnyfkRO.exe
  C:\Windows\System\xnyfkRO.exe
  2⤵
  PID:5928
- C:\Windows\System\bvrRCWF.exe
  C:\Windows\System\bvrRCWF.exe
  2⤵
  PID:5948
- C:\Windows\System\ytUVivZ.exe
  C:\Windows\System\ytUVivZ.exe
  2⤵
  PID:6024
- C:\Windows\System\SvRglzf.exe
  C:\Windows\System\SvRglzf.exe
  2⤵
  PID:6044
- C:\Windows\System\BpeYFWN.exe
  C:\Windows\System\BpeYFWN.exe
  2⤵
  PID:2768
- C:\Windows\System\XjMrXrH.exe
  C:\Windows\System\XjMrXrH.exe
  2⤵
  PID:4468
- C:\Windows\System\rQQUGQs.exe
  C:\Windows\System\rQQUGQs.exe
  2⤵
  PID:4280
- C:\Windows\System\ioYqllU.exe
  C:\Windows\System\ioYqllU.exe
  2⤵
  PID:4680
- C:\Windows\System\CtzhPcI.exe
  C:\Windows\System\CtzhPcI.exe
  2⤵
  PID:3596
- C:\Windows\System\AdoZaSm.exe
  C:\Windows\System\AdoZaSm.exe
  2⤵
  PID:1372
- C:\Windows\System\qRqkPWL.exe
  C:\Windows\System\qRqkPWL.exe
  2⤵
  PID:5220
- C:\Windows\System\nYcpSdT.exe
  C:\Windows\System\nYcpSdT.exe
  2⤵
  PID:5280
- C:\Windows\System\DQprKLa.exe
  C:\Windows\System\DQprKLa.exe
  2⤵
  PID:5300
- C:\Windows\System\FyeIfEL.exe
  C:\Windows\System\FyeIfEL.exe
  2⤵
  PID:5396
- C:\Windows\System\wvPdHtx.exe
  C:\Windows\System\wvPdHtx.exe
  2⤵
  PID:5568
- C:\Windows\System\PPcaSAu.exe
  C:\Windows\System\PPcaSAu.exe
  2⤵
  PID:5548
- C:\Windows\System\unfvKHr.exe
  C:\Windows\System\unfvKHr.exe
  2⤵
  PID:5640
- C:\Windows\System\bjNiuUH.exe
  C:\Windows\System\bjNiuUH.exe
  2⤵
  PID:5648
- C:\Windows\System\LKqHLbT.exe
  C:\Windows\System\LKqHLbT.exe
  2⤵
  PID:5860
- C:\Windows\System\XeBGAom.exe
  C:\Windows\System\XeBGAom.exe
  2⤵
  PID:5884
- C:\Windows\System\hdEoriI.exe
  C:\Windows\System\hdEoriI.exe
  2⤵
  PID:1368
- C:\Windows\System\itgtzxu.exe
  C:\Windows\System\itgtzxu.exe
  2⤵
  PID:6088
- C:\Windows\System\twmqWWZ.exe
  C:\Windows\System\twmqWWZ.exe
  2⤵
  PID:1880
- C:\Windows\System\fVuJtOj.exe
  C:\Windows\System\fVuJtOj.exe
  2⤵
  PID:6128
- C:\Windows\System\jfghubO.exe
  C:\Windows\System\jfghubO.exe
  2⤵
  PID:4968
- C:\Windows\System\VFYvlAz.exe
  C:\Windows\System\VFYvlAz.exe
  2⤵
  PID:4812
- C:\Windows\System\hlRFRvm.exe
  C:\Windows\System\hlRFRvm.exe
  2⤵
  PID:5204
- C:\Windows\System\TjliqqP.exe
  C:\Windows\System\TjliqqP.exe
  2⤵
  PID:5380
- C:\Windows\System\DzvWfvJ.exe
  C:\Windows\System\DzvWfvJ.exe
  2⤵
  PID:5460
- C:\Windows\System\hjzBwnp.exe
  C:\Windows\System\hjzBwnp.exe
  2⤵
  PID:5528
- C:\Windows\System\intwoxC.exe
  C:\Windows\System\intwoxC.exe
  2⤵
  PID:6160
- C:\Windows\System\zvJcMej.exe
  C:\Windows\System\zvJcMej.exe
  2⤵
  PID:6180
- C:\Windows\System\IYhFkLN.exe
  C:\Windows\System\IYhFkLN.exe
  2⤵
  PID:6208
- C:\Windows\System\TLQgjrI.exe
  C:\Windows\System\TLQgjrI.exe
  2⤵
  PID:6228
- C:\Windows\System\XxdJMWE.exe
  C:\Windows\System\XxdJMWE.exe
  2⤵
  PID:6244
- C:\Windows\System\LJwDKMK.exe
  C:\Windows\System\LJwDKMK.exe
  2⤵
  PID:6260
- C:\Windows\System\yPORPtN.exe
  C:\Windows\System\yPORPtN.exe
  2⤵
  PID:6280
- C:\Windows\System\FTmjEqw.exe
  C:\Windows\System\FTmjEqw.exe
  2⤵
  PID:6296
- C:\Windows\System\sdrPzNt.exe
  C:\Windows\System\sdrPzNt.exe
  2⤵
  PID:6316
- C:\Windows\System\uxcpRvE.exe
  C:\Windows\System\uxcpRvE.exe
  2⤵
  PID:6332
- C:\Windows\System\eKBnFDH.exe
  C:\Windows\System\eKBnFDH.exe
  2⤵
  PID:6352
- C:\Windows\System\KumDAet.exe
  C:\Windows\System\KumDAet.exe
  2⤵
  PID:6372
- C:\Windows\System\UTcKdqX.exe
  C:\Windows\System\UTcKdqX.exe
  2⤵
  PID:6408
- C:\Windows\System\IMKrkxH.exe
  C:\Windows\System\IMKrkxH.exe
  2⤵
  PID:6428
- C:\Windows\System\gowMPyq.exe
  C:\Windows\System\gowMPyq.exe
  2⤵
  PID:6444
- C:\Windows\System\JBLnzGW.exe
  C:\Windows\System\JBLnzGW.exe
  2⤵
  PID:6464
- C:\Windows\System\rNCgPeo.exe
  C:\Windows\System\rNCgPeo.exe
  2⤵
  PID:6484
- C:\Windows\System\cCmTdzi.exe
  C:\Windows\System\cCmTdzi.exe
  2⤵
  PID:6500
- C:\Windows\System\BQixsgS.exe
  C:\Windows\System\BQixsgS.exe
  2⤵
  PID:6516
- C:\Windows\System\AFLInwK.exe
  C:\Windows\System\AFLInwK.exe
  2⤵
  PID:6532
- C:\Windows\System\MaJQXsx.exe
  C:\Windows\System\MaJQXsx.exe
  2⤵
  PID:6548
- C:\Windows\System\NQmCRmE.exe
  C:\Windows\System\NQmCRmE.exe
  2⤵
  PID:6564
- C:\Windows\System\kLsgNOU.exe
  C:\Windows\System\kLsgNOU.exe
  2⤵
  PID:6584
- C:\Windows\System\iZUivQS.exe
  C:\Windows\System\iZUivQS.exe
  2⤵
  PID:6600
- C:\Windows\System\TSikvJo.exe
  C:\Windows\System\TSikvJo.exe
  2⤵
  PID:6616
- C:\Windows\System\krmOEbf.exe
  C:\Windows\System\krmOEbf.exe
  2⤵
  PID:6668
- C:\Windows\System\UczeLYO.exe
  C:\Windows\System\UczeLYO.exe
  2⤵
  PID:6684
- C:\Windows\System\hTyKIWT.exe
  C:\Windows\System\hTyKIWT.exe
  2⤵
  PID:6704
- C:\Windows\System\WBgtEeL.exe
  C:\Windows\System\WBgtEeL.exe
  2⤵
  PID:6744
- C:\Windows\System\EIhjoYx.exe
  C:\Windows\System\EIhjoYx.exe
  2⤵
  PID:6760
- C:\Windows\System\oiRAWwE.exe
  C:\Windows\System\oiRAWwE.exe
  2⤵
  PID:6776
- C:\Windows\System\FDtJhGE.exe
  C:\Windows\System\FDtJhGE.exe
  2⤵
  PID:6792
- C:\Windows\System\IReOZQJ.exe
  C:\Windows\System\IReOZQJ.exe
  2⤵
  PID:6808
- C:\Windows\System\aDLBYDJ.exe
  C:\Windows\System\aDLBYDJ.exe
  2⤵
  PID:6828
- C:\Windows\System\TgiXcLx.exe
  C:\Windows\System\TgiXcLx.exe
  2⤵
  PID:6844
- C:\Windows\System\blvlFwU.exe
  C:\Windows\System\blvlFwU.exe
  2⤵
  PID:6860
- C:\Windows\System\sMiRdkj.exe
  C:\Windows\System\sMiRdkj.exe
  2⤵
  PID:6876
- C:\Windows\System\yRvrfBp.exe
  C:\Windows\System\yRvrfBp.exe
  2⤵
  PID:6920
- C:\Windows\System\wafmGQe.exe
  C:\Windows\System\wafmGQe.exe
  2⤵
  PID:6936
- C:\Windows\System\TkWyBOP.exe
  C:\Windows\System\TkWyBOP.exe
  2⤵
  PID:6964
- C:\Windows\System\SwsCeAZ.exe
  C:\Windows\System\SwsCeAZ.exe
  2⤵
  PID:6980
- C:\Windows\System\TYWeGKu.exe
  C:\Windows\System\TYWeGKu.exe
  2⤵
  PID:7000
- C:\Windows\System\LsVDtCF.exe
  C:\Windows\System\LsVDtCF.exe
  2⤵
  PID:7016
- C:\Windows\System\qiaIBZD.exe
  C:\Windows\System\qiaIBZD.exe
  2⤵
  PID:7040
- C:\Windows\System\sLUKYjC.exe
  C:\Windows\System\sLUKYjC.exe
  2⤵
  PID:7056
- C:\Windows\System\ddmmnnG.exe
  C:\Windows\System\ddmmnnG.exe
  2⤵
  PID:7072
- C:\Windows\System\upaDFKw.exe
  C:\Windows\System\upaDFKw.exe
  2⤵
  PID:7104
- C:\Windows\System\KCWeDrT.exe
  C:\Windows\System\KCWeDrT.exe
  2⤵
  PID:7124
- C:\Windows\System\bamrVFl.exe
  C:\Windows\System\bamrVFl.exe
  2⤵
  PID:7144
- C:\Windows\System\pqIoByJ.exe
  C:\Windows\System\pqIoByJ.exe
  2⤵
  PID:7164
- C:\Windows\System\KYlBklp.exe
  C:\Windows\System\KYlBklp.exe
  2⤵
  PID:5708
- C:\Windows\System\powKDfN.exe
  C:\Windows\System\powKDfN.exe
  2⤵
  PID:5524
- C:\Windows\System\nALHQxo.exe
  C:\Windows\System\nALHQxo.exe
  2⤵
  PID:5628
- C:\Windows\System\EtRRbGU.exe
  C:\Windows\System\EtRRbGU.exe
  2⤵
  PID:6108
- C:\Windows\System\tcbQNEr.exe
  C:\Windows\System\tcbQNEr.exe
  2⤵
  PID:5940
- C:\Windows\System\obkNqLZ.exe
  C:\Windows\System\obkNqLZ.exe
  2⤵
  PID:6124
- C:\Windows\System\wnnETFw.exe
  C:\Windows\System\wnnETFw.exe
  2⤵
  PID:2796
- C:\Windows\System\sxNLSiS.exe
  C:\Windows\System\sxNLSiS.exe
  2⤵
  PID:6168
- C:\Windows\System\fLBdbZD.exe
  C:\Windows\System\fLBdbZD.exe
  2⤵
  PID:4984
- C:\Windows\System\midxvFN.exe
  C:\Windows\System\midxvFN.exe
  2⤵
  PID:6216
- C:\Windows\System\LahxTZX.exe
  C:\Windows\System\LahxTZX.exe
  2⤵
  PID:6256
- C:\Windows\System\dApPViE.exe
  C:\Windows\System\dApPViE.exe
  2⤵
  PID:6328
- C:\Windows\System\LKjhMHP.exe
  C:\Windows\System\LKjhMHP.exe
  2⤵
  PID:6368
- C:\Windows\System\AVPAGPY.exe
  C:\Windows\System\AVPAGPY.exe
  2⤵
  PID:6188
- C:\Windows\System\IBTJqDn.exe
  C:\Windows\System\IBTJqDn.exe
  2⤵
  PID:6200
- C:\Windows\System\fCYynOC.exe
  C:\Windows\System\fCYynOC.exe
  2⤵
  PID:6272
- C:\Windows\System\PIQBSWL.exe
  C:\Windows\System\PIQBSWL.exe
  2⤵
  PID:6312
- C:\Windows\System\MlAxcCf.exe
  C:\Windows\System\MlAxcCf.exe
  2⤵
  PID:2308
- C:\Windows\System\TACtRDi.exe
  C:\Windows\System\TACtRDi.exe
  2⤵
  PID:6380
- C:\Windows\System\YHNtNaQ.exe
  C:\Windows\System\YHNtNaQ.exe
  2⤵
  PID:6268
- C:\Windows\System\AuVphWl.exe
  C:\Windows\System\AuVphWl.exe
  2⤵
  PID:6476
- C:\Windows\System\egjJCVM.exe
  C:\Windows\System\egjJCVM.exe
  2⤵
  PID:6416
- C:\Windows\System\tKrXmjg.exe
  C:\Windows\System\tKrXmjg.exe
  2⤵
  PID:952
- C:\Windows\System\JFuFUVT.exe
  C:\Windows\System\JFuFUVT.exe
  2⤵
  PID:6540
- C:\Windows\System\ymTsHPS.exe
  C:\Windows\System\ymTsHPS.exe
  2⤵
  PID:6596
- C:\Windows\System\vRicoIh.exe
  C:\Windows\System\vRicoIh.exe
  2⤵
  PID:2180
- C:\Windows\System\aTgemqY.exe
  C:\Windows\System\aTgemqY.exe
  2⤵
  PID:6656
- C:\Windows\System\svViZlU.exe
  C:\Windows\System\svViZlU.exe
  2⤵
  PID:6696
- C:\Windows\System\AMiRIWx.exe
  C:\Windows\System\AMiRIWx.exe
  2⤵
  PID:3060
- C:\Windows\System\szkuObr.exe
  C:\Windows\System\szkuObr.exe
  2⤵
  PID:6508
- C:\Windows\System\XfTtnHj.exe
  C:\Windows\System\XfTtnHj.exe
  2⤵
  PID:2920
- C:\Windows\System\JEvfttc.exe
  C:\Windows\System\JEvfttc.exe
  2⤵
  PID:6612
- C:\Windows\System\pdoqXSz.exe
  C:\Windows\System\pdoqXSz.exe
  2⤵
  PID:6712
- C:\Windows\System\gKtALpR.exe
  C:\Windows\System\gKtALpR.exe
  2⤵
  PID:6732
- C:\Windows\System\tgKsaPr.exe
  C:\Windows\System\tgKsaPr.exe
  2⤵
  PID:6756
- C:\Windows\System\DaVpKzZ.exe
  C:\Windows\System\DaVpKzZ.exe
  2⤵
  PID:6884
- C:\Windows\System\bfRTIAK.exe
  C:\Windows\System\bfRTIAK.exe
  2⤵
  PID:2128
- C:\Windows\System\peLhXeF.exe
  C:\Windows\System\peLhXeF.exe
  2⤵
  PID:1224
- C:\Windows\System\IeYTTNd.exe
  C:\Windows\System\IeYTTNd.exe
  2⤵
  PID:1680
- C:\Windows\System\CsZUXQz.exe
  C:\Windows\System\CsZUXQz.exe
  2⤵
  PID:6912
- C:\Windows\System\ulhgPEN.exe
  C:\Windows\System\ulhgPEN.exe
  2⤵
  PID:6868
- C:\Windows\System\eThfWrH.exe
  C:\Windows\System\eThfWrH.exe
  2⤵
  PID:6916
- C:\Windows\System\kEePOXL.exe
  C:\Windows\System\kEePOXL.exe
  2⤵
  PID:6976
- C:\Windows\System\FOhWFST.exe
  C:\Windows\System\FOhWFST.exe
  2⤵
  PID:6944
- C:\Windows\System\FKSHhlC.exe
  C:\Windows\System\FKSHhlC.exe
  2⤵
  PID:2976
- C:\Windows\System\XeeiXgV.exe
  C:\Windows\System\XeeiXgV.exe
  2⤵
  PID:6992
- C:\Windows\System\WGAVNCx.exe
  C:\Windows\System\WGAVNCx.exe
  2⤵
  PID:7032
- C:\Windows\System\JYUmHXP.exe
  C:\Windows\System\JYUmHXP.exe
  2⤵
  PID:7068
- C:\Windows\System\unzXQyM.exe
  C:\Windows\System\unzXQyM.exe
  2⤵
  PID:7112
- C:\Windows\System\yMmftZl.exe
  C:\Windows\System\yMmftZl.exe
  2⤵
  PID:7084
- C:\Windows\System\UHDacKG.exe
  C:\Windows\System\UHDacKG.exe
  2⤵
  PID:7152
- C:\Windows\System\fGChjYD.exe
  C:\Windows\System\fGChjYD.exe
  2⤵
  PID:2960
- C:\Windows\System\hLsNDYF.exe
  C:\Windows\System\hLsNDYF.exe
  2⤵
  PID:4444
- C:\Windows\System\xLdAhWb.exe
  C:\Windows\System\xLdAhWb.exe
  2⤵
  PID:552
- C:\Windows\System\VxZIUhW.exe
  C:\Windows\System\VxZIUhW.exe
  2⤵
  PID:5968
- C:\Windows\System\HYYHftG.exe
  C:\Windows\System\HYYHftG.exe
  2⤵
  PID:6172
- C:\Windows\System\yRMVasS.exe
  C:\Windows\System\yRMVasS.exe
  2⤵
  PID:5164
- C:\Windows\System\fPYjVdG.exe
  C:\Windows\System\fPYjVdG.exe
  2⤵
  PID:2536
- C:\Windows\System\duKdCXa.exe
  C:\Windows\System\duKdCXa.exe
  2⤵
  PID:6404
- C:\Windows\System\IxCKoik.exe
  C:\Windows\System\IxCKoik.exe
  2⤵
  PID:2832
- C:\Windows\System\XRbQdjf.exe
  C:\Windows\System\XRbQdjf.exe
  2⤵
  PID:2456
- C:\Windows\System\owETivt.exe
  C:\Windows\System\owETivt.exe
  2⤵
  PID:6436
- C:\Windows\System\jHOHeyQ.exe
  C:\Windows\System\jHOHeyQ.exe
  2⤵
  PID:2812
- C:\Windows\System\ZKOwhnB.exe
  C:\Windows\System\ZKOwhnB.exe
  2⤵
  PID:6156
- C:\Windows\System\SrBJhPe.exe
  C:\Windows\System\SrBJhPe.exe
  2⤵
  PID:1564
- C:\Windows\System\GlmfhxB.exe
  C:\Windows\System\GlmfhxB.exe
  2⤵
  PID:6628
- C:\Windows\System\tunXtFn.exe
  C:\Windows\System\tunXtFn.exe
  2⤵
  PID:6592
- C:\Windows\System\yqeolvY.exe
  C:\Windows\System\yqeolvY.exe
  2⤵
  PID:2132
- C:\Windows\System\zGCNkhs.exe
  C:\Windows\System\zGCNkhs.exe
  2⤵
  PID:6680
- C:\Windows\System\rnJHzWQ.exe
  C:\Windows\System\rnJHzWQ.exe
  2⤵
  PID:2388
- C:\Windows\System\IghFWjq.exe
  C:\Windows\System\IghFWjq.exe
  2⤵
  PID:2404
- C:\Windows\System\rugRgJU.exe
  C:\Windows\System\rugRgJU.exe
  2⤵
  PID:6580
- C:\Windows\System\kCABvPQ.exe
  C:\Windows\System\kCABvPQ.exe
  2⤵
  PID:6736
- C:\Windows\System\xkTBmYU.exe
  C:\Windows\System\xkTBmYU.exe
  2⤵
  PID:6752
- C:\Windows\System\JXxrGxd.exe
  C:\Windows\System\JXxrGxd.exe
  2⤵
  PID:6840
- C:\Windows\System\oKeTeXM.exe
  C:\Windows\System\oKeTeXM.exe
  2⤵
  PID:7092
- C:\Windows\System\mlwhaSi.exe
  C:\Windows\System\mlwhaSi.exe
  2⤵
  PID:7160
- C:\Windows\System\kFZzrab.exe
  C:\Windows\System\kFZzrab.exe
  2⤵
  PID:6788
- C:\Windows\System\nsUIzhw.exe
  C:\Windows\System\nsUIzhw.exe
  2⤵
  PID:6856
- C:\Windows\System\iyGReFT.exe
  C:\Windows\System\iyGReFT.exe
  2⤵
  PID:2360
- C:\Windows\System\KewpagO.exe
  C:\Windows\System\KewpagO.exe
  2⤵
  PID:6768
- C:\Windows\System\RknYWDg.exe
  C:\Windows\System\RknYWDg.exe
  2⤵
  PID:2008
- C:\Windows\System\MPzfXDX.exe
  C:\Windows\System\MPzfXDX.exe
  2⤵
  PID:7080
- C:\Windows\System\tvbqbZK.exe
  C:\Windows\System\tvbqbZK.exe
  2⤵
  PID:7156
- C:\Windows\System\xRHXSFu.exe
  C:\Windows\System\xRHXSFu.exe
  2⤵
  PID:808
- C:\Windows\System\UqJOEgQ.exe
  C:\Windows\System\UqJOEgQ.exe
  2⤵
  PID:2228
- C:\Windows\System\jhlpsGC.exe
  C:\Windows\System\jhlpsGC.exe
  2⤵
  PID:2932
- C:\Windows\System\OdMzkeb.exe
  C:\Windows\System\OdMzkeb.exe
  2⤵
  PID:2540
- C:\Windows\System\TMkbDrl.exe
  C:\Windows\System\TMkbDrl.exe
  2⤵
  PID:1692
- C:\Windows\System\XhReogH.exe
  C:\Windows\System\XhReogH.exe
  2⤵
  PID:6576
- C:\Windows\System\GUjHglj.exe
  C:\Windows\System\GUjHglj.exe
  2⤵
  PID:3028
- C:\Windows\System\dTWjINE.exe
  C:\Windows\System\dTWjINE.exe
  2⤵
  PID:2248
- C:\Windows\System\TMjCasd.exe
  C:\Windows\System\TMjCasd.exe
  2⤵
  PID:5264
- C:\Windows\System\MuvRYJD.exe
  C:\Windows\System\MuvRYJD.exe
  2⤵
  PID:6852
- C:\Windows\System\jrKhScL.exe
  C:\Windows\System\jrKhScL.exe
  2⤵
  PID:6908
- C:\Windows\System\wxjBVQU.exe
  C:\Windows\System\wxjBVQU.exe
  2⤵
  PID:6452
- C:\Windows\System\FfqCSjN.exe
  C:\Windows\System\FfqCSjN.exe
  2⤵
  PID:5740
- C:\Windows\System\mkjibAy.exe
  C:\Windows\System\mkjibAy.exe
  2⤵
  PID:6348
- C:\Windows\System\RSqpage.exe
  C:\Windows\System\RSqpage.exe
  2⤵
  PID:6652
- C:\Windows\System\RuRPZtO.exe
  C:\Windows\System\RuRPZtO.exe
  2⤵
  PID:1856
- C:\Windows\System\AoZXDfy.exe
  C:\Windows\System\AoZXDfy.exe
  2⤵
  PID:6572
- C:\Windows\System\PFfXuxT.exe
  C:\Windows\System\PFfXuxT.exe
  2⤵
  PID:6932
- C:\Windows\System\CZLSNOl.exe
  C:\Windows\System\CZLSNOl.exe
  2⤵
  PID:6396
- C:\Windows\System\PBYrzYJ.exe
  C:\Windows\System\PBYrzYJ.exe
  2⤵
  PID:2444
- C:\Windows\System\VRsFKQL.exe
  C:\Windows\System\VRsFKQL.exe
  2⤵
  PID:1684
- C:\Windows\System\EOVJhNW.exe
  C:\Windows\System\EOVJhNW.exe
  2⤵
  PID:6008
- C:\Windows\System\pPozumN.exe
  C:\Windows\System\pPozumN.exe
  2⤵
  PID:6676
- C:\Windows\System\WGnLGsu.exe
  C:\Windows\System\WGnLGsu.exe
  2⤵
  PID:7120
- C:\Windows\System\KVmoqpG.exe
  C:\Windows\System\KVmoqpG.exe
  2⤵
  PID:6524
- C:\Windows\System\FzYLUtS.exe
  C:\Windows\System\FzYLUtS.exe
  2⤵
  PID:1580
- C:\Windows\System\GQfIbQC.exe
  C:\Windows\System\GQfIbQC.exe
  2⤵
  PID:1440
- C:\Windows\System\fKwMaRv.exe
  C:\Windows\System\fKwMaRv.exe
  2⤵
  PID:2516
- C:\Windows\System\OASmyZC.exe
  C:\Windows\System\OASmyZC.exe
  2⤵
  PID:848
- C:\Windows\System\UWpOJHv.exe
  C:\Windows\System\UWpOJHv.exe
  2⤵
  PID:2188
- C:\Windows\System\XSjQgGP.exe
  C:\Windows\System\XSjQgGP.exe
  2⤵
  PID:1736
- C:\Windows\System\BhXWGuB.exe
  C:\Windows\System\BhXWGuB.exe
  2⤵
  PID:6324
- C:\Windows\System\Vfwdaqt.exe
  C:\Windows\System\Vfwdaqt.exe
  2⤵
  PID:7136
- C:\Windows\System\jNmJHJe.exe
  C:\Windows\System\jNmJHJe.exe
  2⤵
  PID:6972
- C:\Windows\System\NRDIemW.exe
  C:\Windows\System\NRDIemW.exe
  2⤵
  PID:6896
- C:\Windows\System\eQqepXP.exe
  C:\Windows\System\eQqepXP.exe
  2⤵
  PID:6692
- C:\Windows\System\pslSSqy.exe
  C:\Windows\System\pslSSqy.exe
  2⤵
  PID:1016
- C:\Windows\System\ClJPNoP.exe
  C:\Windows\System\ClJPNoP.exe
  2⤵
  PID:6956
- C:\Windows\System\ElEhwQE.exe
  C:\Windows\System\ElEhwQE.exe
  2⤵
  PID:6196
- C:\Windows\System\wmrKHcH.exe
  C:\Windows\System\wmrKHcH.exe
  2⤵
  PID:6528
- C:\Windows\System\XOcKlqN.exe
  C:\Windows\System\XOcKlqN.exe
  2⤵
  PID:7184
- C:\Windows\System\exkrDSk.exe
  C:\Windows\System\exkrDSk.exe
  2⤵
  PID:7204
- C:\Windows\System\rmrnaQz.exe
  C:\Windows\System\rmrnaQz.exe
  2⤵
  PID:7236
- C:\Windows\System\fWxUVxo.exe
  C:\Windows\System\fWxUVxo.exe
  2⤵
  PID:7256
- C:\Windows\System\LRnltoL.exe
  C:\Windows\System\LRnltoL.exe
  2⤵
  PID:7280
- C:\Windows\System\JiQVAJy.exe
  C:\Windows\System\JiQVAJy.exe
  2⤵
  PID:7304
- C:\Windows\System\tEakDzI.exe
  C:\Windows\System\tEakDzI.exe
  2⤵
  PID:7320
- C:\Windows\System\NmSWSFd.exe
  C:\Windows\System\NmSWSFd.exe
  2⤵
  PID:7348
- C:\Windows\System\zVwMHQv.exe
  C:\Windows\System\zVwMHQv.exe
  2⤵
  PID:7364
- C:\Windows\System\qNZNMcO.exe
  C:\Windows\System\qNZNMcO.exe
  2⤵
  PID:7380
- C:\Windows\System\EkFpgiw.exe
  C:\Windows\System\EkFpgiw.exe
  2⤵
  PID:7404
- C:\Windows\System\dvDJimi.exe
  C:\Windows\System\dvDJimi.exe
  2⤵
  PID:7424
- C:\Windows\System\FmRkBBM.exe
  C:\Windows\System\FmRkBBM.exe
  2⤵
  PID:7440
- C:\Windows\System\jpAudCV.exe
  C:\Windows\System\jpAudCV.exe
  2⤵
  PID:7460
- C:\Windows\System\pooRBPq.exe
  C:\Windows\System\pooRBPq.exe
  2⤵
  PID:7476
- C:\Windows\System\njhitvg.exe
  C:\Windows\System\njhitvg.exe
  2⤵
  PID:7500
- C:\Windows\System\whbzNPW.exe
  C:\Windows\System\whbzNPW.exe
  2⤵
  PID:7524
- C:\Windows\System\VTIRbCS.exe
  C:\Windows\System\VTIRbCS.exe
  2⤵
  PID:7540
- C:\Windows\System\fOiaqzk.exe
  C:\Windows\System\fOiaqzk.exe
  2⤵
  PID:7560
- C:\Windows\System\LFhGJyS.exe
  C:\Windows\System\LFhGJyS.exe
  2⤵
  PID:7580
- C:\Windows\System\mWqTtHA.exe
  C:\Windows\System\mWqTtHA.exe
  2⤵
  PID:7608
- C:\Windows\System\AGlrpnD.exe
  C:\Windows\System\AGlrpnD.exe
  2⤵
  PID:7624
- C:\Windows\System\FecVJQY.exe
  C:\Windows\System\FecVJQY.exe
  2⤵
  PID:7640
- C:\Windows\System\XZfPnQP.exe
  C:\Windows\System\XZfPnQP.exe
  2⤵
  PID:7656
- C:\Windows\System\gPVJVmF.exe
  C:\Windows\System\gPVJVmF.exe
  2⤵
  PID:7672
- C:\Windows\System\SzsTUMj.exe
  C:\Windows\System\SzsTUMj.exe
  2⤵
  PID:7688
- C:\Windows\System\liMThtM.exe
  C:\Windows\System\liMThtM.exe
  2⤵
  PID:7704
- C:\Windows\System\qxmOooy.exe
  C:\Windows\System\qxmOooy.exe
  2⤵
  PID:7720
- C:\Windows\System\IYSeOjf.exe
  C:\Windows\System\IYSeOjf.exe
  2⤵
  PID:7736
- C:\Windows\System\ycoRIWy.exe
  C:\Windows\System\ycoRIWy.exe
  2⤵
  PID:7756
- C:\Windows\System\YJTKXNg.exe
  C:\Windows\System\YJTKXNg.exe
  2⤵
  PID:7780
- C:\Windows\System\TZQdPuc.exe
  C:\Windows\System\TZQdPuc.exe
  2⤵
  PID:7800
- C:\Windows\System\klvhFVT.exe
  C:\Windows\System\klvhFVT.exe
  2⤵
  PID:7820
- C:\Windows\System\BgYGcvn.exe
  C:\Windows\System\BgYGcvn.exe
  2⤵
  PID:7840
- C:\Windows\System\QhOgXZK.exe
  C:\Windows\System\QhOgXZK.exe
  2⤵
  PID:7856
- C:\Windows\System\qjDYqdN.exe
  C:\Windows\System\qjDYqdN.exe
  2⤵
  PID:7880
- C:\Windows\System\vEzxyNi.exe
  C:\Windows\System\vEzxyNi.exe
  2⤵
  PID:7900
- C:\Windows\System\DJoBQdg.exe
  C:\Windows\System\DJoBQdg.exe
  2⤵
  PID:7916
- C:\Windows\System\vwpPKvb.exe
  C:\Windows\System\vwpPKvb.exe
  2⤵
  PID:7936
- C:\Windows\System\INHEfTq.exe
  C:\Windows\System\INHEfTq.exe
  2⤵
  PID:7952
- C:\Windows\System\MpxAiBn.exe
  C:\Windows\System\MpxAiBn.exe
  2⤵
  PID:7972
- C:\Windows\System\rKpNYLt.exe
  C:\Windows\System\rKpNYLt.exe
  2⤵
  PID:7988
- C:\Windows\System\htcovPd.exe
  C:\Windows\System\htcovPd.exe
  2⤵
  PID:8004
- C:\Windows\System\PiyrASw.exe
  C:\Windows\System\PiyrASw.exe
  2⤵
  PID:8024
- C:\Windows\System\dHyNPQJ.exe
  C:\Windows\System\dHyNPQJ.exe
  2⤵
  PID:8040
- C:\Windows\System\WyzwdqN.exe
  C:\Windows\System\WyzwdqN.exe
  2⤵
  PID:8056
- C:\Windows\System\oyZAZfE.exe
  C:\Windows\System\oyZAZfE.exe
  2⤵
  PID:8072
- C:\Windows\System\QYSwdTE.exe
  C:\Windows\System\QYSwdTE.exe
  2⤵
  PID:8088
- C:\Windows\System\lBxWLnn.exe
  C:\Windows\System\lBxWLnn.exe
  2⤵
  PID:8112
- C:\Windows\System\QOAyTfy.exe
  C:\Windows\System\QOAyTfy.exe
  2⤵
  PID:8128
- C:\Windows\System\yVAOUGC.exe
  C:\Windows\System\yVAOUGC.exe
  2⤵
  PID:8148
- C:\Windows\System\gAAbexE.exe
  C:\Windows\System\gAAbexE.exe
  2⤵
  PID:8168
- C:\Windows\System\vkTQSgb.exe
  C:\Windows\System\vkTQSgb.exe
  2⤵
  PID:632
- C:\Windows\System\sInHeke.exe
  C:\Windows\System\sInHeke.exe
  2⤵
  PID:7180
- C:\Windows\System\lKEThxG.exe
  C:\Windows\System\lKEThxG.exe
  2⤵
  PID:6224
- C:\Windows\System\XKCyHda.exe
  C:\Windows\System\XKCyHda.exe
  2⤵
  PID:7028
- C:\Windows\System\PMUzQWr.exe
  C:\Windows\System\PMUzQWr.exe
  2⤵
  PID:6720
- C:\Windows\System\tdchtJx.exe
  C:\Windows\System\tdchtJx.exe
  2⤵
  PID:7200
- C:\Windows\System\mvQAJTl.exe
  C:\Windows\System\mvQAJTl.exe
  2⤵
  PID:7272
- C:\Windows\System\zkjtIWG.exe
  C:\Windows\System\zkjtIWG.exe
  2⤵
  PID:7312
- C:\Windows\System\llguscq.exe
  C:\Windows\System\llguscq.exe
  2⤵
  PID:7396
- C:\Windows\System\cCxJudB.exe
  C:\Windows\System\cCxJudB.exe
  2⤵
  PID:7328
- C:\Windows\System\mVFSLUj.exe
  C:\Windows\System\mVFSLUj.exe
  2⤵
  PID:7392
- C:\Windows\System\MBuEwLE.exe
  C:\Windows\System\MBuEwLE.exe
  2⤵
  PID:7436
- C:\Windows\System\WWdFqgj.exe
  C:\Windows\System\WWdFqgj.exe
  2⤵
  PID:7412
- C:\Windows\System\BYpOnqO.exe
  C:\Windows\System\BYpOnqO.exe
  2⤵
  PID:7452
- C:\Windows\System\EfDJdtS.exe
  C:\Windows\System\EfDJdtS.exe
  2⤵
  PID:7496
- C:\Windows\System\oSPFqBU.exe
  C:\Windows\System\oSPFqBU.exe
  2⤵
  PID:7548
- C:\Windows\System\FBSUPik.exe
  C:\Windows\System\FBSUPik.exe
  2⤵
  PID:7592
- C:\Windows\System\rkhVHrW.exe
  C:\Windows\System\rkhVHrW.exe
  2⤵
  PID:7576
- C:\Windows\System\FqSDmDu.exe
  C:\Windows\System\FqSDmDu.exe
  2⤵
  PID:7636
- C:\Windows\System\ETLSFvB.exe
  C:\Windows\System\ETLSFvB.exe
  2⤵
  PID:7728
- C:\Windows\System\mgxnzEX.exe
  C:\Windows\System\mgxnzEX.exe
  2⤵
  PID:7772
- C:\Windows\System\ixqCXfs.exe
  C:\Windows\System\ixqCXfs.exe
  2⤵
  PID:7816
- C:\Windows\System\dZjVVlW.exe
  C:\Windows\System\dZjVVlW.exe
  2⤵
  PID:7892
- C:\Windows\System\ekxeVFH.exe
  C:\Windows\System\ekxeVFH.exe
  2⤵
  PID:7960
- C:\Windows\System\PFzmSHw.exe
  C:\Windows\System\PFzmSHw.exe
  2⤵
  PID:8000
- C:\Windows\System\MvsQJlX.exe
  C:\Windows\System\MvsQJlX.exe
  2⤵
  PID:8068
- C:\Windows\System\DJLIePY.exe
  C:\Windows\System\DJLIePY.exe
  2⤵
  PID:8108
- C:\Windows\System\weJpggQ.exe
  C:\Windows\System\weJpggQ.exe
  2⤵
  PID:7472
- C:\Windows\System\gtXhcNw.exe
  C:\Windows\System\gtXhcNw.exe
  2⤵
  PID:7488
- C:\Windows\System\CvVeWas.exe
  C:\Windows\System\CvVeWas.exe
  2⤵
  PID:7596
- C:\Windows\System\fRCogKf.exe
  C:\Windows\System\fRCogKf.exe
  2⤵
  PID:7852
- C:\Windows\System\npDAVJe.exe
  C:\Windows\System\npDAVJe.exe
  2⤵
  PID:7996
- C:\Windows\System\TwCpfSd.exe
  C:\Windows\System\TwCpfSd.exe
  2⤵
  PID:7712
- C:\Windows\System\SgrYMdA.exe
  C:\Windows\System\SgrYMdA.exe
  2⤵
  PID:7788
- C:\Windows\System\YiohocI.exe
  C:\Windows\System\YiohocI.exe
  2⤵
  PID:7868
- C:\Windows\System\ZhgCCfI.exe
  C:\Windows\System\ZhgCCfI.exe
  2⤵
  PID:7908
- C:\Windows\System\uSftsSa.exe
  C:\Windows\System\uSftsSa.exe
  2⤵
  PID:7980
- C:\Windows\System\NOimibJ.exe
  C:\Windows\System\NOimibJ.exe
  2⤵
  PID:8020
- C:\Windows\System\chtQogG.exe
  C:\Windows\System\chtQogG.exe
  2⤵
  PID:8084
- C:\Windows\System\gljHVlZ.exe
  C:\Windows\System\gljHVlZ.exe
  2⤵
  PID:8160
- C:\Windows\System\afRoHvw.exe
  C:\Windows\System\afRoHvw.exe
  2⤵
  PID:7296
- C:\Windows\System\vAKtlKz.exe
  C:\Windows\System\vAKtlKz.exe
  2⤵
  PID:7420
- C:\Windows\System\hbCWGUu.exe
  C:\Windows\System\hbCWGUu.exe
  2⤵
  PID:7604
- C:\Windows\System\NmrBIGU.exe
  C:\Windows\System\NmrBIGU.exe
  2⤵
  PID:7924
- C:\Windows\System\wmowgDi.exe
  C:\Windows\System\wmowgDi.exe
  2⤵
  PID:8140
- C:\Windows\System\WEOHYpb.exe
  C:\Windows\System\WEOHYpb.exe
  2⤵
  PID:8144
- C:\Windows\System\txcSbep.exe
  C:\Windows\System\txcSbep.exe
  2⤵
  PID:8188
- C:\Windows\System\SFbcLZc.exe
  C:\Windows\System\SFbcLZc.exe
  2⤵
  PID:7228
- C:\Windows\System\ljJIGvu.exe
  C:\Windows\System\ljJIGvu.exe
  2⤵
  PID:6632
- C:\Windows\System\GmdtJwU.exe
  C:\Windows\System\GmdtJwU.exe
  2⤵
  PID:7388
- C:\Windows\System\fDUCTIK.exe
  C:\Windows\System\fDUCTIK.exe
  2⤵
  PID:6560
- C:\Windows\System\MhvcMdK.exe
  C:\Windows\System\MhvcMdK.exe
  2⤵
  PID:7356
- C:\Windows\System\begyLJG.exe
  C:\Windows\System\begyLJG.exe
  2⤵
  PID:7764
- C:\Windows\System\fVBZQGG.exe
  C:\Windows\System\fVBZQGG.exe
  2⤵
  PID:7648
- C:\Windows\System\oACwawk.exe
  C:\Windows\System\oACwawk.exe
  2⤵
  PID:7652
- C:\Windows\System\xbgVJWq.exe
  C:\Windows\System\xbgVJWq.exe
  2⤵
  PID:7680
- C:\Windows\System\peplYsz.exe
  C:\Windows\System\peplYsz.exe
  2⤵
  PID:8064
- C:\Windows\System\pdOZNlr.exe
  C:\Windows\System\pdOZNlr.exe
  2⤵
  PID:8052
- C:\Windows\System\eJqiWyl.exe
  C:\Windows\System\eJqiWyl.exe
  2⤵
  PID:7172
- C:\Windows\System\yIMwqex.exe
  C:\Windows\System\yIMwqex.exe
  2⤵
  PID:6344
- C:\Windows\System\aJAJsLe.exe
  C:\Windows\System\aJAJsLe.exe
  2⤵
  PID:7276
- C:\Windows\System\bzWBxtS.exe
  C:\Windows\System\bzWBxtS.exe
  2⤵
  PID:7292
- C:\Windows\System\STKfDVB.exe
  C:\Windows\System\STKfDVB.exe
  2⤵
  PID:7248
- C:\Windows\System\XCIkDHk.exe
  C:\Windows\System\XCIkDHk.exe
  2⤵
  PID:7932
- C:\Windows\System\AJuJxPV.exe
  C:\Windows\System\AJuJxPV.exe
  2⤵
  PID:7224
- C:\Windows\System\XLhwgyQ.exe
  C:\Windows\System\XLhwgyQ.exe
  2⤵
  PID:816
- C:\Windows\System\tBIAmGu.exe
  C:\Windows\System\tBIAmGu.exe
  2⤵
  PID:7588
- C:\Windows\System\eBWZkgm.exe
  C:\Windows\System\eBWZkgm.exe
  2⤵
  PID:8012
- C:\Windows\System\QhflAFi.exe
  C:\Windows\System\QhflAFi.exe
  2⤵
  PID:1800
- C:\Windows\System\hmgMRwc.exe
  C:\Windows\System\hmgMRwc.exe
  2⤵
  PID:7696
- C:\Windows\System\ocmSEkx.exe
  C:\Windows\System\ocmSEkx.exe
  2⤵
  PID:7828
- C:\Windows\System\nswqvMf.exe
  C:\Windows\System\nswqvMf.exe
  2⤵
  PID:7864
- C:\Windows\System\tRFmxeO.exe
  C:\Windows\System\tRFmxeO.exe
  2⤵
  PID:5844
- C:\Windows\System\IQigfBV.exe
  C:\Windows\System\IQigfBV.exe
  2⤵
  PID:7516
- C:\Windows\System\SwNBjmp.exe
  C:\Windows\System\SwNBjmp.exe
  2⤵
  PID:7808
- C:\Windows\System\ErTeVJS.exe
  C:\Windows\System\ErTeVJS.exe
  2⤵
  PID:8156
- C:\Windows\System\HjRqYvE.exe
  C:\Windows\System\HjRqYvE.exe
  2⤵
  PID:2788
- C:\Windows\System\dwNhOGw.exe
  C:\Windows\System\dwNhOGw.exe
  2⤵
  PID:7752
- C:\Windows\System\WmjfOOB.exe
  C:\Windows\System\WmjfOOB.exe
  2⤵
  PID:8180
- C:\Windows\System\QpMUcgp.exe
  C:\Windows\System\QpMUcgp.exe
  2⤵
  PID:8184
- C:\Windows\System\fDjRskg.exe
  C:\Windows\System\fDjRskg.exe
  2⤵
  PID:7556
- C:\Windows\System\glClHQe.exe
  C:\Windows\System\glClHQe.exe
  2⤵
  PID:3068
- C:\Windows\System\jpJneFh.exe
  C:\Windows\System\jpJneFh.exe
  2⤵
  PID:8208
- C:\Windows\System\EDRWrFg.exe
  C:\Windows\System\EDRWrFg.exe
  2⤵
  PID:8224
- C:\Windows\System\ATTYAbN.exe
  C:\Windows\System\ATTYAbN.exe
  2⤵
  PID:8240
- C:\Windows\System\iHEWIhp.exe
  C:\Windows\System\iHEWIhp.exe
  2⤵
  PID:8256
- C:\Windows\System\ypKzYMv.exe
  C:\Windows\System\ypKzYMv.exe
  2⤵
  PID:8272
- C:\Windows\System\yRPsISZ.exe
  C:\Windows\System\yRPsISZ.exe
  2⤵
  PID:8288
- C:\Windows\System\KibbpCr.exe
  C:\Windows\System\KibbpCr.exe
  2⤵
  PID:8308
- C:\Windows\System\nNwjZLU.exe
  C:\Windows\System\nNwjZLU.exe
  2⤵
  PID:8324
- C:\Windows\System\IGqVSdv.exe
  C:\Windows\System\IGqVSdv.exe
  2⤵
  PID:8340
- C:\Windows\System\wYjKFtL.exe
  C:\Windows\System\wYjKFtL.exe
  2⤵
  PID:8524
- C:\Windows\System\nIiBImE.exe
  C:\Windows\System\nIiBImE.exe
  2⤵
  PID:8540
- C:\Windows\System\HyrmbWF.exe
  C:\Windows\System\HyrmbWF.exe
  2⤵
  PID:8560
- C:\Windows\System\YrrQJYT.exe
  C:\Windows\System\YrrQJYT.exe
  2⤵
  PID:8576
- C:\Windows\System\NRYzSKs.exe
  C:\Windows\System\NRYzSKs.exe
  2⤵
  PID:8592
- C:\Windows\System\khbdYdu.exe
  C:\Windows\System\khbdYdu.exe
  2⤵
  PID:8608
- C:\Windows\System\WjpqUwe.exe
  C:\Windows\System\WjpqUwe.exe
  2⤵
  PID:8624
- C:\Windows\System\BtIyrOx.exe
  C:\Windows\System\BtIyrOx.exe
  2⤵
  PID:8640
- C:\Windows\System\wvTJoKl.exe
  C:\Windows\System\wvTJoKl.exe
  2⤵
  PID:8660
- C:\Windows\System\SmcykfA.exe
  C:\Windows\System\SmcykfA.exe
  2⤵
  PID:8676
- C:\Windows\System\gntlIvM.exe
  C:\Windows\System\gntlIvM.exe
  2⤵
  PID:8692
- C:\Windows\System\YGENeXH.exe
  C:\Windows\System\YGENeXH.exe
  2⤵
  PID:8708
- C:\Windows\System\xRQwvPP.exe
  C:\Windows\System\xRQwvPP.exe
  2⤵
  PID:8724
- C:\Windows\System\tDqArce.exe
  C:\Windows\System\tDqArce.exe
  2⤵
  PID:8740
- C:\Windows\System\XUQifRy.exe
  C:\Windows\System\XUQifRy.exe
  2⤵
  PID:8756
- C:\Windows\System\VYAvWhC.exe
  C:\Windows\System\VYAvWhC.exe
  2⤵
  PID:8772
- C:\Windows\System\kRdcTzj.exe
  C:\Windows\System\kRdcTzj.exe
  2⤵
  PID:8788
- C:\Windows\System\TvoBojf.exe
  C:\Windows\System\TvoBojf.exe
  2⤵
  PID:8804
- C:\Windows\System\IuyTBXb.exe
  C:\Windows\System\IuyTBXb.exe
  2⤵
  PID:8820
- C:\Windows\System\zbQQpAL.exe
  C:\Windows\System\zbQQpAL.exe
  2⤵
  PID:8836
- C:\Windows\System\CvrZRHU.exe
  C:\Windows\System\CvrZRHU.exe
  2⤵
  PID:8852
- C:\Windows\System\bsJpApW.exe
  C:\Windows\System\bsJpApW.exe
  2⤵
  PID:8868
- C:\Windows\System\oQumXlp.exe
  C:\Windows\System\oQumXlp.exe
  2⤵
  PID:8884
- C:\Windows\System\fNLGxvf.exe
  C:\Windows\System\fNLGxvf.exe
  2⤵
  PID:8900
- C:\Windows\System\UslETPd.exe
  C:\Windows\System\UslETPd.exe
  2⤵
  PID:8916
- C:\Windows\System\UvERzjn.exe
  C:\Windows\System\UvERzjn.exe
  2⤵
  PID:8932
- C:\Windows\System\wjScjNc.exe
  C:\Windows\System\wjScjNc.exe
  2⤵
  PID:8948
- C:\Windows\System\oRTYxJH.exe
  C:\Windows\System\oRTYxJH.exe
  2⤵
  PID:8964
- C:\Windows\System\BgSXngZ.exe
  C:\Windows\System\BgSXngZ.exe
  2⤵
  PID:8980
- C:\Windows\System\KYVDaZU.exe
  C:\Windows\System\KYVDaZU.exe
  2⤵
  PID:8996
- C:\Windows\System\gVkeaxu.exe
  C:\Windows\System\gVkeaxu.exe
  2⤵
  PID:9012
- C:\Windows\System\OAmxHwf.exe
  C:\Windows\System\OAmxHwf.exe
  2⤵
  PID:9028
- C:\Windows\System\ViifmUm.exe
  C:\Windows\System\ViifmUm.exe
  2⤵
  PID:9052
- C:\Windows\System\uczVqJj.exe
  C:\Windows\System\uczVqJj.exe
  2⤵
  PID:9068
- C:\Windows\System\bDdGlrN.exe
  C:\Windows\System\bDdGlrN.exe
  2⤵
  PID:9088
- C:\Windows\System\QgbjRnQ.exe
  C:\Windows\System\QgbjRnQ.exe
  2⤵
  PID:9104
- C:\Windows\System\tYXxczc.exe
  C:\Windows\System\tYXxczc.exe
  2⤵
  PID:9120
- C:\Windows\System\lgelbCu.exe
  C:\Windows\System\lgelbCu.exe
  2⤵
  PID:9136
- C:\Windows\System\dRHqijL.exe
  C:\Windows\System\dRHqijL.exe
  2⤵
  PID:9152
- C:\Windows\System\YNINItc.exe
  C:\Windows\System\YNINItc.exe
  2⤵
  PID:9168
- C:\Windows\System\NOAXmXT.exe
  C:\Windows\System\NOAXmXT.exe
  2⤵
  PID:9184
- C:\Windows\System\ILeoUdL.exe
  C:\Windows\System\ILeoUdL.exe
  2⤵
  PID:9204
- C:\Windows\System\wqWursi.exe
  C:\Windows\System\wqWursi.exe
  2⤵
  PID:7288
- C:\Windows\System\CilwJls.exe
  C:\Windows\System\CilwJls.exe
  2⤵
  PID:7508
- C:\Windows\System\pIVMPnJ.exe
  C:\Windows\System\pIVMPnJ.exe
  2⤵
  PID:8268
- C:\Windows\System\uqjckVN.exe
  C:\Windows\System\uqjckVN.exe
  2⤵
  PID:8332
- C:\Windows\System\QGxbtae.exe
  C:\Windows\System\QGxbtae.exe
  2⤵
  PID:8352
- C:\Windows\System\pfKYLRr.exe
  C:\Windows\System\pfKYLRr.exe
  2⤵
  PID:8252
- C:\Windows\System\FnpvUUv.exe
  C:\Windows\System\FnpvUUv.exe
  2⤵
  PID:8320
- C:\Windows\System\fcYTqcK.exe
  C:\Windows\System\fcYTqcK.exe
  2⤵
  PID:8376
- C:\Windows\System\VjdGXSF.exe
  C:\Windows\System\VjdGXSF.exe
  2⤵
  PID:8380
- C:\Windows\System\wTKQVMn.exe
  C:\Windows\System\wTKQVMn.exe
  2⤵
  PID:8400
- C:\Windows\System\fieIqtp.exe
  C:\Windows\System\fieIqtp.exe
  2⤵
  PID:7700
- C:\Windows\System\qDxunDY.exe
  C:\Windows\System\qDxunDY.exe
  2⤵
  PID:8956
- C:\Windows\System\DPKvbeh.exe
  C:\Windows\System\DPKvbeh.exe
  2⤵
  PID:9020
- C:\Windows\System\PIjkOuL.exe
  C:\Windows\System\PIjkOuL.exe
  2⤵
  PID:8684
- C:\Windows\System\ZNddkvE.exe
  C:\Windows\System\ZNddkvE.exe
  2⤵
  PID:8944
- C:\Windows\System\dmjWRYE.exe
  C:\Windows\System\dmjWRYE.exe
  2⤵
  PID:8648
- C:\Windows\System\HcMZtQO.exe
  C:\Windows\System\HcMZtQO.exe
  2⤵
  PID:8912
- C:\Windows\System\JnflOrM.exe
  C:\Windows\System\JnflOrM.exe
  2⤵
  PID:8752
- C:\Windows\System\cTEboxt.exe
  C:\Windows\System\cTEboxt.exe
  2⤵
  PID:8816
- C:\Windows\System\ldcvvkK.exe
  C:\Windows\System\ldcvvkK.exe
  2⤵
  PID:8880
- C:\Windows\System\NjIDHLR.exe
  C:\Windows\System\NjIDHLR.exe
  2⤵
  PID:9036
- C:\Windows\System\YokzUiJ.exe
  C:\Windows\System\YokzUiJ.exe
  2⤵
  PID:9096
- C:\Windows\System\azGTcJS.exe
  C:\Windows\System\azGTcJS.exe
  2⤵
  PID:9160
- C:\Windows\System\oIsxgBF.exe
  C:\Windows\System\oIsxgBF.exe
  2⤵
  PID:9200
- C:\Windows\System\Sivxvmm.exe
  C:\Windows\System\Sivxvmm.exe
  2⤵
  PID:8304
- C:\Windows\System\xfCQoai.exe
  C:\Windows\System\xfCQoai.exe
  2⤵
  PID:8356
- C:\Windows\System\GtVHnRE.exe
  C:\Windows\System\GtVHnRE.exe
  2⤵
  PID:8368
- C:\Windows\System\GPOlTsD.exe
  C:\Windows\System\GPOlTsD.exe
  2⤵
  PID:9148
- C:\Windows\System\RabdVOW.exe
  C:\Windows\System\RabdVOW.exe
  2⤵
  PID:7572
- C:\Windows\System\KpPosyU.exe
  C:\Windows\System\KpPosyU.exe
  2⤵
  PID:8220
- C:\Windows\System\kDQHoVN.exe
  C:\Windows\System\kDQHoVN.exe
  2⤵
  PID:8412
- C:\Windows\System\axVAIDc.exe
  C:\Windows\System\axVAIDc.exe
  2⤵
  PID:2728
- C:\Windows\System\xuFvLPK.exe
  C:\Windows\System\xuFvLPK.exe
  2⤵
  PID:8432
- C:\Windows\System\cWREyiL.exe
  C:\Windows\System\cWREyiL.exe
  2⤵
  PID:8500
- C:\Windows\System\Fxkixwy.exe
  C:\Windows\System\Fxkixwy.exe
  2⤵
  PID:8512
- C:\Windows\System\AelYqYT.exe
  C:\Windows\System\AelYqYT.exe
  2⤵
  PID:8476
- C:\Windows\System\mkekxJO.exe
  C:\Windows\System\mkekxJO.exe
  2⤵
  PID:8496
- C:\Windows\System\jtixGIU.exe
  C:\Windows\System\jtixGIU.exe
  2⤵
  PID:8532
- C:\Windows\System\smkWCUi.exe
  C:\Windows\System\smkWCUi.exe
  2⤵
  PID:8568
- C:\Windows\System\ssLXBGG.exe
  C:\Windows\System\ssLXBGG.exe
  2⤵
  PID:8636
- C:\Windows\System\zmzOCtC.exe
  C:\Windows\System\zmzOCtC.exe
  2⤵
  PID:8736
- C:\Windows\System\CvRwWNB.exe
  C:\Windows\System\CvRwWNB.exe
  2⤵
  PID:8832
- C:\Windows\System\HpKEvvq.exe
  C:\Windows\System\HpKEvvq.exe
  2⤵
  PID:8892
- C:\Windows\System\KzqCRQW.exe
  C:\Windows\System\KzqCRQW.exe
  2⤵
  PID:8928
- C:\Windows\System\NCjIeJR.exe
  C:\Windows\System\NCjIeJR.exe
  2⤵
  PID:8940
- C:\Windows\System\lIBPTZx.exe
  C:\Windows\System\lIBPTZx.exe
  2⤵
  PID:7964
- C:\Windows\System\ppsmRZo.exe
  C:\Windows\System\ppsmRZo.exe
  2⤵
  PID:8616
- C:\Windows\System\LkimtHp.exe
  C:\Windows\System\LkimtHp.exe
  2⤵
  PID:8620
- C:\Windows\System\ReVTVEh.exe
  C:\Windows\System\ReVTVEh.exe
  2⤵
  PID:9064
- C:\Windows\System\BcgIOPC.exe
  C:\Windows\System\BcgIOPC.exe
  2⤵
  PID:8248
- C:\Windows\System\dWbHtdN.exe
  C:\Windows\System\dWbHtdN.exe
  2⤵
  PID:8688
- C:\Windows\System\HgYxMpt.exe
  C:\Windows\System\HgYxMpt.exe
  2⤵
  PID:9128
- C:\Windows\System\pVZxvMG.exe
  C:\Windows\System\pVZxvMG.exe
  2⤵
  PID:9076
- C:\Windows\System\hYSVprf.exe
  C:\Windows\System\hYSVprf.exe
  2⤵
  PID:9212
- C:\Windows\System\hiLZJrL.exe
  C:\Windows\System\hiLZJrL.exe
  2⤵
  PID:9144
- C:\Windows\System\RkpmtFN.exe
  C:\Windows\System\RkpmtFN.exe
  2⤵
  PID:8484
- C:\Windows\System\YIyzwZY.exe
  C:\Windows\System\YIyzwZY.exe
  2⤵
  PID:8396
- C:\Windows\System\BfYyWub.exe
  C:\Windows\System\BfYyWub.exe
  2⤵
  PID:8428
- C:\Windows\System\dOuUZlz.exe
  C:\Windows\System\dOuUZlz.exe
  2⤵
  PID:8488
- C:\Windows\System\UyExPZy.exe
  C:\Windows\System\UyExPZy.exe
  2⤵
  PID:8516
- C:\Windows\System\pwMipGb.exe
  C:\Windows\System\pwMipGb.exe
  2⤵
  PID:8668
- C:\Windows\System\mtjUeWg.exe
  C:\Windows\System\mtjUeWg.exe
  2⤵
  PID:2708
- C:\Windows\System\xuzoAuT.exe
  C:\Windows\System\xuzoAuT.exe
  2⤵
  PID:9196
- C:\Windows\System\fApNkQy.exe
  C:\Windows\System\fApNkQy.exe
  2⤵
  PID:8700
- C:\Windows\System\tkVMQUf.exe
  C:\Windows\System\tkVMQUf.exe
  2⤵
  PID:8216
- C:\Windows\System\Iuadtau.exe
  C:\Windows\System\Iuadtau.exe
  2⤵
  PID:8732
- C:\Windows\System\WltXgVZ.exe
  C:\Windows\System\WltXgVZ.exe
  2⤵
  PID:8796
- C:\Windows\System\kWqdiDE.exe
  C:\Windows\System\kWqdiDE.exe
  2⤵
  PID:8584
- C:\Windows\System\uUVkcOZ.exe
  C:\Windows\System\uUVkcOZ.exe
  2⤵
  PID:9008
- C:\Windows\System\nTexQvA.exe
  C:\Windows\System\nTexQvA.exe
  2⤵
  PID:8876
- C:\Windows\System\DhFXJvQ.exe
  C:\Windows\System\DhFXJvQ.exe
  2⤵
  PID:8976
- C:\Windows\System\RtcFVMp.exe
  C:\Windows\System\RtcFVMp.exe
  2⤵
  PID:8452
- C:\Windows\System\uMIXrOy.exe
  C:\Windows\System\uMIXrOy.exe
  2⤵
  PID:8908
- C:\Windows\System\QjuUkFt.exe
  C:\Windows\System\QjuUkFt.exe
  2⤵
  PID:9180
- C:\Windows\System\UGixdMB.exe
  C:\Windows\System\UGixdMB.exe
  2⤵
  PID:8408
- C:\Windows\System\FByDBJE.exe
  C:\Windows\System\FByDBJE.exe
  2⤵
  PID:8860
- C:\Windows\System\dNXucyJ.exe
  C:\Windows\System\dNXucyJ.exe
  2⤵
  PID:8632
- C:\Windows\System\HSpJKUF.exe
  C:\Windows\System\HSpJKUF.exe
  2⤵
  PID:8388
- C:\Windows\System\ixrzPhu.exe
  C:\Windows\System\ixrzPhu.exe
  2⤵
  PID:8656
- C:\Windows\System\wSExTPR.exe
  C:\Windows\System\wSExTPR.exe
  2⤵
  PID:9060
- C:\Windows\System\xCKvvXv.exe
  C:\Windows\System\xCKvvXv.exe
  2⤵
  PID:9220
- C:\Windows\System\wDWlKTc.exe
  C:\Windows\System\wDWlKTc.exe
  2⤵
  PID:9236
- C:\Windows\System\QkyvRbe.exe
  C:\Windows\System\QkyvRbe.exe
  2⤵
  PID:9252
- C:\Windows\System\lSbGELV.exe
  C:\Windows\System\lSbGELV.exe
  2⤵
  PID:9268
- C:\Windows\System\BBTMkRV.exe
  C:\Windows\System\BBTMkRV.exe
  2⤵
  PID:9284
- C:\Windows\System\GJedqEH.exe
  C:\Windows\System\GJedqEH.exe
  2⤵
  PID:9300
- C:\Windows\System\MEofueF.exe
  C:\Windows\System\MEofueF.exe
  2⤵
  PID:9316
- C:\Windows\System\dZjbZPU.exe
  C:\Windows\System\dZjbZPU.exe
  2⤵
  PID:9332
- C:\Windows\System\BBFQVKT.exe
  C:\Windows\System\BBFQVKT.exe
  2⤵
  PID:9348
- C:\Windows\System\oJaDuJl.exe
  C:\Windows\System\oJaDuJl.exe
  2⤵
  PID:9372
- C:\Windows\System\yWCoRnF.exe
  C:\Windows\System\yWCoRnF.exe
  2⤵
  PID:9416
- C:\Windows\System\tQzgdEw.exe
  C:\Windows\System\tQzgdEw.exe
  2⤵
  PID:9432
- C:\Windows\System\qYUFWqL.exe
  C:\Windows\System\qYUFWqL.exe
  2⤵
  PID:9448
- C:\Windows\System\JlKUUMg.exe
  C:\Windows\System\JlKUUMg.exe
  2⤵
  PID:9464
- C:\Windows\System\hROkDEZ.exe
  C:\Windows\System\hROkDEZ.exe
  2⤵
  PID:9480
- C:\Windows\System\bwpXRUp.exe
  C:\Windows\System\bwpXRUp.exe
  2⤵
  PID:9496
- C:\Windows\System\lbbcarX.exe
  C:\Windows\System\lbbcarX.exe
  2⤵
  PID:9512
- C:\Windows\System\pjvDNWs.exe
  C:\Windows\System\pjvDNWs.exe
  2⤵
  PID:9528
- C:\Windows\System\UecWYTX.exe
  C:\Windows\System\UecWYTX.exe
  2⤵
  PID:9548
- C:\Windows\System\AminjNo.exe
  C:\Windows\System\AminjNo.exe
  2⤵
  PID:9564
- C:\Windows\System\forMoYc.exe
  C:\Windows\System\forMoYc.exe
  2⤵
  PID:9580
- C:\Windows\System\EfsUjxH.exe
  C:\Windows\System\EfsUjxH.exe
  2⤵
  PID:9596
- C:\Windows\System\wABsahQ.exe
  C:\Windows\System\wABsahQ.exe
  2⤵
  PID:9612
- C:\Windows\System\gJWyinX.exe
  C:\Windows\System\gJWyinX.exe
  2⤵
  PID:9632
- C:\Windows\System\eAyoBHV.exe
  C:\Windows\System\eAyoBHV.exe
  2⤵
  PID:9648
- C:\Windows\System\JaoQiHm.exe
  C:\Windows\System\JaoQiHm.exe
  2⤵
  PID:9668
- C:\Windows\System\UzQDPse.exe
  C:\Windows\System\UzQDPse.exe
  2⤵
  PID:9684
- C:\Windows\System\qUZtoeF.exe
  C:\Windows\System\qUZtoeF.exe
  2⤵
  PID:9700
- C:\Windows\System\ogvgVyR.exe
  C:\Windows\System\ogvgVyR.exe
  2⤵
  PID:9716
- C:\Windows\System\xDPGyoN.exe
  C:\Windows\System\xDPGyoN.exe
  2⤵
  PID:9732
- C:\Windows\System\vwswBjn.exe
  C:\Windows\System\vwswBjn.exe
  2⤵
  PID:9748
- C:\Windows\System\KWBrvBJ.exe
  C:\Windows\System\KWBrvBJ.exe
  2⤵
  PID:9764
- C:\Windows\System\bkOxFzR.exe
  C:\Windows\System\bkOxFzR.exe
  2⤵
  PID:9780
- C:\Windows\System\qRIqKAc.exe
  C:\Windows\System\qRIqKAc.exe
  2⤵
  PID:9816
- C:\Windows\System\fvIokjn.exe
  C:\Windows\System\fvIokjn.exe
  2⤵
  PID:9832
- C:\Windows\System\RrgiLKG.exe
  C:\Windows\System\RrgiLKG.exe
  2⤵
  PID:9848
- C:\Windows\System\NxHYyRR.exe
  C:\Windows\System\NxHYyRR.exe
  2⤵
  PID:9868
- C:\Windows\System\PbSTTdB.exe
  C:\Windows\System\PbSTTdB.exe
  2⤵
  PID:9972
- C:\Windows\System\ORpjnSb.exe
  C:\Windows\System\ORpjnSb.exe
  2⤵
  PID:9988
- C:\Windows\System\LBPNBzJ.exe
  C:\Windows\System\LBPNBzJ.exe
  2⤵
  PID:10004
- C:\Windows\System\FQAnCwX.exe
  C:\Windows\System\FQAnCwX.exe
  2⤵
  PID:10020
- C:\Windows\System\cgEppAq.exe
  C:\Windows\System\cgEppAq.exe
  2⤵
  PID:10040
- C:\Windows\System\MghLYen.exe
  C:\Windows\System\MghLYen.exe
  2⤵
  PID:10056
- C:\Windows\System\XSjDaAj.exe
  C:\Windows\System\XSjDaAj.exe
  2⤵
  PID:10072
- C:\Windows\System\EbtCUve.exe
  C:\Windows\System\EbtCUve.exe
  2⤵
  PID:10088
- C:\Windows\System\CtyMWpB.exe
  C:\Windows\System\CtyMWpB.exe
  2⤵
  PID:10104
- C:\Windows\System\OjAxwuO.exe
  C:\Windows\System\OjAxwuO.exe
  2⤵
  PID:10120
- C:\Windows\System\wNjjGpS.exe
  C:\Windows\System\wNjjGpS.exe
  2⤵
  PID:10140
- C:\Windows\System\OReoEcd.exe
  C:\Windows\System\OReoEcd.exe
  2⤵
  PID:10168
- C:\Windows\System\chZBnks.exe
  C:\Windows\System\chZBnks.exe
  2⤵
  PID:10188
- C:\Windows\System\SlFzNpf.exe
  C:\Windows\System\SlFzNpf.exe
  2⤵
  PID:10212
- C:\Windows\System\qkQazuy.exe
  C:\Windows\System\qkQazuy.exe
  2⤵
  PID:10232
- C:\Windows\System\qisGvvy.exe
  C:\Windows\System\qisGvvy.exe
  2⤵
  PID:9232
- C:\Windows\System\DWBelMe.exe
  C:\Windows\System\DWBelMe.exe
  2⤵
  PID:9276
- C:\Windows\System\uFmWVao.exe
  C:\Windows\System\uFmWVao.exe
  2⤵
  PID:9364
- C:\Windows\System\yCvFtiX.exe
  C:\Windows\System\yCvFtiX.exe
  2⤵
  PID:9488
- C:\Windows\System\vcbeNvb.exe
  C:\Windows\System\vcbeNvb.exe
  2⤵
  PID:9380
- C:\Windows\System\PxUnUTi.exe
  C:\Windows\System\PxUnUTi.exe
  2⤵
  PID:9392
- C:\Windows\System\smbjQVM.exe
  C:\Windows\System\smbjQVM.exe
  2⤵
  PID:9408
- C:\Windows\System\RljqanT.exe
  C:\Windows\System\RljqanT.exe
  2⤵
  PID:9476
- C:\Windows\System\SuzyONS.exe
  C:\Windows\System\SuzyONS.exe
  2⤵
  PID:9412
- C:\Windows\System\kJfZoBi.exe
  C:\Windows\System\kJfZoBi.exe
  2⤵
  PID:9524
- C:\Windows\System\YPHhcLt.exe
  C:\Windows\System\YPHhcLt.exe
  2⤵
  PID:9444
- C:\Windows\System\RpcFtdI.exe
  C:\Windows\System\RpcFtdI.exe
  2⤵
  PID:9592
- C:\Windows\System\jPlUZOb.exe
  C:\Windows\System\jPlUZOb.exe
  2⤵
  PID:9660
- C:\Windows\System\vhuhdSs.exe
  C:\Windows\System\vhuhdSs.exe
  2⤵
  PID:9676
- C:\Windows\System\EeyFWiF.exe
  C:\Windows\System\EeyFWiF.exe
  2⤵
  PID:9696
- C:\Windows\System\BKAcfWf.exe
  C:\Windows\System\BKAcfWf.exe
  2⤵
  PID:9728
- C:\Windows\System\gnbmbtm.exe
  C:\Windows\System\gnbmbtm.exe
  2⤵
  PID:9840
- C:\Windows\System\bnfdots.exe
  C:\Windows\System\bnfdots.exe
  2⤵
  PID:9860
- C:\Windows\System\mwLlzHD.exe
  C:\Windows\System\mwLlzHD.exe
  2⤵
  PID:9888
- C:\Windows\System\XdcWTaF.exe
  C:\Windows\System\XdcWTaF.exe
  2⤵
  PID:9928
- C:\Windows\System\IVsdiag.exe
  C:\Windows\System\IVsdiag.exe
  2⤵
  PID:9936
- C:\Windows\System\uJEhbMn.exe
  C:\Windows\System\uJEhbMn.exe
  2⤵
  PID:9956
- C:\Windows\System\oqqageg.exe
  C:\Windows\System\oqqageg.exe
  2⤵
  PID:9980
- C:\Windows\System\wzFilHA.exe
  C:\Windows\System\wzFilHA.exe
  2⤵
  PID:9996
- C:\Windows\System\jXBKYVW.exe
  C:\Windows\System\jXBKYVW.exe
  2⤵
  PID:10036
- C:\Windows\System\KxZoism.exe
  C:\Windows\System\KxZoism.exe
  2⤵
  PID:10132
- C:\Windows\System\VCaQcDY.exe
  C:\Windows\System\VCaQcDY.exe
  2⤵
  PID:10184
- C:\Windows\System\swZcSkY.exe
  C:\Windows\System\swZcSkY.exe
  2⤵
  PID:9292
- C:\Windows\System\zCXIjLw.exe
  C:\Windows\System\zCXIjLw.exe
  2⤵
  PID:9424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AqKwHDg.exe

Filesize
2.8MB

MD5
503d14098b1374abf78c49e9c168fe5a

SHA1
ef11fc6ebaf4f4e3092d74af7e8423fa8c6a117a

SHA256
727ad9421c7b130766258ceb187cf05ea428b9d07ad029f002f9c2d8fbc51018

SHA512
2b6e8f9f0fe8a8ff854bef949df4ef355a88cbf67e36608bc4eb9e6d4d116f661a1839ff9cfa3eed898c9165e82e066f085c76cea040a0da9500840dc6cadc42

Download Submit
C:\Windows\system\DKtEFAL.exe

Filesize
2.8MB

MD5
22a8eb9b58e5fab65cacb43bf889a456

SHA1
11b50c3c63ac62131df594e9cf8031c038766857

SHA256
c7f16f31a55495f322dae518fa368475c472920e0a012c0fb483d13b83ec2347

SHA512
02d21cc90cd8c8d11c523fac8bb47f841029c747a960adb538219bc59318416d559c2d2678c1ada76ebd1c6aa5abc89a214cbcda7c87ccad7e068d51d65b46cf

Download Submit
C:\Windows\system\FBGbEgZ.exe

Filesize
2.8MB

MD5
6ee026cfae5a0f76ca1a204234951687

SHA1
06d41949a0aa02d5eb85ce318e1e0f4526d122e0

SHA256
6cbe1bcb114171130d5a6b4e17e9646e151271d4e3fa7627d003bfa4c3a3bd58

SHA512
cab0686e18ff26f3bc097199a05d5b437f511841b6e0027fa6ded2f01d976640be2eb0662bfca1801fdcc321050cb2b315b762b9452e87d97d684314e8dad12f

Download Submit
C:\Windows\system\HPBlBvM.exe

Filesize
2.8MB

MD5
4c02e1a2182bff32eae5eafc873360fa

SHA1
358260efff74400e5e7e475468a07e78d86b6237

SHA256
b8055476833f154f573d241b7e2a8620bb430508ba44defeb83a5eeff715d153

SHA512
e0acbadf92c763433105be1d31fa7b3672082c2128b615c21e8a75c994a1b99edca4ef0304904edc84eadf01b945fec5d447d7adbf2d9a8c5c2a607f78ef2dc9

Download Submit
C:\Windows\system\HpAtsBS.exe

Filesize
2.8MB

MD5
4a20a79b36835147a5884bca55cef7f7

SHA1
5dced17b5ecc0a8fb01b80e019f771c1378e1cbd

SHA256
56cb09dcbcad094b0f338374d53ce65dc7080fcf108b48c0d4aaba629fbdd1b3

SHA512
a341ccbf6240b795dfe4e485298071821e617c1cf2745c261490e8519e19d4af91123c6715e3ced328b2561d0f95786b2634bdddf794873b0ec5187ea305ff89

Download Submit
C:\Windows\system\HtWEbNp.exe

Filesize
2.8MB

MD5
6d386163bc6e4f309a98dab175346316

SHA1
b1e0ea1222335729f0377d1311652d6f25083cec

SHA256
2f1691b625cb0875f704f6acb141bdfcacaa565809466c4d257962faf1884819

SHA512
146f4b3267d536d43104b3403881aa19652b47176e009f776bbd67d62e6796b62ffd3d693ea40d139ca58158d8b6b3ba0018e959ecee2c00e3bfaa9dfac730a7

Download Submit
C:\Windows\system\KpcadLD.exe

Filesize
2.8MB

MD5
ddf901e95f17bf83dd12f338c0f13670

SHA1
3570302e0bf535817300298f563b433e8ca8e5b2

SHA256
fd48bc5c5a0837b738d425ec5a6bbd42344b2386b4637e8a5a6767be821993df

SHA512
1517aaef562cfb79fc1c3bb7fe06af438294b56cbf055469e84236b7a999369531f35341c22a4284a6219b086c9741f6efb85ad8fbe0605eca2defb6bdef8cf8

Download Submit
C:\Windows\system\NVyqPib.exe

Filesize
2.8MB

MD5
4ba4987a7cdb6d3c6b94cd508e202b6e

SHA1
193569ac3aed81265363127aee22b30819c46d64

SHA256
43f50a82aec675010b3b3208dbc0e2711b85c82bad74bf98147a7d61fa4237ca

SHA512
fcff48eb5bfdf53f028c6e3b2831462a9386885f8797fd52897e9895d8f8d0720e65196d4c0f71db5bb836fb917cf03854fcc2b355dc93badd00b50970baa544

Download Submit
C:\Windows\system\NfHOPjk.exe

Filesize
2.8MB

MD5
4d2e9f9246c3b488cdcfc5d8e95b7b19

SHA1
3a43a7aabbaa3fda0c02535e2a117faa3b0f64a6

SHA256
ad07d7107bca4640d46fb43993a6375ba4237ec4b48c24cf3c9605cccc0e05b8

SHA512
b0730c0b1844a15b71010a1fbdc837fe9e34e3f363247e0277fb2e5743be8cbcc8d4300b64e32ebadc90651370a2f9242e17d3dbdcfc8bd63e4027a8a8fcc5a0

Download Submit
C:\Windows\system\OHPAycm.exe

Filesize
2.8MB

MD5
c74237104656550001afeb548ff42bbf

SHA1
1a45df8c0d1bdde07deabf70232175c64fc4a897

SHA256
59dec39b8c8e2ff9428ef159fe3fede3eeb41e8768f1a998f3e87977932e1990

SHA512
90250ff391aa0e1c67c6ac46380c102d6569f11145d3546c4c1da85bdc7858327d902b9a9e454d74fb343bf9189f996e077f2e9fb3f7371a75a7dc26a36a6e61

Download Submit
C:\Windows\system\Pmouufv.exe

Filesize
2.8MB

MD5
57dea1d825210b8792bce36e800e27bf

SHA1
34fc6ca0018467413f5ea8ec3e6d734095cef325

SHA256
6de678b68baf2d195f394a44647ea6d9a1e14fa3095197e93fb128c18693a9e0

SHA512
024a44e77a403b7b37d12c0dbb4106ff2b9160347732c4306fe6afd0aaf2399b1e08e88b0e46fab54a7f2b4da5c3a8fa7f9eaccc66e229eb4d269e753329655c

Download Submit
C:\Windows\system\ZpbypJu.exe

Filesize
2.8MB

MD5
b45446cdc55f41eff22fcc7d6bfaecdc

SHA1
af992aec64bc7f7890ba71aff3acd705bf11d5da

SHA256
c8b70cdad8260198320de147e70b5e97c9d057bd208d8fcd3ab238d789b0a4c4

SHA512
06fe6662433cd29ab64eb05d397d9a346477b247480687f58eff86846f006121bc95babfebea82284293ef5669e51f8a3e16a170cdc73252c962ca0696ec809a

Download Submit
C:\Windows\system\clvyNCw.exe

Filesize
2.8MB

MD5
22eded0c70b918c29a5ec8834b0480c0

SHA1
1689b6a4cf4cc122af6198391f42f5e9f2272dbc

SHA256
3e7db7e67f16171cf21de160263f15d48af14034ba3a96c105628981ab95cf62

SHA512
ae0cfde0a7d21387b129d31ed852c9fa036c574a60fba115ae7c1f1327213268b4351493166c0952825364038fc23f380d2038b25bbfe8e94eda583a6103c6b3

Download Submit
C:\Windows\system\eHGyaWp.exe

Filesize
2.8MB

MD5
bf1dc998c9318f878c1cf67cc433206b

SHA1
ec43ee890bab9a2ac20a76a49f65f39768c39963

SHA256
d8951984118dde1836e6da35f918ca7b72e4a645c2271d50d639b2ee8e22a153

SHA512
d81f1faa79c6c629de4dff3463bd8277e627dab62fc95d0c4d3facf47c7c93b9b0bc5f0e5912c86120d72bde71b15b773f22b98b2cecfa11536cf2e745fede9e

Download Submit
C:\Windows\system\eSWnvSn.exe

Filesize
2.8MB

MD5
284b5dac484fbdaff518afe0a4119a54

SHA1
cb9e6b5d2f56f52a5b745fc2e848c4f68417b4bd

SHA256
2e8060a7dca0d9540fd595453d56fece316d2149f0c9b0c4d591ea0740bbe01b

SHA512
ad436d5e1891f4574b1b19fc0dc33a1e1d7348d4192d8ed7669223a9e220f9bf8fcc10f293693d3ac57c7141f6373e5cf0c30c48bcc8b7e486dd3a151fdfdff0

Download Submit
C:\Windows\system\eeiHRTh.exe

Filesize
2.8MB

MD5
d8250d2ff5e507167322d55f00b4719f

SHA1
03d904b3fb6c388a9d0cbf0d9c62ecedffaa5009

SHA256
85c8050d8b58b9ab255cd7467308e8da8a2b9471b091b2fc81c4c533b6599df0

SHA512
23fb16b3720ef233ca4e9ddaa4e18882934aa57b81ee0b3302d6226792dcaa4ba48040bb4cab5ab1483dc9f2b6263346a8bd56713f4102a50355eb8ebf4e0303

Download Submit
C:\Windows\system\fEpUQXA.exe

Filesize
2.8MB

MD5
5aee60ad700855ebf904cfdf6a37532a

SHA1
23c9226acf52d3f93de9d97a82a93ace0bd63d76

SHA256
4ba59bafc13fcf0387e15a25d52af8df1161f51bc328b5722d3a9be4be5a794b

SHA512
a201875c59acc4986a3d706cff0b2312bb705427a2f00d972a40affac25cc0ded084a8440d5c6d2986ced417164e8cffc54fb5fa503d4f2e8745410153d8b613

Download Submit
C:\Windows\system\fdXjdaU.exe

Filesize
2.8MB

MD5
6a862ecab39e4e2b6fa2bd624e933301

SHA1
84d81fd050cf7d80e49a7b8313254c35cf0b06bc

SHA256
45a6147fb3253e988c4b33b5b5f0ca7110b202cdb133b4acff855c7fd47ebf82

SHA512
ba392db07b66b75348df7e461b73a9553f64b00249ea1f628e23116b74fd577f7c8287eee6f5c34c94971c550ce9b92e594259fee8df4e019c7a92071918871d

Download Submit
C:\Windows\system\igfASkP.exe

Filesize
2.8MB

MD5
ee41b23814af351eb97ff4fbea838e5d

SHA1
ce11ac2548819aec4088bcc1e4f9dc13650304e0

SHA256
80510c079f600c4292dda340ffb292ffd7f8f2b5a161b3504f49e6ff041ae808

SHA512
5737262a914fc7abfc66d83bc9d3ea160321fd2d8d4fd23a6a66bc9673d88492d03dd98bbe3fe69c778a9f8222f62cf499cbfc2cf0dda000461ddab5f7754cf4

Download Submit
C:\Windows\system\odZqPQt.exe

Filesize
2.8MB

MD5
6e15c3fe5ca13f6f4973826afe214ccf

SHA1
75a8756671db94495d5b8625c644323bf9746f00

SHA256
f52c7a00228ee151a5de810afb9e114bb2f983b732657acfaab02de55c737424

SHA512
aec3631f66f48848236e5a3217331d531c0ce921d30429d77a1b07b60d4a081c69356e70608bbbf2878498bd3247b0c00233f152f062f10872e6428c46d48673

Download Submit
C:\Windows\system\pANTnBm.exe

Filesize
2.8MB

MD5
29a442ff09be91cdcbda3c9daa1d74ed

SHA1
a55a5321112582beb55016bcdefb5c69b409dad0

SHA256
c0968f9bd42871562d290a52f2a1bc7d3d0464a01af5a87ff343ea7fed77dd03

SHA512
775ec4fac4045a8dc1a2b861ec13c7814d4399ae5b0a817d746e8e31cffdd01170f39a83ea039ff6e1fe2b45a0c63b72ed0bcec7a9936d64fa3db2ddfaa7dd1d

Download Submit
C:\Windows\system\pAlzWVF.exe

Filesize
8B

MD5
6c6a33c852f4e05ffd14cdf0dcab7779

SHA1
70449821f99925d7b8d245181569b7ac4d2ffae8

SHA256
889f3baefc9f46c7632a467db8882ec92f1f0df14da91d5a211e7484de261e45

SHA512
92e5654661ef50c470f84dbec4dcad9efdca5e4026c073f08c798af48c0b5d8107a7b2ff4d63fdb982f371e15d79e95f8a6d716a30b5c5123a7273c49d650d19

Download Submit
C:\Windows\system\piJmQmW.exe

Filesize
2.8MB

MD5
f3f632ce63cac6946deaccf62aab4c1f

SHA1
5c5ed04e993ef5725e1fb6b68dd3503b2b7fff1c

SHA256
c87985e3d5665cf9e0b7f57fd28aaca123af4052d4e97942ce62977cd5558d56

SHA512
8e72025227f091e308568fb57f1bc500e539d7c02a230c992248b256430dc08c8263709a8003cb904f44e969ea87da57cd9aea6a4a2e6401c2782f1b632bd714

Download Submit
C:\Windows\system\szIlkBx.exe

Filesize
2.8MB

MD5
8304391462cb4fdffbe98fee5b042843

SHA1
04443f2c44e6af0bf2657f28ee8d065403ee4333

SHA256
7cc77f627e2dc69f5cc3310d292766567c202a4dd8eaddb8861f61b70f20ee8a

SHA512
1c271478e2d4247cd880feccf3feb9a48290d1fa347838187b2f66ad505942574abbd9cfba9070b06c8e76b61434e94e47473a043226d36eeaee29a6cff32ab8

Download Submit
C:\Windows\system\twodRYz.exe

Filesize
2.8MB

MD5
aabd370833f3ab8e4284191d21e93b8d

SHA1
752a134146ef513ed68e6d27204a1f24bec6981c

SHA256
d18e4aaba07732d65fc954902471f476de81567ae227e5c74ed68b01e851bf9f

SHA512
5d5f481eb20c979781e80911864a02d4727f589111a038bad20484bba340ce8537c89e2df7835618658b2f98d3372f15eb739e549e5cbb897052cfe774d79b3c

Download Submit
C:\Windows\system\uMvlUtq.exe

Filesize
2.8MB

MD5
e3294e9b720c47aedea63d86dedb67ee

SHA1
b24b982e61dbbd0094fae3f453a9bccc4b458adc

SHA256
21109f6e166dc3c91f49f8db39049f95dfe808da6b84ec50fe700d437d0735a2

SHA512
c6984086e4ea21a818994474d4e788986611a9dcc552b49fb12b392a6b7f4d04d010f92b0daf82c75c25975090edd5ede87fa795ca0102ac8b570a66f474f6ee

Download Submit
C:\Windows\system\uvpHAmy.exe

Filesize
2.8MB

MD5
7527898d0de4113409ebce3b3bf0d7d8

SHA1
49937676e757bdbd3b7ffab9eaca148e49ebb348

SHA256
0ee3288e4a21da2d74091a3f98be5285c3a186b1e2546069c321437e72aa8788

SHA512
7acfc639b140340172ed35e2dffabcf1aa0770a3e3a5cce4ae1add5cd6f1c97f05190635fb9444999dcabd8a48ce4d7877f263c46f2dbeacf48c1fc6ee565607

Download Submit
\Windows\system\ATGUqic.exe

Filesize
2.8MB

MD5
06e6dc697ef95b786bfa380a641bfd25

SHA1
1e8d5b78ffdb28b25f07b670672714fe88258215

SHA256
d0634778bebd907ac3964b549aa9e86da93c206cca077278e65a4859b4c84f07

SHA512
a74ee05e78a62594dc2247c026ab77f909dc2aa7bc2d7d142f5cc6925dd5eff96161903c9760f26fa42ec1b66f462f57ea84eac040353430017d7cdf747c0e2f

Download Submit
\Windows\system\DhrStvw.exe

Filesize
2.8MB

MD5
9ba4c653ec594bb30b01010652eb61cf

SHA1
088701ea85d85a6952e0ca307a6e4a548fb85831

SHA256
ec165a0fd41b0316f15640ba7e1a7a7090c00fdd8190a81152b29f251105dfc0

SHA512
85201c3cf5e39f91548a9a46bb3bc4fc89460a56d4ad12ac964eeeae2c7f9e37e0c845453f137a3cbda9a1253f4e20b417ae4ac47dc26c13ac053da089a29b5b

Download Submit
\Windows\system\RFcqaaf.exe

Filesize
2.8MB

MD5
23953ce89360927ca70f42776b3d5106

SHA1
fb51dcd3b9087371e0d52544d0a992d4e2d3693c

SHA256
dd31ec6141769b3872feea214169f942e690e2a1de9fd1f26d7387aeca7be0ca

SHA512
cd7171943c86daf9d41250788a18f1eeeea2df3a74fb759fec61d985ad97d92e5e2edfd2542214fed573f754b827eccf34bac880bddf657fbf65c4dc8281ccf7

Download Submit
\Windows\system\UBijoNI.exe

Filesize
2.8MB

MD5
c60d35d793673281a21b8b07986c712d

SHA1
a37ae0027e8b7291807e0a379d5001ea3b1f290d

SHA256
e1ea4513eb9c36ab5643b2e42f1651a9b7296509b0f70b26fa133563cd60645a

SHA512
1572cd7950719d6a67e9d5690685cd0eedceb6ea0e75ace19bab2ba3b6323fcca4035914b7774de19c1a08c8aacc8565c38f672e8492af82aeb9771ccd258da3

Download Submit
\Windows\system\XPVJkVL.exe

Filesize
2.8MB

MD5
42445da3d4fc3f143977ba4e58df75b5

SHA1
902e5aa803950a8e4a0e48c61147e411a8346bf2

SHA256
05957bf75abeca416be7d9db92882a8f88bb2f151ecec588aacdf1074a30853d

SHA512
92a565d46b7488817d83d18db19d752d19711a80ebc1b5f189284069e66b297f369f79a1cc30a7f544b526fb0f7dd3ae3dbb1f0e0a16bffcd53fb22e49c94a79

Download Submit
\Windows\system\awrCHVB.exe

Filesize
2.8MB

MD5
547ddb06c5438806bf720b96dd97ecf0

SHA1
9c3ceeb8ca8d188cb3a81d7874f48a84dbe86b8e

SHA256
9749a466f0c6bff705c72568483ade498b9ba14584a0bfddfa369ae5549776b1

SHA512
fafaf33cba18cbafd1b9b3893604c796fa168dbd3bb3fc68b944401f10ddf9e2c17bbce0b20966f7889b029e2b8bfcf2a88402018c0c7da0e164d97b32fb60d7

Download Submit
memory/376-72-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/376-3338-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/376-6795-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/1968-17-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-3712-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/1968-70-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-47-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-111-0x000000013FC90000-0x0000000140086000-memory.dmp

Filesize
4.0MB

Download
memory/1968-1-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/1968-43-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-34-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/1968-64-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-98-0x000000013F600000-0x000000013F9F6000-memory.dmp

Filesize
4.0MB

Download
memory/1968-13-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-94-0x0000000003620000-0x0000000003A16000-memory.dmp

Filesize
4.0MB

Download
memory/1968-69-0x000000013FB50000-0x000000013FF46000-memory.dmp

Filesize
4.0MB

Download
memory/1968-3711-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/1968-93-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/1968-25-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/1968-67-0x0000000003290000-0x0000000003686000-memory.dmp

Filesize
4.0MB

Download
memory/1968-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2160-2101-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2160-1695-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2336-24-0x000000013F520000-0x000000013F916000-memory.dmp

Filesize
4.0MB

Download
memory/2336-6792-0x000000013F520000-0x000000013F916000-memory.dmp

Filesize
4.0MB

Download
memory/2432-6800-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2432-2409-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2432-52-0x000000013F930000-0x000000013FD26000-memory.dmp

Filesize
4.0MB

Download
memory/2488-92-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2488-6801-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2488-3710-0x000000013F9D0000-0x000000013FDC6000-memory.dmp

Filesize
4.0MB

Download
memory/2496-1673-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2496-38-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2496-6799-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2592-71-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2592-6796-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2604-6794-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2604-27-0x000000013FB10000-0x000000013FF06000-memory.dmp

Filesize
4.0MB

Download
memory/2656-6793-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2656-19-0x000000013F3F0000-0x000000013F7E6000-memory.dmp

Filesize
4.0MB

Download
memory/2700-1666-0x000000013F500000-0x000000013F8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2700-6797-0x000000013F500000-0x000000013F8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2700-28-0x000000013F500000-0x000000013F8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2736-83-0x000000013F5A0000-0x000000013F996000-memory.dmp

Filesize
4.0MB

Download
memory/2736-6798-0x000000013F5A0000-0x000000013F996000-memory.dmp

Filesize
4.0MB

Download