xmrig | 0f5cdd6bd3b566fadd85fb6e435c6a9c461d1382cdb008503ac2036922841aff

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
Size

1.5MB
MD5

a916de2af8b180c4e45ffbe3c0b4fa90
SHA1

c26d6ba05dd0497faca8499fdd8968a2319828e6
SHA256

0f5cdd6bd3b566fadd85fb6e435c6a9c461d1382cdb008503ac2036922841aff
SHA512

4de42befee434d395eea1dc0f35a73b80747f9c190b7e8b1cce2c0dd25dff89a9e43b6351d9d91124f1b8ee6496e84c843b39857f34194f6c72e0963fd8006b5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgWqabE1yuya:Lz071uv4BPMkHC0IEFTo/abRu/

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/864-8-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2288-112-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2776-114-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/1316-110-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2780-108-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/1932-106-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/808-116-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/396-117-0x0000000002EB0000-0x00000000032A2000-memory.dmp	xmrig
behavioral1/memory/2516-118-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2596-120-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/3000-122-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/396-123-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/564-124-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2916-125-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2516-4847-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2288-6085-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/808-6086-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/3000-6091-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/1932-6089-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2776-6115-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2596-6165-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2916-6261-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/564-6231-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/864-6587-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/1316-6588-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2780-6716-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/396-7657-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2376	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
864	LboWyIQ.exe
2916	yUPiFCM.exe
1932	YHWjnOv.exe
2780	rDJLEQB.exe
1316	vMMSxEr.exe
2288	ToYFTCm.exe
2776	XqeZAHM.exe
808	fUfMzMB.exe
2516	HEAwhkz.exe
2596	CqXHcmH.exe
3000	boaZdTa.exe
564	aAZFCVV.exe
2824	kQhBlBq.exe
2868	oJipwrw.exe
3020	mApwTnd.exe
3016	YMPgxZB.exe
1328	VmkCqGs.exe
1060	OtNsctP.exe
572	KyojcTG.exe
800	VYrxhnM.exe
2328	SDbuaOL.exe
2104	IKrdBHF.exe
2068	fvgXoRM.exe
2620	sLJWoIS.exe
1252	UWGKuEh.exe
1836	buFzGri.exe
2476	EetsWwT.exe
2284	MBaAVVy.exe
852	ayWUlvh.exe
292	QDTVwbF.exe
1176	WEcxHsq.exe
1620	LesOWij.exe
112	MOsQFEV.exe
1052	vqLWUsa.exe
1720	gNnJkaq.exe
2240	flDYBey.exe
2324	QPBnBvD.exe
356	iDieklx.exe
1748	qUErJrK.exe
1608	NljrWuL.exe
2524	pFQSxwz.exe
1944	pkfdzgz.exe
2152	IsTpjZY.exe
484	cXQVeUO.exe
2252	CEpKwxo.exe
2564	crbeYlM.exe
2720	cLANjCd.exe
1796	GgFXSKN.exe
916	yiuesXh.exe
2436	ZSwponz.exe
1660	ptyeCYW.exe
1740	Wqiwhvv.exe
2356	tygVxsD.exe
1376	tygByFW.exe
2468	qwLViyS.exe
1512	oLpOldP.exe
1564	rQVBYQc.exe
3088	lEYGcpD.exe
3148	oZUbzpy.exe
3184	QMltprN.exe
3220	PLrnvlY.exe
3256	XSwgqMB.exe
788	hnvkCqE.exe
3300	JEREsMB.exe

Loads dropped DLL 64 IoCs

pid	Process
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/396-1-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x000d00000001226c-5.dat	upx
behavioral1/memory/864-8-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0037000000015f54-18.dat	upx
behavioral1/files/0x000f000000003683-23.dat	upx
behavioral1/files/0x0009000000016572-28.dat	upx
behavioral1/files/0x0007000000016824-33.dat	upx
behavioral1/files/0x0007000000016c4a-43.dat	upx
behavioral1/files/0x0006000000016d78-49.dat	upx
behavioral1/files/0x0006000000016db2-61.dat	upx
behavioral1/files/0x0006000000016dd1-72.dat	upx
behavioral1/files/0x000600000001720f-82.dat	upx
behavioral1/files/0x00060000000173b4-88.dat	upx
behavioral1/files/0x00060000000173d3-92.dat	upx
behavioral1/files/0x00060000000171ba-78.dat	upx
behavioral1/files/0x0006000000016dc8-67.dat	upx
behavioral1/files/0x0006000000017568-128.dat	upx
behavioral1/files/0x00060000000175f4-137.dat	upx
behavioral1/files/0x00060000000190d6-179.dat	upx
behavioral1/files/0x00050000000193d2-191.dat	upx
behavioral1/files/0x0005000000019349-186.dat	upx
behavioral1/files/0x0006000000018bc6-172.dat	upx
behavioral1/files/0x00050000000187a2-165.dat	upx
behavioral1/files/0x0005000000018784-158.dat	upx
behavioral1/files/0x0005000000018711-151.dat	upx
behavioral1/files/0x0005000000018701-144.dat	upx
behavioral1/files/0x00060000000173d6-98.dat	upx
behavioral1/files/0x0006000000016da0-57.dat	upx
behavioral1/files/0x0008000000016c67-47.dat	upx
behavioral1/files/0x0007000000016a7d-37.dat	upx
behavioral1/memory/2288-112-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/2776-114-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/1316-110-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2780-108-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/1932-106-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/808-116-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2516-118-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2596-120-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/3000-122-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/564-124-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2916-125-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x00060000000175e8-130.dat	upx
behavioral1/files/0x0005000000019296-181.dat	upx
behavioral1/files/0x00050000000186ff-139.dat	upx
behavioral1/files/0x00050000000193c5-188.dat	upx
behavioral1/files/0x0006000000018bda-174.dat	upx
behavioral1/files/0x0006000000018b73-167.dat	upx
behavioral1/files/0x000500000001878b-160.dat	upx
behavioral1/files/0x000500000001873a-153.dat	upx
behavioral1/files/0x000500000001870d-146.dat	upx
behavioral1/memory/2516-4847-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2288-6085-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/memory/808-6086-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/3000-6091-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/1932-6089-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2776-6115-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2596-6165-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2916-6261-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/564-6231-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/864-6587-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/1316-6588-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2780-6716-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/396-7657-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\flsuuim.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\IyHuPNi.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\tvbCxPH.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\rPAVskT.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\KIUXWue.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\hcsLrkS.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\qyixkXe.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\pCpbXsh.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\nqQXzWr.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\gCVuFBG.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\bKAVTJq.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\DLHwLwv.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\uxTczXp.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\MoYTeOZ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\WVrMDcW.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\fGXdMJl.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\eNoJaiJ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\kFSaSLn.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\kwRIHsQ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\JpVMLJX.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\aqOikGW.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\xTGhHdW.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\JWqzNcI.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\hMUNjTO.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ECzBNWF.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ETfeBjU.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\SWJwboI.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\iwOUsWj.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\yEASiKF.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\EzFtGpR.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\lmdSiGt.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\bzIgWwb.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\qWEpdRy.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ttTYdgt.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\AFUEkPX.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\wByTbRd.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\gIXsZHW.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\NIyretV.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ddibPHF.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\jgFwJni.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\xARkUIa.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\KjBMBSl.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\yujAfWG.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\kyYjkBv.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\GWrNvRd.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\QasPhNS.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\pyRaQZf.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\MXKtYnJ.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\SiqzTEX.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\gNxXjgY.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\vMMSxEr.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\HsnrLWk.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\plOheGb.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\pNQhwsq.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\fPJsNmv.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\JdCxypq.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\qnzXmXv.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\skSEcoo.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\ajWZozr.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\dVXkyAD.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\DzQaLtq.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\fLMWteG.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\QyMVbPY.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
File created	C:\Windows\System\iWmvUsK.exe	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeLockMemoryPrivilege	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 2376	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	29
PID 396 wrote to memory of 2376	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	29
PID 396 wrote to memory of 2376	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	29
PID 396 wrote to memory of 864	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	30
PID 396 wrote to memory of 864	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	30
PID 396 wrote to memory of 864	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	30
PID 396 wrote to memory of 2916	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	31
PID 396 wrote to memory of 2916	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	31
PID 396 wrote to memory of 2916	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	31
PID 396 wrote to memory of 1932	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	32
PID 396 wrote to memory of 1932	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	32
PID 396 wrote to memory of 1932	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	32
PID 396 wrote to memory of 2780	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	33
PID 396 wrote to memory of 2780	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	33
PID 396 wrote to memory of 2780	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	33
PID 396 wrote to memory of 1316	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	34
PID 396 wrote to memory of 1316	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	34
PID 396 wrote to memory of 1316	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	34
PID 396 wrote to memory of 2288	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	35
PID 396 wrote to memory of 2288	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	35
PID 396 wrote to memory of 2288	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	35
PID 396 wrote to memory of 2776	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	36
PID 396 wrote to memory of 2776	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	36
PID 396 wrote to memory of 2776	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	36
PID 396 wrote to memory of 808	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	37
PID 396 wrote to memory of 808	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	37
PID 396 wrote to memory of 808	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	37
PID 396 wrote to memory of 2516	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	38
PID 396 wrote to memory of 2516	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	38
PID 396 wrote to memory of 2516	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	38
PID 396 wrote to memory of 2596	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	39
PID 396 wrote to memory of 2596	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	39
PID 396 wrote to memory of 2596	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	39
PID 396 wrote to memory of 3000	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	40
PID 396 wrote to memory of 3000	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	40
PID 396 wrote to memory of 3000	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	40
PID 396 wrote to memory of 564	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	41
PID 396 wrote to memory of 564	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	41
PID 396 wrote to memory of 564	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	41
PID 396 wrote to memory of 2824	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	42
PID 396 wrote to memory of 2824	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	42
PID 396 wrote to memory of 2824	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	42
PID 396 wrote to memory of 2868	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	43
PID 396 wrote to memory of 2868	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	43
PID 396 wrote to memory of 2868	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	43
PID 396 wrote to memory of 3020	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	44
PID 396 wrote to memory of 3020	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	44
PID 396 wrote to memory of 3020	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	44
PID 396 wrote to memory of 3016	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	45
PID 396 wrote to memory of 3016	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	45
PID 396 wrote to memory of 3016	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	45
PID 396 wrote to memory of 1328	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	46
PID 396 wrote to memory of 1328	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	46
PID 396 wrote to memory of 1328	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	46
PID 396 wrote to memory of 1060	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	47
PID 396 wrote to memory of 1060	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	47
PID 396 wrote to memory of 1060	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	47
PID 396 wrote to memory of 572	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	48
PID 396 wrote to memory of 572	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	48
PID 396 wrote to memory of 572	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	48
PID 396 wrote to memory of 788	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	49
PID 396 wrote to memory of 788	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	49
PID 396 wrote to memory of 788	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	49
PID 396 wrote to memory of 800	396	a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a916de2af8b180c4e45ffbe3c0b4fa90_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System\LboWyIQ.exe
  C:\Windows\System\LboWyIQ.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\yUPiFCM.exe
  C:\Windows\System\yUPiFCM.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\YHWjnOv.exe
  C:\Windows\System\YHWjnOv.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\rDJLEQB.exe
  C:\Windows\System\rDJLEQB.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\vMMSxEr.exe
  C:\Windows\System\vMMSxEr.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\ToYFTCm.exe
  C:\Windows\System\ToYFTCm.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\XqeZAHM.exe
  C:\Windows\System\XqeZAHM.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\fUfMzMB.exe
  C:\Windows\System\fUfMzMB.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\HEAwhkz.exe
  C:\Windows\System\HEAwhkz.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\CqXHcmH.exe
  C:\Windows\System\CqXHcmH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\boaZdTa.exe
  C:\Windows\System\boaZdTa.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\aAZFCVV.exe
  C:\Windows\System\aAZFCVV.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\kQhBlBq.exe
  C:\Windows\System\kQhBlBq.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\oJipwrw.exe
  C:\Windows\System\oJipwrw.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\mApwTnd.exe
  C:\Windows\System\mApwTnd.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\YMPgxZB.exe
  C:\Windows\System\YMPgxZB.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\VmkCqGs.exe
  C:\Windows\System\VmkCqGs.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\OtNsctP.exe
  C:\Windows\System\OtNsctP.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\KyojcTG.exe
  C:\Windows\System\KyojcTG.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\hnvkCqE.exe
  C:\Windows\System\hnvkCqE.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\VYrxhnM.exe
  C:\Windows\System\VYrxhnM.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\LphQXTN.exe
  C:\Windows\System\LphQXTN.exe
  2⤵
  PID:1532
- C:\Windows\System\SDbuaOL.exe
  C:\Windows\System\SDbuaOL.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\YCuciRV.exe
  C:\Windows\System\YCuciRV.exe
  2⤵
  PID:1460
- C:\Windows\System\IKrdBHF.exe
  C:\Windows\System\IKrdBHF.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\qhmZdAo.exe
  C:\Windows\System\qhmZdAo.exe
  2⤵
  PID:2108
- C:\Windows\System\fvgXoRM.exe
  C:\Windows\System\fvgXoRM.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\HaXSXwN.exe
  C:\Windows\System\HaXSXwN.exe
  2⤵
  PID:2368
- C:\Windows\System\sLJWoIS.exe
  C:\Windows\System\sLJWoIS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\oxoMNEQ.exe
  C:\Windows\System\oxoMNEQ.exe
  2⤵
  PID:2232
- C:\Windows\System\UWGKuEh.exe
  C:\Windows\System\UWGKuEh.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\EDrttoR.exe
  C:\Windows\System\EDrttoR.exe
  2⤵
  PID:1504
- C:\Windows\System\buFzGri.exe
  C:\Windows\System\buFzGri.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\jxgOSVS.exe
  C:\Windows\System\jxgOSVS.exe
  2⤵
  PID:2304
- C:\Windows\System\EetsWwT.exe
  C:\Windows\System\EetsWwT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\uUheNVa.exe
  C:\Windows\System\uUheNVa.exe
  2⤵
  PID:444
- C:\Windows\System\MBaAVVy.exe
  C:\Windows\System\MBaAVVy.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\vOQCyZx.exe
  C:\Windows\System\vOQCyZx.exe
  2⤵
  PID:2280
- C:\Windows\System\ayWUlvh.exe
  C:\Windows\System\ayWUlvh.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\sSENwPG.exe
  C:\Windows\System\sSENwPG.exe
  2⤵
  PID:1552
- C:\Windows\System\QDTVwbF.exe
  C:\Windows\System\QDTVwbF.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\mEHbXeO.exe
  C:\Windows\System\mEHbXeO.exe
  2⤵
  PID:1556
- C:\Windows\System\WEcxHsq.exe
  C:\Windows\System\WEcxHsq.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\GjyXyMJ.exe
  C:\Windows\System\GjyXyMJ.exe
  2⤵
  PID:1636
- C:\Windows\System\LesOWij.exe
  C:\Windows\System\LesOWij.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\JdbCRvD.exe
  C:\Windows\System\JdbCRvD.exe
  2⤵
  PID:956
- C:\Windows\System\MOsQFEV.exe
  C:\Windows\System\MOsQFEV.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\BIAxREg.exe
  C:\Windows\System\BIAxREg.exe
  2⤵
  PID:2928
- C:\Windows\System\vqLWUsa.exe
  C:\Windows\System\vqLWUsa.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\SRskOVt.exe
  C:\Windows\System\SRskOVt.exe
  2⤵
  PID:924
- C:\Windows\System\gNnJkaq.exe
  C:\Windows\System\gNnJkaq.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\XaNIiTp.exe
  C:\Windows\System\XaNIiTp.exe
  2⤵
  PID:1400
- C:\Windows\System\flDYBey.exe
  C:\Windows\System\flDYBey.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\GQOhHkY.exe
  C:\Windows\System\GQOhHkY.exe
  2⤵
  PID:1068
- C:\Windows\System\QPBnBvD.exe
  C:\Windows\System\QPBnBvD.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\HLVxPpH.exe
  C:\Windows\System\HLVxPpH.exe
  2⤵
  PID:3044
- C:\Windows\System\iDieklx.exe
  C:\Windows\System\iDieklx.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\PVUEESZ.exe
  C:\Windows\System\PVUEESZ.exe
  2⤵
  PID:1772
- C:\Windows\System\qUErJrK.exe
  C:\Windows\System\qUErJrK.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\gKvlEre.exe
  C:\Windows\System\gKvlEre.exe
  2⤵
  PID:1764
- C:\Windows\System\NljrWuL.exe
  C:\Windows\System\NljrWuL.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\EGLgsOr.exe
  C:\Windows\System\EGLgsOr.exe
  2⤵
  PID:1604
- C:\Windows\System\pFQSxwz.exe
  C:\Windows\System\pFQSxwz.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\OIazHFn.exe
  C:\Windows\System\OIazHFn.exe
  2⤵
  PID:3004
- C:\Windows\System\pkfdzgz.exe
  C:\Windows\System\pkfdzgz.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\qZezSgh.exe
  C:\Windows\System\qZezSgh.exe
  2⤵
  PID:2972
- C:\Windows\System\IsTpjZY.exe
  C:\Windows\System\IsTpjZY.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\qPNKuGW.exe
  C:\Windows\System\qPNKuGW.exe
  2⤵
  PID:2828
- C:\Windows\System\cXQVeUO.exe
  C:\Windows\System\cXQVeUO.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\NXozZWQ.exe
  C:\Windows\System\NXozZWQ.exe
  2⤵
  PID:2900
- C:\Windows\System\CEpKwxo.exe
  C:\Windows\System\CEpKwxo.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\blBcaXL.exe
  C:\Windows\System\blBcaXL.exe
  2⤵
  PID:2920
- C:\Windows\System\crbeYlM.exe
  C:\Windows\System\crbeYlM.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\IhPsTfD.exe
  C:\Windows\System\IhPsTfD.exe
  2⤵
  PID:1296
- C:\Windows\System\cLANjCd.exe
  C:\Windows\System\cLANjCd.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\cIJNuJT.exe
  C:\Windows\System\cIJNuJT.exe
  2⤵
  PID:1804
- C:\Windows\System\GgFXSKN.exe
  C:\Windows\System\GgFXSKN.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\EyZJjLe.exe
  C:\Windows\System\EyZJjLe.exe
  2⤵
  PID:780
- C:\Windows\System\yiuesXh.exe
  C:\Windows\System\yiuesXh.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\gJkHWrY.exe
  C:\Windows\System\gJkHWrY.exe
  2⤵
  PID:2196
- C:\Windows\System\ZSwponz.exe
  C:\Windows\System\ZSwponz.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\jXbSZbb.exe
  C:\Windows\System\jXbSZbb.exe
  2⤵
  PID:592
- C:\Windows\System\ptyeCYW.exe
  C:\Windows\System\ptyeCYW.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\BxeiEqC.exe
  C:\Windows\System\BxeiEqC.exe
  2⤵
  PID:2192
- C:\Windows\System\Wqiwhvv.exe
  C:\Windows\System\Wqiwhvv.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\gAaXCLX.exe
  C:\Windows\System\gAaXCLX.exe
  2⤵
  PID:968
- C:\Windows\System\tygVxsD.exe
  C:\Windows\System\tygVxsD.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\SHDSQdZ.exe
  C:\Windows\System\SHDSQdZ.exe
  2⤵
  PID:3036
- C:\Windows\System\tygByFW.exe
  C:\Windows\System\tygByFW.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\LYDboXD.exe
  C:\Windows\System\LYDboXD.exe
  2⤵
  PID:2656
- C:\Windows\System\qwLViyS.exe
  C:\Windows\System\qwLViyS.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\cPhQGGP.exe
  C:\Windows\System\cPhQGGP.exe
  2⤵
  PID:700
- C:\Windows\System\oLpOldP.exe
  C:\Windows\System\oLpOldP.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\UrFaOKb.exe
  C:\Windows\System\UrFaOKb.exe
  2⤵
  PID:540
- C:\Windows\System\rQVBYQc.exe
  C:\Windows\System\rQVBYQc.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\gfaBBJl.exe
  C:\Windows\System\gfaBBJl.exe
  2⤵
  PID:2296
- C:\Windows\System\lEYGcpD.exe
  C:\Windows\System\lEYGcpD.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\sZwUsGS.exe
  C:\Windows\System\sZwUsGS.exe
  2⤵
  PID:3120
- C:\Windows\System\oZUbzpy.exe
  C:\Windows\System\oZUbzpy.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ZZEdUSM.exe
  C:\Windows\System\ZZEdUSM.exe
  2⤵
  PID:3164
- C:\Windows\System\QMltprN.exe
  C:\Windows\System\QMltprN.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\VngzonF.exe
  C:\Windows\System\VngzonF.exe
  2⤵
  PID:3200
- C:\Windows\System\PLrnvlY.exe
  C:\Windows\System\PLrnvlY.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\lxXioZb.exe
  C:\Windows\System\lxXioZb.exe
  2⤵
  PID:3236
- C:\Windows\System\XSwgqMB.exe
  C:\Windows\System\XSwgqMB.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\PqnuOwa.exe
  C:\Windows\System\PqnuOwa.exe
  2⤵
  PID:3272
- C:\Windows\System\JEREsMB.exe
  C:\Windows\System\JEREsMB.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\yvLtlZi.exe
  C:\Windows\System\yvLtlZi.exe
  2⤵
  PID:3316
- C:\Windows\System\VFZBlZh.exe
  C:\Windows\System\VFZBlZh.exe
  2⤵
  PID:3332
- C:\Windows\System\iKgkznd.exe
  C:\Windows\System\iKgkznd.exe
  2⤵
  PID:3348
- C:\Windows\System\jOqSenu.exe
  C:\Windows\System\jOqSenu.exe
  2⤵
  PID:3364
- C:\Windows\System\ItzPCve.exe
  C:\Windows\System\ItzPCve.exe
  2⤵
  PID:3380
- C:\Windows\System\XULOWbO.exe
  C:\Windows\System\XULOWbO.exe
  2⤵
  PID:3396
- C:\Windows\System\UFHnVvX.exe
  C:\Windows\System\UFHnVvX.exe
  2⤵
  PID:3412
- C:\Windows\System\PmSgAnt.exe
  C:\Windows\System\PmSgAnt.exe
  2⤵
  PID:3428
- C:\Windows\System\CRIasSg.exe
  C:\Windows\System\CRIasSg.exe
  2⤵
  PID:3444
- C:\Windows\System\nMAiEAK.exe
  C:\Windows\System\nMAiEAK.exe
  2⤵
  PID:3460
- C:\Windows\System\aBTjzrr.exe
  C:\Windows\System\aBTjzrr.exe
  2⤵
  PID:3476
- C:\Windows\System\ZoUsmSv.exe
  C:\Windows\System\ZoUsmSv.exe
  2⤵
  PID:3492
- C:\Windows\System\paAYbQd.exe
  C:\Windows\System\paAYbQd.exe
  2⤵
  PID:3512
- C:\Windows\System\saBnscp.exe
  C:\Windows\System\saBnscp.exe
  2⤵
  PID:3528
- C:\Windows\System\KRkejuJ.exe
  C:\Windows\System\KRkejuJ.exe
  2⤵
  PID:3544
- C:\Windows\System\ARiozak.exe
  C:\Windows\System\ARiozak.exe
  2⤵
  PID:3560
- C:\Windows\System\LOHYJVz.exe
  C:\Windows\System\LOHYJVz.exe
  2⤵
  PID:3576
- C:\Windows\System\JDYoEGb.exe
  C:\Windows\System\JDYoEGb.exe
  2⤵
  PID:3592
- C:\Windows\System\pLCvUcd.exe
  C:\Windows\System\pLCvUcd.exe
  2⤵
  PID:3608
- C:\Windows\System\HJeFXbn.exe
  C:\Windows\System\HJeFXbn.exe
  2⤵
  PID:3624
- C:\Windows\System\RAAuGgn.exe
  C:\Windows\System\RAAuGgn.exe
  2⤵
  PID:3640
- C:\Windows\System\ajVvBNl.exe
  C:\Windows\System\ajVvBNl.exe
  2⤵
  PID:3656
- C:\Windows\System\jrXpucD.exe
  C:\Windows\System\jrXpucD.exe
  2⤵
  PID:3704
- C:\Windows\System\gymuKOk.exe
  C:\Windows\System\gymuKOk.exe
  2⤵
  PID:3720
- C:\Windows\System\VxIpitp.exe
  C:\Windows\System\VxIpitp.exe
  2⤵
  PID:3736
- C:\Windows\System\mTPZxsw.exe
  C:\Windows\System\mTPZxsw.exe
  2⤵
  PID:3752
- C:\Windows\System\KeQUIrc.exe
  C:\Windows\System\KeQUIrc.exe
  2⤵
  PID:3768
- C:\Windows\System\AwUTWnC.exe
  C:\Windows\System\AwUTWnC.exe
  2⤵
  PID:2344
- C:\Windows\System\xKVufhm.exe
  C:\Windows\System\xKVufhm.exe
  2⤵
  PID:3112
- C:\Windows\System\Fhywlnj.exe
  C:\Windows\System\Fhywlnj.exe
  2⤵
  PID:3192
- C:\Windows\System\jceCwrT.exe
  C:\Windows\System\jceCwrT.exe
  2⤵
  PID:3268
- C:\Windows\System\azAevcw.exe
  C:\Windows\System\azAevcw.exe
  2⤵
  PID:1044
- C:\Windows\System\lnsswLn.exe
  C:\Windows\System\lnsswLn.exe
  2⤵
  PID:860
- C:\Windows\System\tFLLGNZ.exe
  C:\Windows\System\tFLLGNZ.exe
  2⤵
  PID:3404
- C:\Windows\System\vahwrgL.exe
  C:\Windows\System\vahwrgL.exe
  2⤵
  PID:3468
- C:\Windows\System\VfPQecP.exe
  C:\Windows\System\VfPQecP.exe
  2⤵
  PID:3536
- C:\Windows\System\tifkiPj.exe
  C:\Windows\System\tifkiPj.exe
  2⤵
  PID:3600
- C:\Windows\System\dBQojkx.exe
  C:\Windows\System\dBQojkx.exe
  2⤵
  PID:3664
- C:\Windows\System\iNIWlxm.exe
  C:\Windows\System\iNIWlxm.exe
  2⤵
  PID:3688
- C:\Windows\System\gNjhSYT.exe
  C:\Windows\System\gNjhSYT.exe
  2⤵
  PID:2544
- C:\Windows\System\whYrjje.exe
  C:\Windows\System\whYrjje.exe
  2⤵
  PID:1004
- C:\Windows\System\ZdqZbqT.exe
  C:\Windows\System\ZdqZbqT.exe
  2⤵
  PID:2528
- C:\Windows\System\oOfqCUL.exe
  C:\Windows\System\oOfqCUL.exe
  2⤵
  PID:2764
- C:\Windows\System\vPlQIvW.exe
  C:\Windows\System\vPlQIvW.exe
  2⤵
  PID:1632
- C:\Windows\System\NtPqRnm.exe
  C:\Windows\System\NtPqRnm.exe
  2⤵
  PID:3328
- C:\Windows\System\RMpIhUa.exe
  C:\Windows\System\RMpIhUa.exe
  2⤵
  PID:1300
- C:\Windows\System\kIKMHYa.exe
  C:\Windows\System\kIKMHYa.exe
  2⤵
  PID:3084
- C:\Windows\System\jBkBXWE.exe
  C:\Windows\System\jBkBXWE.exe
  2⤵
  PID:3784
- C:\Windows\System\xWupRsn.exe
  C:\Windows\System\xWupRsn.exe
  2⤵
  PID:856
- C:\Windows\System\csTMhFF.exe
  C:\Windows\System\csTMhFF.exe
  2⤵
  PID:3776
- C:\Windows\System\LsiwYEx.exe
  C:\Windows\System\LsiwYEx.exe
  2⤵
  PID:3864
- C:\Windows\System\BQLknpZ.exe
  C:\Windows\System\BQLknpZ.exe
  2⤵
  PID:2488
- C:\Windows\System\uXEetBB.exe
  C:\Windows\System\uXEetBB.exe
  2⤵
  PID:2308
- C:\Windows\System\pNPkONl.exe
  C:\Windows\System\pNPkONl.exe
  2⤵
  PID:1112
- C:\Windows\System\iFyXeSq.exe
  C:\Windows\System\iFyXeSq.exe
  2⤵
  PID:1256
- C:\Windows\System\cFoBEig.exe
  C:\Windows\System\cFoBEig.exe
  2⤵
  PID:2556
- C:\Windows\System\npAMQTI.exe
  C:\Windows\System\npAMQTI.exe
  2⤵
  PID:2684
- C:\Windows\System\MkeEwbg.exe
  C:\Windows\System\MkeEwbg.exe
  2⤵
  PID:2548
- C:\Windows\System\ljgtcfC.exe
  C:\Windows\System\ljgtcfC.exe
  2⤵
  PID:2632
- C:\Windows\System\SLQWfDV.exe
  C:\Windows\System\SLQWfDV.exe
  2⤵
  PID:684
- C:\Windows\System\DRHlXeU.exe
  C:\Windows\System\DRHlXeU.exe
  2⤵
  PID:3144
- C:\Windows\System\VjFMRuY.exe
  C:\Windows\System\VjFMRuY.exe
  2⤵
  PID:3488
- C:\Windows\System\NiFPzdr.exe
  C:\Windows\System\NiFPzdr.exe
  2⤵
  PID:3556
- C:\Windows\System\uUVAojI.exe
  C:\Windows\System\uUVAojI.exe
  2⤵
  PID:2392
- C:\Windows\System\EVcutHR.exe
  C:\Windows\System\EVcutHR.exe
  2⤵
  PID:1996
- C:\Windows\System\tYAmGsO.exe
  C:\Windows\System\tYAmGsO.exe
  2⤵
  PID:3800
- C:\Windows\System\vuKSlcd.exe
  C:\Windows\System\vuKSlcd.exe
  2⤵
  PID:3816
- C:\Windows\System\WMfogOI.exe
  C:\Windows\System\WMfogOI.exe
  2⤵
  PID:1984
- C:\Windows\System\szRjmAV.exe
  C:\Windows\System\szRjmAV.exe
  2⤵
  PID:3852
- C:\Windows\System\DAjRaiI.exe
  C:\Windows\System\DAjRaiI.exe
  2⤵
  PID:3388
- C:\Windows\System\CuNTaQR.exe
  C:\Windows\System\CuNTaQR.exe
  2⤵
  PID:3884
- C:\Windows\System\MscheOU.exe
  C:\Windows\System\MscheOU.exe
  2⤵
  PID:3912
- C:\Windows\System\NyPHgWx.exe
  C:\Windows\System\NyPHgWx.exe
  2⤵
  PID:3928
- C:\Windows\System\obkNSIF.exe
  C:\Windows\System\obkNSIF.exe
  2⤵
  PID:2396
- C:\Windows\System\tNMWfDb.exe
  C:\Windows\System\tNMWfDb.exe
  2⤵
  PID:2260
- C:\Windows\System\whXlsJx.exe
  C:\Windows\System\whXlsJx.exe
  2⤵
  PID:1972
- C:\Windows\System\YmMQOFI.exe
  C:\Windows\System\YmMQOFI.exe
  2⤵
  PID:636
- C:\Windows\System\OIowhzw.exe
  C:\Windows\System\OIowhzw.exe
  2⤵
  PID:2980
- C:\Windows\System\uaqhNVM.exe
  C:\Windows\System\uaqhNVM.exe
  2⤵
  PID:2388
- C:\Windows\System\HKyznia.exe
  C:\Windows\System\HKyznia.exe
  2⤵
  PID:908
- C:\Windows\System\mdGLXwj.exe
  C:\Windows\System\mdGLXwj.exe
  2⤵
  PID:1452
- C:\Windows\System\KXaOipX.exe
  C:\Windows\System\KXaOipX.exe
  2⤵
  PID:1656
- C:\Windows\System\SLFbZuC.exe
  C:\Windows\System\SLFbZuC.exe
  2⤵
  PID:1356
- C:\Windows\System\hLBEHKe.exe
  C:\Windows\System\hLBEHKe.exe
  2⤵
  PID:3952
- C:\Windows\System\xlFWldb.exe
  C:\Windows\System\xlFWldb.exe
  2⤵
  PID:3968
- C:\Windows\System\ehwlQvB.exe
  C:\Windows\System\ehwlQvB.exe
  2⤵
  PID:3988
- C:\Windows\System\FCGxNot.exe
  C:\Windows\System\FCGxNot.exe
  2⤵
  PID:4036
- C:\Windows\System\pAMkQuR.exe
  C:\Windows\System\pAMkQuR.exe
  2⤵
  PID:4060
- C:\Windows\System\mXcfqoC.exe
  C:\Windows\System\mXcfqoC.exe
  2⤵
  PID:1136
- C:\Windows\System\mPrLMyT.exe
  C:\Windows\System\mPrLMyT.exe
  2⤵
  PID:3116
- C:\Windows\System\WbglwNO.exe
  C:\Windows\System\WbglwNO.exe
  2⤵
  PID:3676
- C:\Windows\System\FnnAEGS.exe
  C:\Windows\System\FnnAEGS.exe
  2⤵
  PID:3376
- C:\Windows\System\nozGDlA.exe
  C:\Windows\System\nozGDlA.exe
  2⤵
  PID:2216
- C:\Windows\System\cFSROVE.exe
  C:\Windows\System\cFSROVE.exe
  2⤵
  PID:1952
- C:\Windows\System\wTvReZk.exe
  C:\Windows\System\wTvReZk.exe
  2⤵
  PID:2676
- C:\Windows\System\VcTOyhz.exe
  C:\Windows\System\VcTOyhz.exe
  2⤵
  PID:3132
- C:\Windows\System\RgMHqRJ.exe
  C:\Windows\System\RgMHqRJ.exe
  2⤵
  PID:3876
- C:\Windows\System\pKPVVuN.exe
  C:\Windows\System\pKPVVuN.exe
  2⤵
  PID:3696
- C:\Windows\System\exIMpFa.exe
  C:\Windows\System\exIMpFa.exe
  2⤵
  PID:3040
- C:\Windows\System\bjZmRqe.exe
  C:\Windows\System\bjZmRqe.exe
  2⤵
  PID:2340
- C:\Windows\System\MsYjOSG.exe
  C:\Windows\System\MsYjOSG.exe
  2⤵
  PID:3668
- C:\Windows\System\UbwLbek.exe
  C:\Windows\System\UbwLbek.exe
  2⤵
  PID:2080
- C:\Windows\System\JcLPUoe.exe
  C:\Windows\System\JcLPUoe.exe
  2⤵
  PID:2012
- C:\Windows\System\ZFSTKqY.exe
  C:\Windows\System\ZFSTKqY.exe
  2⤵
  PID:1672
- C:\Windows\System\qMfhjlN.exe
  C:\Windows\System\qMfhjlN.exe
  2⤵
  PID:3748
- C:\Windows\System\pgtLlYm.exe
  C:\Windows\System\pgtLlYm.exe
  2⤵
  PID:2316
- C:\Windows\System\vjEgbyR.exe
  C:\Windows\System\vjEgbyR.exe
  2⤵
  PID:3008
- C:\Windows\System\suGvxzj.exe
  C:\Windows\System\suGvxzj.exe
  2⤵
  PID:3616
- C:\Windows\System\AXIjNAT.exe
  C:\Windows\System\AXIjNAT.exe
  2⤵
  PID:3812
- C:\Windows\System\INaDMQo.exe
  C:\Windows\System\INaDMQo.exe
  2⤵
  PID:3848
- C:\Windows\System\rdXelAW.exe
  C:\Windows\System\rdXelAW.exe
  2⤵
  PID:1056
- C:\Windows\System\kPfCnIK.exe
  C:\Windows\System\kPfCnIK.exe
  2⤵
  PID:3712
- C:\Windows\System\FkMOyrq.exe
  C:\Windows\System\FkMOyrq.exe
  2⤵
  PID:3828
- C:\Windows\System\eCiLjnz.exe
  C:\Windows\System\eCiLjnz.exe
  2⤵
  PID:2660
- C:\Windows\System\VowxUjA.exe
  C:\Windows\System\VowxUjA.exe
  2⤵
  PID:1396
- C:\Windows\System\msyLXjJ.exe
  C:\Windows\System\msyLXjJ.exe
  2⤵
  PID:3208
- C:\Windows\System\cFvBvfZ.exe
  C:\Windows\System\cFvBvfZ.exe
  2⤵
  PID:3996
- C:\Windows\System\VomCOZK.exe
  C:\Windows\System\VomCOZK.exe
  2⤵
  PID:4012
- C:\Windows\System\EGGQnFJ.exe
  C:\Windows\System\EGGQnFJ.exe
  2⤵
  PID:4004
- C:\Windows\System\yquYARX.exe
  C:\Windows\System\yquYARX.exe
  2⤵
  PID:3452
- C:\Windows\System\TvQqBlW.exe
  C:\Windows\System\TvQqBlW.exe
  2⤵
  PID:3900
- C:\Windows\System\DAxNiva.exe
  C:\Windows\System\DAxNiva.exe
  2⤵
  PID:2896
- C:\Windows\System\hCpuYjZ.exe
  C:\Windows\System\hCpuYjZ.exe
  2⤵
  PID:768
- C:\Windows\System\ZJqhhel.exe
  C:\Windows\System\ZJqhhel.exe
  2⤵
  PID:3056
- C:\Windows\System\ixiSZGQ.exe
  C:\Windows\System\ixiSZGQ.exe
  2⤵
  PID:3976
- C:\Windows\System\ybPWZZY.exe
  C:\Windows\System\ybPWZZY.exe
  2⤵
  PID:1652
- C:\Windows\System\AZIpMdz.exe
  C:\Windows\System\AZIpMdz.exe
  2⤵
  PID:3096
- C:\Windows\System\slaqaVn.exe
  C:\Windows\System\slaqaVn.exe
  2⤵
  PID:4056
- C:\Windows\System\OZuHexO.exe
  C:\Windows\System\OZuHexO.exe
  2⤵
  PID:1108
- C:\Windows\System\GzpRTQE.exe
  C:\Windows\System\GzpRTQE.exe
  2⤵
  PID:3680
- C:\Windows\System\nIzvZOj.exe
  C:\Windows\System\nIzvZOj.exe
  2⤵
  PID:3508
- C:\Windows\System\IhRusyB.exe
  C:\Windows\System\IhRusyB.exe
  2⤵
  PID:1320
- C:\Windows\System\VOJgFMI.exe
  C:\Windows\System\VOJgFMI.exe
  2⤵
  PID:712
- C:\Windows\System\NHHfPKM.exe
  C:\Windows\System\NHHfPKM.exe
  2⤵
  PID:2364
- C:\Windows\System\fDFuPLT.exe
  C:\Windows\System\fDFuPLT.exe
  2⤵
  PID:1928
- C:\Windows\System\RHELswX.exe
  C:\Windows\System\RHELswX.exe
  2⤵
  PID:1684
- C:\Windows\System\HKGMYKB.exe
  C:\Windows\System\HKGMYKB.exe
  2⤵
  PID:2872
- C:\Windows\System\aGCOnnp.exe
  C:\Windows\System\aGCOnnp.exe
  2⤵
  PID:2504
- C:\Windows\System\IjhEVrC.exe
  C:\Windows\System\IjhEVrC.exe
  2⤵
  PID:1368
- C:\Windows\System\CUjtUmt.exe
  C:\Windows\System\CUjtUmt.exe
  2⤵
  PID:2808
- C:\Windows\System\BabSjCP.exe
  C:\Windows\System\BabSjCP.exe
  2⤵
  PID:2820
- C:\Windows\System\iEvdvvN.exe
  C:\Windows\System\iEvdvvN.exe
  2⤵
  PID:1144
- C:\Windows\System\oHOujik.exe
  C:\Windows\System\oHOujik.exe
  2⤵
  PID:3808
- C:\Windows\System\fkUjnqt.exe
  C:\Windows\System\fkUjnqt.exe
  2⤵
  PID:2884
- C:\Windows\System\DqOaKfc.exe
  C:\Windows\System\DqOaKfc.exe
  2⤵
  PID:1868
- C:\Windows\System\ofrmmTn.exe
  C:\Windows\System\ofrmmTn.exe
  2⤵
  PID:3280
- C:\Windows\System\RWJKDBY.exe
  C:\Windows\System\RWJKDBY.exe
  2⤵
  PID:2708
- C:\Windows\System\dbXOsSi.exe
  C:\Windows\System\dbXOsSi.exe
  2⤵
  PID:1272
- C:\Windows\System\HjXUXoD.exe
  C:\Windows\System\HjXUXoD.exe
  2⤵
  PID:3128
- C:\Windows\System\OtbuMBy.exe
  C:\Windows\System\OtbuMBy.exe
  2⤵
  PID:3896
- C:\Windows\System\kyYjkBv.exe
  C:\Windows\System\kyYjkBv.exe
  2⤵
  PID:3232
- C:\Windows\System\sTQQuoS.exe
  C:\Windows\System\sTQQuoS.exe
  2⤵
  PID:3160
- C:\Windows\System\zHghcFl.exe
  C:\Windows\System\zHghcFl.exe
  2⤵
  PID:4008
- C:\Windows\System\iXpTSii.exe
  C:\Windows\System\iXpTSii.exe
  2⤵
  PID:1716
- C:\Windows\System\yvhaRoL.exe
  C:\Windows\System\yvhaRoL.exe
  2⤵
  PID:3176
- C:\Windows\System\eJLsAFN.exe
  C:\Windows\System\eJLsAFN.exe
  2⤵
  PID:3632
- C:\Windows\System\zfHLnQb.exe
  C:\Windows\System\zfHLnQb.exe
  2⤵
  PID:3764
- C:\Windows\System\uYltVYz.exe
  C:\Windows\System\uYltVYz.exe
  2⤵
  PID:2852
- C:\Windows\System\Oktyyah.exe
  C:\Windows\System\Oktyyah.exe
  2⤵
  PID:3880
- C:\Windows\System\OpTixMP.exe
  C:\Windows\System\OpTixMP.exe
  2⤵
  PID:1736
- C:\Windows\System\QMnFibR.exe
  C:\Windows\System\QMnFibR.exe
  2⤵
  PID:2648
- C:\Windows\System\TwKRLKl.exe
  C:\Windows\System\TwKRLKl.exe
  2⤵
  PID:2208
- C:\Windows\System\LajTTYb.exe
  C:\Windows\System\LajTTYb.exe
  2⤵
  PID:1668
- C:\Windows\System\kZHAVEY.exe
  C:\Windows\System\kZHAVEY.exe
  2⤵
  PID:3292
- C:\Windows\System\XrXHxnp.exe
  C:\Windows\System\XrXHxnp.exe
  2⤵
  PID:3104
- C:\Windows\System\ybYttQJ.exe
  C:\Windows\System\ybYttQJ.exe
  2⤵
  PID:3440
- C:\Windows\System\qQfOnfq.exe
  C:\Windows\System\qQfOnfq.exe
  2⤵
  PID:1700
- C:\Windows\System\TOnWyXB.exe
  C:\Windows\System\TOnWyXB.exe
  2⤵
  PID:1040
- C:\Windows\System\rVSFoPF.exe
  C:\Windows\System\rVSFoPF.exe
  2⤵
  PID:1676
- C:\Windows\System\BIePaES.exe
  C:\Windows\System\BIePaES.exe
  2⤵
  PID:880
- C:\Windows\System\JTxhdFR.exe
  C:\Windows\System\JTxhdFR.exe
  2⤵
  PID:1688
- C:\Windows\System\UdIZjUO.exe
  C:\Windows\System\UdIZjUO.exe
  2⤵
  PID:1704
- C:\Windows\System\JJsJcfI.exe
  C:\Windows\System\JJsJcfI.exe
  2⤵
  PID:2580
- C:\Windows\System\WdAKdwI.exe
  C:\Windows\System\WdAKdwI.exe
  2⤵
  PID:2204
- C:\Windows\System\LLvxyTy.exe
  C:\Windows\System\LLvxyTy.exe
  2⤵
  PID:3920
- C:\Windows\System\HJUVXZp.exe
  C:\Windows\System\HJUVXZp.exe
  2⤵
  PID:4028
- C:\Windows\System\MJVPoTq.exe
  C:\Windows\System\MJVPoTq.exe
  2⤵
  PID:348
- C:\Windows\System\VEEApQl.exe
  C:\Windows\System\VEEApQl.exe
  2⤵
  PID:3648
- C:\Windows\System\KatWROW.exe
  C:\Windows\System\KatWROW.exe
  2⤵
  PID:3908
- C:\Windows\System\KSFeBtq.exe
  C:\Windows\System\KSFeBtq.exe
  2⤵
  PID:3244
- C:\Windows\System\UrBmUoB.exe
  C:\Windows\System\UrBmUoB.exe
  2⤵
  PID:2832
- C:\Windows\System\UChzuxh.exe
  C:\Windows\System\UChzuxh.exe
  2⤵
  PID:1472
- C:\Windows\System\UMUyHml.exe
  C:\Windows\System\UMUyHml.exe
  2⤵
  PID:3340
- C:\Windows\System\xjLgzTS.exe
  C:\Windows\System\xjLgzTS.exe
  2⤵
  PID:3252
- C:\Windows\System\IZAMrny.exe
  C:\Windows\System\IZAMrny.exe
  2⤵
  PID:672
- C:\Windows\System\KZbfQkN.exe
  C:\Windows\System\KZbfQkN.exe
  2⤵
  PID:1212
- C:\Windows\System\EvZWePT.exe
  C:\Windows\System\EvZWePT.exe
  2⤵
  PID:1612
- C:\Windows\System\LGfnXKa.exe
  C:\Windows\System\LGfnXKa.exe
  2⤵
  PID:904
- C:\Windows\System\eiHgCYp.exe
  C:\Windows\System\eiHgCYp.exe
  2⤵
  PID:2988
- C:\Windows\System\GVEBWcC.exe
  C:\Windows\System\GVEBWcC.exe
  2⤵
  PID:1160
- C:\Windows\System\pGyVnHw.exe
  C:\Windows\System\pGyVnHw.exe
  2⤵
  PID:772
- C:\Windows\System\HfKqhla.exe
  C:\Windows\System\HfKqhla.exe
  2⤵
  PID:3568
- C:\Windows\System\rpUXJXh.exe
  C:\Windows\System\rpUXJXh.exe
  2⤵
  PID:2668
- C:\Windows\System\skhtSgC.exe
  C:\Windows\System\skhtSgC.exe
  2⤵
  PID:4108
- C:\Windows\System\yghQSlP.exe
  C:\Windows\System\yghQSlP.exe
  2⤵
  PID:4124
- C:\Windows\System\RdfPALM.exe
  C:\Windows\System\RdfPALM.exe
  2⤵
  PID:4140
- C:\Windows\System\DVcbUbw.exe
  C:\Windows\System\DVcbUbw.exe
  2⤵
  PID:4156
- C:\Windows\System\zMXZRTP.exe
  C:\Windows\System\zMXZRTP.exe
  2⤵
  PID:4240
- C:\Windows\System\sRTNjFB.exe
  C:\Windows\System\sRTNjFB.exe
  2⤵
  PID:4264
- C:\Windows\System\jfDfkVO.exe
  C:\Windows\System\jfDfkVO.exe
  2⤵
  PID:4288
- C:\Windows\System\vhRJOCW.exe
  C:\Windows\System\vhRJOCW.exe
  2⤵
  PID:4320
- C:\Windows\System\qGGxAlh.exe
  C:\Windows\System\qGGxAlh.exe
  2⤵
  PID:4372
- C:\Windows\System\VfLVYkf.exe
  C:\Windows\System\VfLVYkf.exe
  2⤵
  PID:4396
- C:\Windows\System\kBOFoev.exe
  C:\Windows\System\kBOFoev.exe
  2⤵
  PID:4420
- C:\Windows\System\uHvtkBW.exe
  C:\Windows\System\uHvtkBW.exe
  2⤵
  PID:4436
- C:\Windows\System\qXDprHI.exe
  C:\Windows\System\qXDprHI.exe
  2⤵
  PID:4452
- C:\Windows\System\GcVIHGI.exe
  C:\Windows\System\GcVIHGI.exe
  2⤵
  PID:4484
- C:\Windows\System\QLANmwH.exe
  C:\Windows\System\QLANmwH.exe
  2⤵
  PID:4504
- C:\Windows\System\XWmAnzY.exe
  C:\Windows\System\XWmAnzY.exe
  2⤵
  PID:4524
- C:\Windows\System\HbOYlTL.exe
  C:\Windows\System\HbOYlTL.exe
  2⤵
  PID:4540
- C:\Windows\System\sPhJadJ.exe
  C:\Windows\System\sPhJadJ.exe
  2⤵
  PID:4556
- C:\Windows\System\FvOlSPF.exe
  C:\Windows\System\FvOlSPF.exe
  2⤵
  PID:4572
- C:\Windows\System\FpoPITb.exe
  C:\Windows\System\FpoPITb.exe
  2⤵
  PID:4588
- C:\Windows\System\otvDlcy.exe
  C:\Windows\System\otvDlcy.exe
  2⤵
  PID:4604
- C:\Windows\System\JmXiayZ.exe
  C:\Windows\System\JmXiayZ.exe
  2⤵
  PID:4620
- C:\Windows\System\frNJOdv.exe
  C:\Windows\System\frNJOdv.exe
  2⤵
  PID:4636
- C:\Windows\System\OBkyrhO.exe
  C:\Windows\System\OBkyrhO.exe
  2⤵
  PID:4652
- C:\Windows\System\ghVgHFB.exe
  C:\Windows\System\ghVgHFB.exe
  2⤵
  PID:4688
- C:\Windows\System\EpZzbvF.exe
  C:\Windows\System\EpZzbvF.exe
  2⤵
  PID:4704
- C:\Windows\System\pVuodFN.exe
  C:\Windows\System\pVuodFN.exe
  2⤵
  PID:4720
- C:\Windows\System\cKFadNe.exe
  C:\Windows\System\cKFadNe.exe
  2⤵
  PID:4736
- C:\Windows\System\YywukId.exe
  C:\Windows\System\YywukId.exe
  2⤵
  PID:4836
- C:\Windows\System\ZQKVBxd.exe
  C:\Windows\System\ZQKVBxd.exe
  2⤵
  PID:4856
- C:\Windows\System\HDScGqy.exe
  C:\Windows\System\HDScGqy.exe
  2⤵
  PID:4876
- C:\Windows\System\qjHQrWj.exe
  C:\Windows\System\qjHQrWj.exe
  2⤵
  PID:4892
- C:\Windows\System\VruywFR.exe
  C:\Windows\System\VruywFR.exe
  2⤵
  PID:4908
- C:\Windows\System\PCbBveW.exe
  C:\Windows\System\PCbBveW.exe
  2⤵
  PID:4924
- C:\Windows\System\RmolKzw.exe
  C:\Windows\System\RmolKzw.exe
  2⤵
  PID:4940
- C:\Windows\System\cTcNGfU.exe
  C:\Windows\System\cTcNGfU.exe
  2⤵
  PID:4956
- C:\Windows\System\QmMDTXN.exe
  C:\Windows\System\QmMDTXN.exe
  2⤵
  PID:4972
- C:\Windows\System\QoSPkEG.exe
  C:\Windows\System\QoSPkEG.exe
  2⤵
  PID:4988
- C:\Windows\System\yIPXwjS.exe
  C:\Windows\System\yIPXwjS.exe
  2⤵
  PID:5004
- C:\Windows\System\kKVGSqA.exe
  C:\Windows\System\kKVGSqA.exe
  2⤵
  PID:5020
- C:\Windows\System\PJJwyHS.exe
  C:\Windows\System\PJJwyHS.exe
  2⤵
  PID:5036
- C:\Windows\System\CNyjBcX.exe
  C:\Windows\System\CNyjBcX.exe
  2⤵
  PID:5052
- C:\Windows\System\jidLehL.exe
  C:\Windows\System\jidLehL.exe
  2⤵
  PID:5068
- C:\Windows\System\XVZmvNB.exe
  C:\Windows\System\XVZmvNB.exe
  2⤵
  PID:5084
- C:\Windows\System\nHVErRG.exe
  C:\Windows\System\nHVErRG.exe
  2⤵
  PID:5100
- C:\Windows\System\IpoSuIu.exe
  C:\Windows\System\IpoSuIu.exe
  2⤵
  PID:5116
- C:\Windows\System\XJbmtMr.exe
  C:\Windows\System\XJbmtMr.exe
  2⤵
  PID:3652
- C:\Windows\System\GMHfPDF.exe
  C:\Windows\System\GMHfPDF.exe
  2⤵
  PID:4132
- C:\Windows\System\pbMHGLw.exe
  C:\Windows\System\pbMHGLw.exe
  2⤵
  PID:4200
- C:\Windows\System\jinSPil.exe
  C:\Windows\System\jinSPil.exe
  2⤵
  PID:4256
- C:\Windows\System\yKvITMu.exe
  C:\Windows\System\yKvITMu.exe
  2⤵
  PID:4232
- C:\Windows\System\hJhEdYl.exe
  C:\Windows\System\hJhEdYl.exe
  2⤵
  PID:3732
- C:\Windows\System\muAYMmG.exe
  C:\Windows\System\muAYMmG.exe
  2⤵
  PID:4328
- C:\Windows\System\RmxGvGx.exe
  C:\Windows\System\RmxGvGx.exe
  2⤵
  PID:4316
- C:\Windows\System\qpSKxHJ.exe
  C:\Windows\System\qpSKxHJ.exe
  2⤵
  PID:4348
- C:\Windows\System\HcUJnio.exe
  C:\Windows\System\HcUJnio.exe
  2⤵
  PID:4432
- C:\Windows\System\STarVhk.exe
  C:\Windows\System\STarVhk.exe
  2⤵
  PID:4408
- C:\Windows\System\eihvIVW.exe
  C:\Windows\System\eihvIVW.exe
  2⤵
  PID:4352
- C:\Windows\System\MiFkiCq.exe
  C:\Windows\System\MiFkiCq.exe
  2⤵
  PID:4472
- C:\Windows\System\PjnTKFy.exe
  C:\Windows\System\PjnTKFy.exe
  2⤵
  PID:4512
- C:\Windows\System\BmlzkAr.exe
  C:\Windows\System\BmlzkAr.exe
  2⤵
  PID:4552
- C:\Windows\System\Crquywt.exe
  C:\Windows\System\Crquywt.exe
  2⤵
  PID:4612
- C:\Windows\System\zdsnScu.exe
  C:\Windows\System\zdsnScu.exe
  2⤵
  PID:4648
- C:\Windows\System\CTxLoLK.exe
  C:\Windows\System\CTxLoLK.exe
  2⤵
  PID:4532
- C:\Windows\System\PJOfZOp.exe
  C:\Windows\System\PJOfZOp.exe
  2⤵
  PID:4684
- C:\Windows\System\IsqYcUp.exe
  C:\Windows\System\IsqYcUp.exe
  2⤵
  PID:4700
- C:\Windows\System\dzUAasR.exe
  C:\Windows\System\dzUAasR.exe
  2⤵
  PID:4756
- C:\Windows\System\OxckVIX.exe
  C:\Windows\System\OxckVIX.exe
  2⤵
  PID:4768
- C:\Windows\System\IMzDQcL.exe
  C:\Windows\System\IMzDQcL.exe
  2⤵
  PID:4764
- C:\Windows\System\awnjWlX.exe
  C:\Windows\System\awnjWlX.exe
  2⤵
  PID:4816
- C:\Windows\System\PnbpYwd.exe
  C:\Windows\System\PnbpYwd.exe
  2⤵
  PID:4824
- C:\Windows\System\LbMtNjG.exe
  C:\Windows\System\LbMtNjG.exe
  2⤵
  PID:4868
- C:\Windows\System\SbIJbRl.exe
  C:\Windows\System\SbIJbRl.exe
  2⤵
  PID:4948
- C:\Windows\System\CngKExP.exe
  C:\Windows\System\CngKExP.exe
  2⤵
  PID:5044
- C:\Windows\System\Zaixiwr.exe
  C:\Windows\System\Zaixiwr.exe
  2⤵
  PID:4968
- C:\Windows\System\hRirQSZ.exe
  C:\Windows\System\hRirQSZ.exe
  2⤵
  PID:4884
- C:\Windows\System\JNutLZV.exe
  C:\Windows\System\JNutLZV.exe
  2⤵
  PID:3296
- C:\Windows\System\iTRgzFr.exe
  C:\Windows\System\iTRgzFr.exe
  2⤵
  PID:5096
- C:\Windows\System\XWioUJB.exe
  C:\Windows\System\XWioUJB.exe
  2⤵
  PID:5028
- C:\Windows\System\TFlCFfC.exe
  C:\Windows\System\TFlCFfC.exe
  2⤵
  PID:5064
- C:\Windows\System\ogbDECf.exe
  C:\Windows\System\ogbDECf.exe
  2⤵
  PID:4284
- C:\Windows\System\WbcDCdP.exe
  C:\Windows\System\WbcDCdP.exe
  2⤵
  PID:4172
- C:\Windows\System\IANuVct.exe
  C:\Windows\System\IANuVct.exe
  2⤵
  PID:4196
- C:\Windows\System\lEXkMUn.exe
  C:\Windows\System\lEXkMUn.exe
  2⤵
  PID:4220
- C:\Windows\System\uyygjUY.exe
  C:\Windows\System\uyygjUY.exe
  2⤵
  PID:4300
- C:\Windows\System\KCdjalb.exe
  C:\Windows\System\KCdjalb.exe
  2⤵
  PID:4384
- C:\Windows\System\snJUqdF.exe
  C:\Windows\System\snJUqdF.exe
  2⤵
  PID:4356
- C:\Windows\System\ZWkjbvN.exe
  C:\Windows\System\ZWkjbvN.exe
  2⤵
  PID:4444
- C:\Windows\System\nHUacHU.exe
  C:\Windows\System\nHUacHU.exe
  2⤵
  PID:4500
- C:\Windows\System\NStTyOy.exe
  C:\Windows\System\NStTyOy.exe
  2⤵
  PID:4520
- C:\Windows\System\noCwnmU.exe
  C:\Windows\System\noCwnmU.exe
  2⤵
  PID:4584
- C:\Windows\System\xpxvvph.exe
  C:\Windows\System\xpxvvph.exe
  2⤵
  PID:4632
- C:\Windows\System\VWwBVAI.exe
  C:\Windows\System\VWwBVAI.exe
  2⤵
  PID:4600
- C:\Windows\System\dixtTgu.exe
  C:\Windows\System\dixtTgu.exe
  2⤵
  PID:4696
- C:\Windows\System\iiLQjGJ.exe
  C:\Windows\System\iiLQjGJ.exe
  2⤵
  PID:4776
- C:\Windows\System\IsjyFqn.exe
  C:\Windows\System\IsjyFqn.exe
  2⤵
  PID:4812
- C:\Windows\System\FaNMVWx.exe
  C:\Windows\System\FaNMVWx.exe
  2⤵
  PID:4828
- C:\Windows\System\LZvMHqL.exe
  C:\Windows\System\LZvMHqL.exe
  2⤵
  PID:4916
- C:\Windows\System\NlumFur.exe
  C:\Windows\System\NlumFur.exe
  2⤵
  PID:4980
- C:\Windows\System\yXnJDuM.exe
  C:\Windows\System\yXnJDuM.exe
  2⤵
  PID:5016
- C:\Windows\System\UPERPba.exe
  C:\Windows\System\UPERPba.exe
  2⤵
  PID:5000
- C:\Windows\System\zJPRVgu.exe
  C:\Windows\System\zJPRVgu.exe
  2⤵
  PID:4152
- C:\Windows\System\uXIhxyL.exe
  C:\Windows\System\uXIhxyL.exe
  2⤵
  PID:3264
- C:\Windows\System\bskSpqV.exe
  C:\Windows\System\bskSpqV.exe
  2⤵
  PID:2960
- C:\Windows\System\rWWMFom.exe
  C:\Windows\System\rWWMFom.exe
  2⤵
  PID:4224
- C:\Windows\System\yRgYuQP.exe
  C:\Windows\System\yRgYuQP.exe
  2⤵
  PID:4360
- C:\Windows\System\JxXwrnm.exe
  C:\Windows\System\JxXwrnm.exe
  2⤵
  PID:1696
- C:\Windows\System\vINYgCm.exe
  C:\Windows\System\vINYgCm.exe
  2⤵
  PID:4752
- C:\Windows\System\oQqyaaO.exe
  C:\Windows\System\oQqyaaO.exe
  2⤵
  PID:4716
- C:\Windows\System\Djwddkd.exe
  C:\Windows\System\Djwddkd.exe
  2⤵
  PID:4120
- C:\Windows\System\YcFwamu.exe
  C:\Windows\System\YcFwamu.exe
  2⤵
  PID:4744
- C:\Windows\System\jeBbPse.exe
  C:\Windows\System\jeBbPse.exe
  2⤵
  PID:4932
- C:\Windows\System\efuPyZS.exe
  C:\Windows\System\efuPyZS.exe
  2⤵
  PID:4848
- C:\Windows\System\aBhPKiT.exe
  C:\Windows\System\aBhPKiT.exe
  2⤵
  PID:4548
- C:\Windows\System\sdqxPcD.exe
  C:\Windows\System\sdqxPcD.exe
  2⤵
  PID:5060
- C:\Windows\System\DoOgRGC.exe
  C:\Windows\System\DoOgRGC.exe
  2⤵
  PID:4208
- C:\Windows\System\fhTovMR.exe
  C:\Windows\System\fhTovMR.exe
  2⤵
  PID:4212
- C:\Windows\System\wBbotQe.exe
  C:\Windows\System\wBbotQe.exe
  2⤵
  PID:4308
- C:\Windows\System\TUjqKLh.exe
  C:\Windows\System\TUjqKLh.exe
  2⤵
  PID:4492
- C:\Windows\System\NrQKXuh.exe
  C:\Windows\System\NrQKXuh.exe
  2⤵
  PID:4568
- C:\Windows\System\jlYhoEz.exe
  C:\Windows\System\jlYhoEz.exe
  2⤵
  PID:3796
- C:\Windows\System\zxeSsHU.exe
  C:\Windows\System\zxeSsHU.exe
  2⤵
  PID:4920
- C:\Windows\System\cYimLDb.exe
  C:\Windows\System\cYimLDb.exe
  2⤵
  PID:4216
- C:\Windows\System\mxQZFIz.exe
  C:\Windows\System\mxQZFIz.exe
  2⤵
  PID:5132
- C:\Windows\System\jabtXJZ.exe
  C:\Windows\System\jabtXJZ.exe
  2⤵
  PID:5152
- C:\Windows\System\pNQhwsq.exe
  C:\Windows\System\pNQhwsq.exe
  2⤵
  PID:5168
- C:\Windows\System\ckwZGCB.exe
  C:\Windows\System\ckwZGCB.exe
  2⤵
  PID:5184
- C:\Windows\System\NXPDULq.exe
  C:\Windows\System\NXPDULq.exe
  2⤵
  PID:5200
- C:\Windows\System\PKqqTnH.exe
  C:\Windows\System\PKqqTnH.exe
  2⤵
  PID:5216
- C:\Windows\System\lqQAMER.exe
  C:\Windows\System\lqQAMER.exe
  2⤵
  PID:5232
- C:\Windows\System\wsGJBpl.exe
  C:\Windows\System\wsGJBpl.exe
  2⤵
  PID:5248
- C:\Windows\System\HhCOyAa.exe
  C:\Windows\System\HhCOyAa.exe
  2⤵
  PID:5276
- C:\Windows\System\sjYZQma.exe
  C:\Windows\System\sjYZQma.exe
  2⤵
  PID:5292
- C:\Windows\System\STdqUUt.exe
  C:\Windows\System\STdqUUt.exe
  2⤵
  PID:5312
- C:\Windows\System\rjZUTtI.exe
  C:\Windows\System\rjZUTtI.exe
  2⤵
  PID:5340
- C:\Windows\System\PTDZwxM.exe
  C:\Windows\System\PTDZwxM.exe
  2⤵
  PID:5356
- C:\Windows\System\AZgTmIh.exe
  C:\Windows\System\AZgTmIh.exe
  2⤵
  PID:5380
- C:\Windows\System\SNyvFzE.exe
  C:\Windows\System\SNyvFzE.exe
  2⤵
  PID:5396
- C:\Windows\System\txqIxCZ.exe
  C:\Windows\System\txqIxCZ.exe
  2⤵
  PID:5412
- C:\Windows\System\dHjFzCE.exe
  C:\Windows\System\dHjFzCE.exe
  2⤵
  PID:5496
- C:\Windows\System\bpelpiM.exe
  C:\Windows\System\bpelpiM.exe
  2⤵
  PID:5520
- C:\Windows\System\nuQxZuj.exe
  C:\Windows\System\nuQxZuj.exe
  2⤵
  PID:5536
- C:\Windows\System\iWbaVck.exe
  C:\Windows\System\iWbaVck.exe
  2⤵
  PID:5552
- C:\Windows\System\maFoLhy.exe
  C:\Windows\System\maFoLhy.exe
  2⤵
  PID:5568
- C:\Windows\System\diWgmrU.exe
  C:\Windows\System\diWgmrU.exe
  2⤵
  PID:5584
- C:\Windows\System\nucpkSE.exe
  C:\Windows\System\nucpkSE.exe
  2⤵
  PID:5600
- C:\Windows\System\qZcUNGc.exe
  C:\Windows\System\qZcUNGc.exe
  2⤵
  PID:5616
- C:\Windows\System\tTkXjkQ.exe
  C:\Windows\System\tTkXjkQ.exe
  2⤵
  PID:5636
- C:\Windows\System\iXNovMB.exe
  C:\Windows\System\iXNovMB.exe
  2⤵
  PID:5652
- C:\Windows\System\dfUOGvh.exe
  C:\Windows\System\dfUOGvh.exe
  2⤵
  PID:5668
- C:\Windows\System\CwXFYMi.exe
  C:\Windows\System\CwXFYMi.exe
  2⤵
  PID:5684
- C:\Windows\System\PGwYYJr.exe
  C:\Windows\System\PGwYYJr.exe
  2⤵
  PID:5700
- C:\Windows\System\bhxLLcr.exe
  C:\Windows\System\bhxLLcr.exe
  2⤵
  PID:5716
- C:\Windows\System\eiemXWh.exe
  C:\Windows\System\eiemXWh.exe
  2⤵
  PID:5732
- C:\Windows\System\paOHmTp.exe
  C:\Windows\System\paOHmTp.exe
  2⤵
  PID:5752
- C:\Windows\System\lWghMkd.exe
  C:\Windows\System\lWghMkd.exe
  2⤵
  PID:5768
- C:\Windows\System\llDVrJy.exe
  C:\Windows\System\llDVrJy.exe
  2⤵
  PID:5784
- C:\Windows\System\SwXTdMf.exe
  C:\Windows\System\SwXTdMf.exe
  2⤵
  PID:5800
- C:\Windows\System\pBKGbRB.exe
  C:\Windows\System\pBKGbRB.exe
  2⤵
  PID:5816
- C:\Windows\System\YgXTkCW.exe
  C:\Windows\System\YgXTkCW.exe
  2⤵
  PID:5832
- C:\Windows\System\qyixkXe.exe
  C:\Windows\System\qyixkXe.exe
  2⤵
  PID:5848
- C:\Windows\System\CifStur.exe
  C:\Windows\System\CifStur.exe
  2⤵
  PID:5864
- C:\Windows\System\XzYSEOn.exe
  C:\Windows\System\XzYSEOn.exe
  2⤵
  PID:5900
- C:\Windows\System\VXpavrb.exe
  C:\Windows\System\VXpavrb.exe
  2⤵
  PID:5916
- C:\Windows\System\DjJWIri.exe
  C:\Windows\System\DjJWIri.exe
  2⤵
  PID:5932
- C:\Windows\System\buvJceX.exe
  C:\Windows\System\buvJceX.exe
  2⤵
  PID:5948
- C:\Windows\System\PSTROft.exe
  C:\Windows\System\PSTROft.exe
  2⤵
  PID:5964
- C:\Windows\System\CKoeimk.exe
  C:\Windows\System\CKoeimk.exe
  2⤵
  PID:5980
- C:\Windows\System\bUFIrUa.exe
  C:\Windows\System\bUFIrUa.exe
  2⤵
  PID:5996
- C:\Windows\System\KNuQnAt.exe
  C:\Windows\System\KNuQnAt.exe
  2⤵
  PID:6016
- C:\Windows\System\zUhxcFo.exe
  C:\Windows\System\zUhxcFo.exe
  2⤵
  PID:6032
- C:\Windows\System\LNzbhen.exe
  C:\Windows\System\LNzbhen.exe
  2⤵
  PID:6048
- C:\Windows\System\gAwHaQY.exe
  C:\Windows\System\gAwHaQY.exe
  2⤵
  PID:6064
- C:\Windows\System\qGRdoqe.exe
  C:\Windows\System\qGRdoqe.exe
  2⤵
  PID:6080
- C:\Windows\System\ehIAjjk.exe
  C:\Windows\System\ehIAjjk.exe
  2⤵
  PID:6096
- C:\Windows\System\DaXClNV.exe
  C:\Windows\System\DaXClNV.exe
  2⤵
  PID:6112
- C:\Windows\System\MvrgSCQ.exe
  C:\Windows\System\MvrgSCQ.exe
  2⤵
  PID:6128
- C:\Windows\System\lnTCywD.exe
  C:\Windows\System\lnTCywD.exe
  2⤵
  PID:4148
- C:\Windows\System\STlSYYn.exe
  C:\Windows\System\STlSYYn.exe
  2⤵
  PID:4664
- C:\Windows\System\fwKyoPC.exe
  C:\Windows\System\fwKyoPC.exe
  2⤵
  PID:5124
- C:\Windows\System\jDfgjOT.exe
  C:\Windows\System\jDfgjOT.exe
  2⤵
  PID:5192
- C:\Windows\System\bNwjatm.exe
  C:\Windows\System\bNwjatm.exe
  2⤵
  PID:5260
- C:\Windows\System\VDWzOoA.exe
  C:\Windows\System\VDWzOoA.exe
  2⤵
  PID:4176
- C:\Windows\System\zsEDxKT.exe
  C:\Windows\System\zsEDxKT.exe
  2⤵
  PID:4628
- C:\Windows\System\ekXYzyq.exe
  C:\Windows\System\ekXYzyq.exe
  2⤵
  PID:4888
- C:\Windows\System\XWymlVg.exe
  C:\Windows\System\XWymlVg.exe
  2⤵
  PID:5140
- C:\Windows\System\nJYfYFX.exe
  C:\Windows\System\nJYfYFX.exe
  2⤵
  PID:5404
- C:\Windows\System\BQAUcmB.exe
  C:\Windows\System\BQAUcmB.exe
  2⤵
  PID:5364
- C:\Windows\System\NsdOEeq.exe
  C:\Windows\System\NsdOEeq.exe
  2⤵
  PID:5324
- C:\Windows\System\EbAOVaf.exe
  C:\Windows\System\EbAOVaf.exe
  2⤵
  PID:5244
- C:\Windows\System\KceqxqR.exe
  C:\Windows\System\KceqxqR.exe
  2⤵
  PID:5176
- C:\Windows\System\YCJGmML.exe
  C:\Windows\System\YCJGmML.exe
  2⤵
  PID:5512
- C:\Windows\System\hZUMMKy.exe
  C:\Windows\System\hZUMMKy.exe
  2⤵
  PID:5576
- C:\Windows\System\JCCsMsv.exe
  C:\Windows\System\JCCsMsv.exe
  2⤵
  PID:5644
- C:\Windows\System\izFplEy.exe
  C:\Windows\System\izFplEy.exe
  2⤵
  PID:5708
- C:\Windows\System\YanKlHm.exe
  C:\Windows\System\YanKlHm.exe
  2⤵
  PID:5748
- C:\Windows\System\jEoOtVD.exe
  C:\Windows\System\jEoOtVD.exe
  2⤵
  PID:5308
- C:\Windows\System\qeVjhGb.exe
  C:\Windows\System\qeVjhGb.exe
  2⤵
  PID:5776
- C:\Windows\System\FFyNhac.exe
  C:\Windows\System\FFyNhac.exe
  2⤵
  PID:5268
- C:\Windows\System\VSysNQc.exe
  C:\Windows\System\VSysNQc.exe
  2⤵
  PID:5388
- C:\Windows\System\jnejDVh.exe
  C:\Windows\System\jnejDVh.exe
  2⤵
  PID:5440
- C:\Windows\System\JJjAYyr.exe
  C:\Windows\System\JJjAYyr.exe
  2⤵
  PID:5460
- C:\Windows\System\EqdbZpV.exe
  C:\Windows\System\EqdbZpV.exe
  2⤵
  PID:5480
- C:\Windows\System\muuOeBj.exe
  C:\Windows\System\muuOeBj.exe
  2⤵
  PID:5528
- C:\Windows\System\tYaYDxx.exe
  C:\Windows\System\tYaYDxx.exe
  2⤵
  PID:5592
- C:\Windows\System\BdUBfSs.exe
  C:\Windows\System\BdUBfSs.exe
  2⤵
  PID:5632
- C:\Windows\System\fPJsNmv.exe
  C:\Windows\System\fPJsNmv.exe
  2⤵
  PID:5696
- C:\Windows\System\sWyVzqM.exe
  C:\Windows\System\sWyVzqM.exe
  2⤵
  PID:5764
- C:\Windows\System\cokLyfs.exe
  C:\Windows\System\cokLyfs.exe
  2⤵
  PID:5812
- C:\Windows\System\HXIjvPz.exe
  C:\Windows\System\HXIjvPz.exe
  2⤵
  PID:5888
- C:\Windows\System\fAjluxJ.exe
  C:\Windows\System\fAjluxJ.exe
  2⤵
  PID:5876
- C:\Windows\System\HPvHGyA.exe
  C:\Windows\System\HPvHGyA.exe
  2⤵
  PID:4416
- C:\Windows\System\mGVsPwn.exe
  C:\Windows\System\mGVsPwn.exe
  2⤵
  PID:5960
- C:\Windows\System\FNSupjU.exe
  C:\Windows\System\FNSupjU.exe
  2⤵
  PID:6028
- C:\Windows\System\BxfDalP.exe
  C:\Windows\System\BxfDalP.exe
  2⤵
  PID:6092
- C:\Windows\System\UstBabC.exe
  C:\Windows\System\UstBabC.exe
  2⤵
  PID:4480
- C:\Windows\System\oxIJZDq.exe
  C:\Windows\System\oxIJZDq.exe
  2⤵
  PID:6008
- C:\Windows\System\ecLCQju.exe
  C:\Windows\System\ecLCQju.exe
  2⤵
  PID:6108
- C:\Windows\System\aOmVyRc.exe
  C:\Windows\System\aOmVyRc.exe
  2⤵
  PID:5908
- C:\Windows\System\ZLANEyY.exe
  C:\Windows\System\ZLANEyY.exe
  2⤵
  PID:5972
- C:\Windows\System\Enzgerm.exe
  C:\Windows\System\Enzgerm.exe
  2⤵
  PID:6076
- C:\Windows\System\gbyzqIA.exe
  C:\Windows\System\gbyzqIA.exe
  2⤵
  PID:5256
- C:\Windows\System\iIzBWuV.exe
  C:\Windows\System\iIzBWuV.exe
  2⤵
  PID:5408
- C:\Windows\System\gyfEEjK.exe
  C:\Windows\System\gyfEEjK.exe
  2⤵
  PID:5208
- C:\Windows\System\kuwnTtS.exe
  C:\Windows\System\kuwnTtS.exe
  2⤵
  PID:5548
- C:\Windows\System\wCvvois.exe
  C:\Windows\System\wCvvois.exe
  2⤵
  PID:5680
- C:\Windows\System\tknORLt.exe
  C:\Windows\System\tknORLt.exe
  2⤵
  PID:5872
- C:\Windows\System\BJQInbH.exe
  C:\Windows\System\BJQInbH.exe
  2⤵
  PID:6060
- C:\Windows\System\CytrlkQ.exe
  C:\Windows\System\CytrlkQ.exe
  2⤵
  PID:4864
- C:\Windows\System\kAwbvvL.exe
  C:\Windows\System\kAwbvvL.exe
  2⤵
  PID:4428
- C:\Windows\System\JFVnhmy.exe
  C:\Windows\System\JFVnhmy.exe
  2⤵
  PID:6024
- C:\Windows\System\wWbNrvR.exe
  C:\Windows\System\wWbNrvR.exe
  2⤵
  PID:6104
- C:\Windows\System\YCHnsnD.exe
  C:\Windows\System\YCHnsnD.exe
  2⤵
  PID:5544
- C:\Windows\System\MbzBGJO.exe
  C:\Windows\System\MbzBGJO.exe
  2⤵
  PID:5676
- C:\Windows\System\PUjibcH.exe
  C:\Windows\System\PUjibcH.exe
  2⤵
  PID:5264
- C:\Windows\System\IqbdFcU.exe
  C:\Windows\System\IqbdFcU.exe
  2⤵
  PID:5468
- C:\Windows\System\uyaYILg.exe
  C:\Windows\System\uyaYILg.exe
  2⤵
  PID:5508
- C:\Windows\System\faRzRrW.exe
  C:\Windows\System\faRzRrW.exe
  2⤵
  PID:5744
- C:\Windows\System\VWuCfun.exe
  C:\Windows\System\VWuCfun.exe
  2⤵
  PID:5352
- C:\Windows\System\LhtFPkS.exe
  C:\Windows\System\LhtFPkS.exe
  2⤵
  PID:5488
- C:\Windows\System\zzRgUhP.exe
  C:\Windows\System\zzRgUhP.exe
  2⤵
  PID:5728
- C:\Windows\System\eghCPFZ.exe
  C:\Windows\System\eghCPFZ.exe
  2⤵
  PID:5564
- C:\Windows\System\uohndJd.exe
  C:\Windows\System\uohndJd.exe
  2⤵
  PID:5860
- C:\Windows\System\bZhVaTD.exe
  C:\Windows\System\bZhVaTD.exe
  2⤵
  PID:5992
- C:\Windows\System\jveEYmu.exe
  C:\Windows\System\jveEYmu.exe
  2⤵
  PID:5456
- C:\Windows\System\LZbIXlS.exe
  C:\Windows\System\LZbIXlS.exe
  2⤵
  PID:5780
- C:\Windows\System\dXfDNpw.exe
  C:\Windows\System\dXfDNpw.exe
  2⤵
  PID:5796
- C:\Windows\System\DwFnojY.exe
  C:\Windows\System\DwFnojY.exe
  2⤵
  PID:6188
- C:\Windows\System\KztFlOC.exe
  C:\Windows\System\KztFlOC.exe
  2⤵
  PID:6340
- C:\Windows\System\WFvpPMu.exe
  C:\Windows\System\WFvpPMu.exe
  2⤵
  PID:6360
- C:\Windows\System\ZBKDHvV.exe
  C:\Windows\System\ZBKDHvV.exe
  2⤵
  PID:6380
- C:\Windows\System\yPRsRfu.exe
  C:\Windows\System\yPRsRfu.exe
  2⤵
  PID:6396
- C:\Windows\System\NlbbFYt.exe
  C:\Windows\System\NlbbFYt.exe
  2⤵
  PID:6412
- C:\Windows\System\dyPRyLA.exe
  C:\Windows\System\dyPRyLA.exe
  2⤵
  PID:6428
- C:\Windows\System\KseUEBB.exe
  C:\Windows\System\KseUEBB.exe
  2⤵
  PID:6444
- C:\Windows\System\ZQIhhlz.exe
  C:\Windows\System\ZQIhhlz.exe
  2⤵
  PID:6464
- C:\Windows\System\jDouMAM.exe
  C:\Windows\System\jDouMAM.exe
  2⤵
  PID:6480
- C:\Windows\System\dNUHZJg.exe
  C:\Windows\System\dNUHZJg.exe
  2⤵
  PID:6496
- C:\Windows\System\guflCHx.exe
  C:\Windows\System\guflCHx.exe
  2⤵
  PID:6512
- C:\Windows\System\LwRkAAu.exe
  C:\Windows\System\LwRkAAu.exe
  2⤵
  PID:6528
- C:\Windows\System\VohKoIe.exe
  C:\Windows\System\VohKoIe.exe
  2⤵
  PID:6544
- C:\Windows\System\gbDZyKy.exe
  C:\Windows\System\gbDZyKy.exe
  2⤵
  PID:6560
- C:\Windows\System\UvVrWtX.exe
  C:\Windows\System\UvVrWtX.exe
  2⤵
  PID:6576
- C:\Windows\System\SXCfoTC.exe
  C:\Windows\System\SXCfoTC.exe
  2⤵
  PID:6592
- C:\Windows\System\TFTUodC.exe
  C:\Windows\System\TFTUodC.exe
  2⤵
  PID:6608
- C:\Windows\System\XlpoDhR.exe
  C:\Windows\System\XlpoDhR.exe
  2⤵
  PID:6624
- C:\Windows\System\iyJpyQU.exe
  C:\Windows\System\iyJpyQU.exe
  2⤵
  PID:6640
- C:\Windows\System\YNvITCv.exe
  C:\Windows\System\YNvITCv.exe
  2⤵
  PID:6656
- C:\Windows\System\pCpbXsh.exe
  C:\Windows\System\pCpbXsh.exe
  2⤵
  PID:6672
- C:\Windows\System\IOXRMgA.exe
  C:\Windows\System\IOXRMgA.exe
  2⤵
  PID:6688
- C:\Windows\System\sMWVEeV.exe
  C:\Windows\System\sMWVEeV.exe
  2⤵
  PID:6704
- C:\Windows\System\JQqCwxU.exe
  C:\Windows\System\JQqCwxU.exe
  2⤵
  PID:6720
- C:\Windows\System\YbTjedZ.exe
  C:\Windows\System\YbTjedZ.exe
  2⤵
  PID:6736
- C:\Windows\System\KiwQGGQ.exe
  C:\Windows\System\KiwQGGQ.exe
  2⤵
  PID:6752
- C:\Windows\System\LmeGtIw.exe
  C:\Windows\System\LmeGtIw.exe
  2⤵
  PID:6768
- C:\Windows\System\GQANTrN.exe
  C:\Windows\System\GQANTrN.exe
  2⤵
  PID:6784
- C:\Windows\System\lPgkJyn.exe
  C:\Windows\System\lPgkJyn.exe
  2⤵
  PID:6800
- C:\Windows\System\aUyEkKe.exe
  C:\Windows\System\aUyEkKe.exe
  2⤵
  PID:6816
- C:\Windows\System\lnpPbsl.exe
  C:\Windows\System\lnpPbsl.exe
  2⤵
  PID:6832
- C:\Windows\System\QRZxKLE.exe
  C:\Windows\System\QRZxKLE.exe
  2⤵
  PID:6956
- C:\Windows\System\GQFRDMN.exe
  C:\Windows\System\GQFRDMN.exe
  2⤵
  PID:6980
- C:\Windows\System\hhYBzNJ.exe
  C:\Windows\System\hhYBzNJ.exe
  2⤵
  PID:6996
- C:\Windows\System\yJqYcjN.exe
  C:\Windows\System\yJqYcjN.exe
  2⤵
  PID:7012
- C:\Windows\System\OwfWXyD.exe
  C:\Windows\System\OwfWXyD.exe
  2⤵
  PID:7032
- C:\Windows\System\SzDbWlY.exe
  C:\Windows\System\SzDbWlY.exe
  2⤵
  PID:7048
- C:\Windows\System\jSzMmyu.exe
  C:\Windows\System\jSzMmyu.exe
  2⤵
  PID:7064
- C:\Windows\System\AFWSEzt.exe
  C:\Windows\System\AFWSEzt.exe
  2⤵
  PID:7080
- C:\Windows\System\nDDRJlp.exe
  C:\Windows\System\nDDRJlp.exe
  2⤵
  PID:7096
- C:\Windows\System\zMRKJur.exe
  C:\Windows\System\zMRKJur.exe
  2⤵
  PID:7112
- C:\Windows\System\lILgUwI.exe
  C:\Windows\System\lILgUwI.exe
  2⤵
  PID:7128
- C:\Windows\System\WwhReIK.exe
  C:\Windows\System\WwhReIK.exe
  2⤵
  PID:7144
- C:\Windows\System\anuVdqf.exe
  C:\Windows\System\anuVdqf.exe
  2⤵
  PID:7160
- C:\Windows\System\sTSwURU.exe
  C:\Windows\System\sTSwURU.exe
  2⤵
  PID:5628
- C:\Windows\System\yXPGpzI.exe
  C:\Windows\System\yXPGpzI.exe
  2⤵
  PID:5224
- C:\Windows\System\BxlmEVU.exe
  C:\Windows\System\BxlmEVU.exe
  2⤵
  PID:6148
- C:\Windows\System\VFKwWUc.exe
  C:\Windows\System\VFKwWUc.exe
  2⤵
  PID:6044
- C:\Windows\System\PJiPwsL.exe
  C:\Windows\System\PJiPwsL.exe
  2⤵
  PID:5892
- C:\Windows\System\qnNUSPN.exe
  C:\Windows\System\qnNUSPN.exe
  2⤵
  PID:5452
- C:\Windows\System\jwBuqsN.exe
  C:\Windows\System\jwBuqsN.exe
  2⤵
  PID:5896
- C:\Windows\System\HEWXwQO.exe
  C:\Windows\System\HEWXwQO.exe
  2⤵
  PID:6164
- C:\Windows\System\gvEJuzH.exe
  C:\Windows\System\gvEJuzH.exe
  2⤵
  PID:6184
- C:\Windows\System\UvzTqfu.exe
  C:\Windows\System\UvzTqfu.exe
  2⤵
  PID:6208
- C:\Windows\System\xvqVCwO.exe
  C:\Windows\System\xvqVCwO.exe
  2⤵
  PID:6216
- C:\Windows\System\OvDArWF.exe
  C:\Windows\System\OvDArWF.exe
  2⤵
  PID:6240
- C:\Windows\System\HNtRizO.exe
  C:\Windows\System\HNtRizO.exe
  2⤵
  PID:6248
- C:\Windows\System\LPDhBcN.exe
  C:\Windows\System\LPDhBcN.exe
  2⤵
  PID:6268
- C:\Windows\System\uTUUwKZ.exe
  C:\Windows\System\uTUUwKZ.exe
  2⤵
  PID:6284
- C:\Windows\System\oKZuPpk.exe
  C:\Windows\System\oKZuPpk.exe
  2⤵
  PID:6300
- C:\Windows\System\FmSwWBL.exe
  C:\Windows\System\FmSwWBL.exe
  2⤵
  PID:6316
- C:\Windows\System\BWIrLvD.exe
  C:\Windows\System\BWIrLvD.exe
  2⤵
  PID:6332
- C:\Windows\System\iXiLIYf.exe
  C:\Windows\System\iXiLIYf.exe
  2⤵
  PID:6356
- C:\Windows\System\zyRrItW.exe
  C:\Windows\System\zyRrItW.exe
  2⤵
  PID:6376
- C:\Windows\System\WkZPmVJ.exe
  C:\Windows\System\WkZPmVJ.exe
  2⤵
  PID:6424
- C:\Windows\System\Bbsgzwu.exe
  C:\Windows\System\Bbsgzwu.exe
  2⤵
  PID:1580
- C:\Windows\System\XfEfjCh.exe
  C:\Windows\System\XfEfjCh.exe
  2⤵
  PID:6488
- C:\Windows\System\UjJrOuY.exe
  C:\Windows\System\UjJrOuY.exe
  2⤵
  PID:6504
- C:\Windows\System\VAZIoqG.exe
  C:\Windows\System\VAZIoqG.exe
  2⤵
  PID:6536
- C:\Windows\System\TOrxpWx.exe
  C:\Windows\System\TOrxpWx.exe
  2⤵
  PID:6572
- C:\Windows\System\qkQTyjh.exe
  C:\Windows\System\qkQTyjh.exe
  2⤵
  PID:6632
- C:\Windows\System\RkScpDc.exe
  C:\Windows\System\RkScpDc.exe
  2⤵
  PID:6652
- C:\Windows\System\LfOfgpb.exe
  C:\Windows\System\LfOfgpb.exe
  2⤵
  PID:6696
- C:\Windows\System\PjCKgHD.exe
  C:\Windows\System\PjCKgHD.exe
  2⤵
  PID:6680
- C:\Windows\System\ECJohiv.exe
  C:\Windows\System\ECJohiv.exe
  2⤵
  PID:6812
- C:\Windows\System\DqKHKgG.exe
  C:\Windows\System\DqKHKgG.exe
  2⤵
  PID:6840
- C:\Windows\System\SLZDDEH.exe
  C:\Windows\System\SLZDDEH.exe
  2⤵
  PID:6824
- C:\Windows\System\bMENJhZ.exe
  C:\Windows\System\bMENJhZ.exe
  2⤵
  PID:6844
- C:\Windows\System\MRljWCH.exe
  C:\Windows\System\MRljWCH.exe
  2⤵
  PID:6868
- C:\Windows\System\fnFKvTS.exe
  C:\Windows\System\fnFKvTS.exe
  2⤵
  PID:6884
- C:\Windows\System\kFVrkQe.exe
  C:\Windows\System\kFVrkQe.exe
  2⤵
  PID:6900
- C:\Windows\System\EmbjHJB.exe
  C:\Windows\System\EmbjHJB.exe
  2⤵
  PID:6916
- C:\Windows\System\HlqgkIN.exe
  C:\Windows\System\HlqgkIN.exe
  2⤵
  PID:6936
- C:\Windows\System\bZTowym.exe
  C:\Windows\System\bZTowym.exe
  2⤵
  PID:6952
- C:\Windows\System\IadqQjO.exe
  C:\Windows\System\IadqQjO.exe
  2⤵
  PID:6992
- C:\Windows\System\syIgVdw.exe
  C:\Windows\System\syIgVdw.exe
  2⤵
  PID:6968
- C:\Windows\System\HKhHXag.exe
  C:\Windows\System\HKhHXag.exe
  2⤵
  PID:7044
- C:\Windows\System\JVOimMm.exe
  C:\Windows\System\JVOimMm.exe
  2⤵
  PID:7108
- C:\Windows\System\JjJBNbV.exe
  C:\Windows\System\JjJBNbV.exe
  2⤵
  PID:6176
- C:\Windows\System\lhABXkP.exe
  C:\Windows\System\lhABXkP.exe
  2⤵
  PID:5608
- C:\Windows\System\HCWyEUZ.exe
  C:\Windows\System\HCWyEUZ.exe
  2⤵
  PID:6232
- C:\Windows\System\SGDRMWW.exe
  C:\Windows\System\SGDRMWW.exe
  2⤵
  PID:6252
- C:\Windows\System\DYUbQoC.exe
  C:\Windows\System\DYUbQoC.exe
  2⤵
  PID:6352
- C:\Windows\System\sLErtIV.exe
  C:\Windows\System\sLErtIV.exe
  2⤵
  PID:6308
- C:\Windows\System\eaaEbqL.exe
  C:\Windows\System\eaaEbqL.exe
  2⤵
  PID:6368
- C:\Windows\System\gNWkmDs.exe
  C:\Windows\System\gNWkmDs.exe
  2⤵
  PID:6292
- C:\Windows\System\yZsuwRh.exe
  C:\Windows\System\yZsuwRh.exe
  2⤵
  PID:6476
- C:\Windows\System\LoNXfPK.exe
  C:\Windows\System\LoNXfPK.exe
  2⤵
  PID:6616
- C:\Windows\System\luOaiWw.exe
  C:\Windows\System\luOaiWw.exe
  2⤵
  PID:6620
- C:\Windows\System\YDIxWQD.exe
  C:\Windows\System\YDIxWQD.exe
  2⤵
  PID:6524
- C:\Windows\System\DyfJLwo.exe
  C:\Windows\System\DyfJLwo.exe
  2⤵
  PID:6748
- C:\Windows\System\UaDLAHP.exe
  C:\Windows\System\UaDLAHP.exe
  2⤵
  PID:6792
- C:\Windows\System\AqAkBeV.exe
  C:\Windows\System\AqAkBeV.exe
  2⤵
  PID:6892
- C:\Windows\System\djklYXO.exe
  C:\Windows\System\djklYXO.exe
  2⤵
  PID:6848
- C:\Windows\System\TpEgpuk.exe
  C:\Windows\System\TpEgpuk.exe
  2⤵
  PID:6924
- C:\Windows\System\JZPdlSx.exe
  C:\Windows\System\JZPdlSx.exe
  2⤵
  PID:6948
- C:\Windows\System\KiHVhmZ.exe
  C:\Windows\System\KiHVhmZ.exe
  2⤵
  PID:6928
- C:\Windows\System\klCTGby.exe
  C:\Windows\System\klCTGby.exe
  2⤵
  PID:7136
- C:\Windows\System\tfLwxja.exe
  C:\Windows\System\tfLwxja.exe
  2⤵
  PID:7076
- C:\Windows\System\CytDKVY.exe
  C:\Windows\System\CytDKVY.exe
  2⤵
  PID:5944
- C:\Windows\System\VqbLiWW.exe
  C:\Windows\System\VqbLiWW.exe
  2⤵
  PID:7060
- C:\Windows\System\BuyiKWZ.exe
  C:\Windows\System\BuyiKWZ.exe
  2⤵
  PID:6152
- C:\Windows\System\udIsQUU.exe
  C:\Windows\System\udIsQUU.exe
  2⤵
  PID:7152
- C:\Windows\System\DSrwHlp.exe
  C:\Windows\System\DSrwHlp.exe
  2⤵
  PID:6408
- C:\Windows\System\GGPKjAI.exe
  C:\Windows\System\GGPKjAI.exe
  2⤵
  PID:6668
- C:\Windows\System\XGSoyUU.exe
  C:\Windows\System\XGSoyUU.exe
  2⤵
  PID:6808
- C:\Windows\System\xiOtByY.exe
  C:\Windows\System\xiOtByY.exe
  2⤵
  PID:6764
- C:\Windows\System\rwLAppO.exe
  C:\Windows\System\rwLAppO.exe
  2⤵
  PID:6972
- C:\Windows\System\XFsuQQp.exe
  C:\Windows\System\XFsuQQp.exe
  2⤵
  PID:7104
- C:\Windows\System\bbamfyO.exe
  C:\Windows\System\bbamfyO.exe
  2⤵
  PID:5368
- C:\Windows\System\FPojOgk.exe
  C:\Windows\System\FPojOgk.exe
  2⤵
  PID:7092
- C:\Windows\System\LVNEJfb.exe
  C:\Windows\System\LVNEJfb.exe
  2⤵
  PID:7024
- C:\Windows\System\dAfQJkn.exe
  C:\Windows\System\dAfQJkn.exe
  2⤵
  PID:7088
- C:\Windows\System\LkjwXWw.exe
  C:\Windows\System\LkjwXWw.exe
  2⤵
  PID:6964
- C:\Windows\System\LUarSVv.exe
  C:\Windows\System\LUarSVv.exe
  2⤵
  PID:6244
- C:\Windows\System\YPzLuUM.exe
  C:\Windows\System\YPzLuUM.exe
  2⤵
  PID:6264
- C:\Windows\System\oEwZyVX.exe
  C:\Windows\System\oEwZyVX.exe
  2⤵
  PID:6196
- C:\Windows\System\CfuKxfX.exe
  C:\Windows\System\CfuKxfX.exe
  2⤵
  PID:6420
- C:\Windows\System\IwLoDPh.exe
  C:\Windows\System\IwLoDPh.exe
  2⤵
  PID:6684
- C:\Windows\System\WUZaLJR.exe
  C:\Windows\System\WUZaLJR.exe
  2⤵
  PID:6712
- C:\Windows\System\jsfrMpw.exe
  C:\Windows\System\jsfrMpw.exe
  2⤵
  PID:6456
- C:\Windows\System\fYnzeIN.exe
  C:\Windows\System\fYnzeIN.exe
  2⤵
  PID:6328
- C:\Windows\System\EPHwYGh.exe
  C:\Windows\System\EPHwYGh.exe
  2⤵
  PID:7184
- C:\Windows\System\umOSkgT.exe
  C:\Windows\System\umOSkgT.exe
  2⤵
  PID:7256
- C:\Windows\System\guJRmvZ.exe
  C:\Windows\System\guJRmvZ.exe
  2⤵
  PID:7276
- C:\Windows\System\lIQyWpA.exe
  C:\Windows\System\lIQyWpA.exe
  2⤵
  PID:7296
- C:\Windows\System\YDCdCsa.exe
  C:\Windows\System\YDCdCsa.exe
  2⤵
  PID:7316
- C:\Windows\System\trJZQlM.exe
  C:\Windows\System\trJZQlM.exe
  2⤵
  PID:7336
- C:\Windows\System\cGQTkHv.exe
  C:\Windows\System\cGQTkHv.exe
  2⤵
  PID:7352
- C:\Windows\System\fRlcnDl.exe
  C:\Windows\System\fRlcnDl.exe
  2⤵
  PID:7368
- C:\Windows\System\HAuLkkO.exe
  C:\Windows\System\HAuLkkO.exe
  2⤵
  PID:7384
- C:\Windows\System\PZzvAHL.exe
  C:\Windows\System\PZzvAHL.exe
  2⤵
  PID:7400
- C:\Windows\System\tIAFmjz.exe
  C:\Windows\System\tIAFmjz.exe
  2⤵
  PID:7428
- C:\Windows\System\OBpRvrB.exe
  C:\Windows\System\OBpRvrB.exe
  2⤵
  PID:7468
- C:\Windows\System\SFKTvBf.exe
  C:\Windows\System\SFKTvBf.exe
  2⤵
  PID:7484
- C:\Windows\System\hzhflSn.exe
  C:\Windows\System\hzhflSn.exe
  2⤵
  PID:7500
- C:\Windows\System\rfeVHQr.exe
  C:\Windows\System\rfeVHQr.exe
  2⤵
  PID:7516
- C:\Windows\System\nCkBTBS.exe
  C:\Windows\System\nCkBTBS.exe
  2⤵
  PID:7532
- C:\Windows\System\ztiYCYy.exe
  C:\Windows\System\ztiYCYy.exe
  2⤵
  PID:7548
- C:\Windows\System\dsAoYlV.exe
  C:\Windows\System\dsAoYlV.exe
  2⤵
  PID:7564
- C:\Windows\System\TpaGMzE.exe
  C:\Windows\System\TpaGMzE.exe
  2⤵
  PID:7580
- C:\Windows\System\AFDiqcu.exe
  C:\Windows\System\AFDiqcu.exe
  2⤵
  PID:7596
- C:\Windows\System\zjAkwPS.exe
  C:\Windows\System\zjAkwPS.exe
  2⤵
  PID:7612
- C:\Windows\System\CalxVwl.exe
  C:\Windows\System\CalxVwl.exe
  2⤵
  PID:7628
- C:\Windows\System\ppBKtQw.exe
  C:\Windows\System\ppBKtQw.exe
  2⤵
  PID:7644
- C:\Windows\System\zotWohn.exe
  C:\Windows\System\zotWohn.exe
  2⤵
  PID:7660
- C:\Windows\System\Figyceb.exe
  C:\Windows\System\Figyceb.exe
  2⤵
  PID:7676
- C:\Windows\System\zHsUNcQ.exe
  C:\Windows\System\zHsUNcQ.exe
  2⤵
  PID:7700
- C:\Windows\System\pxYPLPd.exe
  C:\Windows\System\pxYPLPd.exe
  2⤵
  PID:7720
- C:\Windows\System\KnuccDt.exe
  C:\Windows\System\KnuccDt.exe
  2⤵
  PID:7740
- C:\Windows\System\eitVYoN.exe
  C:\Windows\System\eitVYoN.exe
  2⤵
  PID:7784
- C:\Windows\System\gXKpYdu.exe
  C:\Windows\System\gXKpYdu.exe
  2⤵
  PID:7804
- C:\Windows\System\fueUKSp.exe
  C:\Windows\System\fueUKSp.exe
  2⤵
  PID:7824
- C:\Windows\System\EmzyzJP.exe
  C:\Windows\System\EmzyzJP.exe
  2⤵
  PID:7840
- C:\Windows\System\fDjTVzS.exe
  C:\Windows\System\fDjTVzS.exe
  2⤵
  PID:7856
- C:\Windows\System\anNPLaZ.exe
  C:\Windows\System\anNPLaZ.exe
  2⤵
  PID:7872
- C:\Windows\System\sAXEtbR.exe
  C:\Windows\System\sAXEtbR.exe
  2⤵
  PID:7888
- C:\Windows\System\etMxLqR.exe
  C:\Windows\System\etMxLqR.exe
  2⤵
  PID:7904
- C:\Windows\System\pgeWNhR.exe
  C:\Windows\System\pgeWNhR.exe
  2⤵
  PID:7920
- C:\Windows\System\EFnFkMB.exe
  C:\Windows\System\EFnFkMB.exe
  2⤵
  PID:7936
- C:\Windows\System\KiqsBFJ.exe
  C:\Windows\System\KiqsBFJ.exe
  2⤵
  PID:7952
- C:\Windows\System\ksAnHfi.exe
  C:\Windows\System\ksAnHfi.exe
  2⤵
  PID:7968
- C:\Windows\System\ZioPOeW.exe
  C:\Windows\System\ZioPOeW.exe
  2⤵
  PID:7984
- C:\Windows\System\ySZxmOl.exe
  C:\Windows\System\ySZxmOl.exe
  2⤵
  PID:8004
- C:\Windows\System\DgDBXhj.exe
  C:\Windows\System\DgDBXhj.exe
  2⤵
  PID:8024
- C:\Windows\System\AOSxLtF.exe
  C:\Windows\System\AOSxLtF.exe
  2⤵
  PID:8048
- C:\Windows\System\PJvUeHw.exe
  C:\Windows\System\PJvUeHw.exe
  2⤵
  PID:8064
- C:\Windows\System\uQFXJYY.exe
  C:\Windows\System\uQFXJYY.exe
  2⤵
  PID:8080
- C:\Windows\System\EfdpNRu.exe
  C:\Windows\System\EfdpNRu.exe
  2⤵
  PID:8100
- C:\Windows\System\gxUSrul.exe
  C:\Windows\System\gxUSrul.exe
  2⤵
  PID:8116
- C:\Windows\System\lVQVmfy.exe
  C:\Windows\System\lVQVmfy.exe
  2⤵
  PID:8136
- C:\Windows\System\bilXYOr.exe
  C:\Windows\System\bilXYOr.exe
  2⤵
  PID:8160
- C:\Windows\System\pcoApXI.exe
  C:\Windows\System\pcoApXI.exe
  2⤵
  PID:8180
- C:\Windows\System\AKEcFKW.exe
  C:\Windows\System\AKEcFKW.exe
  2⤵
  PID:6636
- C:\Windows\System\bxJcaHH.exe
  C:\Windows\System\bxJcaHH.exe
  2⤵
  PID:7180
- C:\Windows\System\eRXmZPc.exe
  C:\Windows\System\eRXmZPc.exe
  2⤵
  PID:7244
- C:\Windows\System\vJvoSnI.exe
  C:\Windows\System\vJvoSnI.exe
  2⤵
  PID:7212
- C:\Windows\System\fSAEuiN.exe
  C:\Windows\System\fSAEuiN.exe
  2⤵
  PID:7228
- C:\Windows\System\UsmBCiV.exe
  C:\Windows\System\UsmBCiV.exe
  2⤵
  PID:7252
- C:\Windows\System\fRYFool.exe
  C:\Windows\System\fRYFool.exe
  2⤵
  PID:7324
- C:\Windows\System\aGfxmdH.exe
  C:\Windows\System\aGfxmdH.exe
  2⤵
  PID:7344
- C:\Windows\System\USnJvKC.exe
  C:\Windows\System\USnJvKC.exe
  2⤵
  PID:7436
- C:\Windows\System\HmkJyDg.exe
  C:\Windows\System\HmkJyDg.exe
  2⤵
  PID:7408
- C:\Windows\System\TouEhOh.exe
  C:\Windows\System\TouEhOh.exe
  2⤵
  PID:7376
- C:\Windows\System\jndLulE.exe
  C:\Windows\System\jndLulE.exe
  2⤵
  PID:7480
- C:\Windows\System\XRfIttr.exe
  C:\Windows\System\XRfIttr.exe
  2⤵
  PID:7544
- C:\Windows\System\yLpQVhf.exe
  C:\Windows\System\yLpQVhf.exe
  2⤵
  PID:7608
- C:\Windows\System\enDWZhE.exe
  C:\Windows\System\enDWZhE.exe
  2⤵
  PID:7528
- C:\Windows\System\zAHUqWt.exe
  C:\Windows\System\zAHUqWt.exe
  2⤵
  PID:7592
- C:\Windows\System\zlLYMxy.exe
  C:\Windows\System\zlLYMxy.exe
  2⤵
  PID:7640
- C:\Windows\System\ekEgged.exe
  C:\Windows\System\ekEgged.exe
  2⤵
  PID:7728
- C:\Windows\System\iivHxsK.exe
  C:\Windows\System\iivHxsK.exe
  2⤵
  PID:7476
- C:\Windows\System\nQWKxoh.exe
  C:\Windows\System\nQWKxoh.exe
  2⤵
  PID:7688
- C:\Windows\System\NAGKnwu.exe
  C:\Windows\System\NAGKnwu.exe
  2⤵
  PID:7760
- C:\Windows\System\mkzmWlX.exe
  C:\Windows\System\mkzmWlX.exe
  2⤵
  PID:7772
- C:\Windows\System\QwvyubG.exe
  C:\Windows\System\QwvyubG.exe
  2⤵
  PID:7796
- C:\Windows\System\fQFIgZr.exe
  C:\Windows\System\fQFIgZr.exe
  2⤵
  PID:7868
- C:\Windows\System\lzxLVQR.exe
  C:\Windows\System\lzxLVQR.exe
  2⤵
  PID:7816
- C:\Windows\System\hltGNBM.exe
  C:\Windows\System\hltGNBM.exe
  2⤵
  PID:7852
- C:\Windows\System\gKzZgbO.exe
  C:\Windows\System\gKzZgbO.exe
  2⤵
  PID:7916
- C:\Windows\System\bvebUuw.exe
  C:\Windows\System\bvebUuw.exe
  2⤵
  PID:7928
- C:\Windows\System\EnLkqym.exe
  C:\Windows\System\EnLkqym.exe
  2⤵
  PID:8000
- C:\Windows\System\VOyadFE.exe
  C:\Windows\System\VOyadFE.exe
  2⤵
  PID:7980
- C:\Windows\System\YWtiSvh.exe
  C:\Windows\System\YWtiSvh.exe
  2⤵
  PID:8060
- C:\Windows\System\IgtMhQD.exe
  C:\Windows\System\IgtMhQD.exe
  2⤵
  PID:8124
- C:\Windows\System\TbXGacB.exe
  C:\Windows\System\TbXGacB.exe
  2⤵
  PID:8172
- C:\Windows\System\eEyZpNf.exe
  C:\Windows\System\eEyZpNf.exe
  2⤵
  PID:7996
- C:\Windows\System\DuFFlUs.exe
  C:\Windows\System\DuFFlUs.exe
  2⤵
  PID:8144
- C:\Windows\System\PTJlnVm.exe
  C:\Windows\System\PTJlnVm.exe
  2⤵
  PID:8112
- C:\Windows\System\VeAlfRQ.exe
  C:\Windows\System\VeAlfRQ.exe
  2⤵
  PID:8188
- C:\Windows\System\FIgsZiC.exe
  C:\Windows\System\FIgsZiC.exe
  2⤵
  PID:6004
- C:\Windows\System\oLTftDD.exe
  C:\Windows\System\oLTftDD.exe
  2⤵
  PID:5304
- C:\Windows\System\MNxMtHT.exe
  C:\Windows\System\MNxMtHT.exe
  2⤵
  PID:7272
- C:\Windows\System\fYbjrky.exe
  C:\Windows\System\fYbjrky.exe
  2⤵
  PID:7200
- C:\Windows\System\MIMtblU.exe
  C:\Windows\System\MIMtblU.exe
  2⤵
  PID:7288
- C:\Windows\System\wzHTKNr.exe
  C:\Windows\System\wzHTKNr.exe
  2⤵
  PID:7220
- C:\Windows\System\YlzBGWw.exe
  C:\Windows\System\YlzBGWw.exe
  2⤵
  PID:7416
- C:\Windows\System\ttUAEFz.exe
  C:\Windows\System\ttUAEFz.exe
  2⤵
  PID:7636
- C:\Windows\System\TfPFtnj.exe
  C:\Windows\System\TfPFtnj.exe
  2⤵
  PID:7732
- C:\Windows\System\gAkpgUe.exe
  C:\Windows\System\gAkpgUe.exe
  2⤵
  PID:7900
- C:\Windows\System\RCtqhjN.exe
  C:\Windows\System\RCtqhjN.exe
  2⤵
  PID:7960
- C:\Windows\System\SKVNwte.exe
  C:\Windows\System\SKVNwte.exe
  2⤵
  PID:7560
- C:\Windows\System\nfdfFWO.exe
  C:\Windows\System\nfdfFWO.exe
  2⤵
  PID:7716
- C:\Windows\System\rHAtvzD.exe
  C:\Windows\System\rHAtvzD.exe
  2⤵
  PID:7768
- C:\Windows\System\UidCOkI.exe
  C:\Windows\System\UidCOkI.exe
  2⤵
  PID:6392
- C:\Windows\System\QoAILCf.exe
  C:\Windows\System\QoAILCf.exe
  2⤵
  PID:7992
- C:\Windows\System\wzhfkCZ.exe
  C:\Windows\System\wzhfkCZ.exe
  2⤵
  PID:6324
- C:\Windows\System\UDOtSuu.exe
  C:\Windows\System\UDOtSuu.exe
  2⤵
  PID:7176
- C:\Windows\System\CyRiXfV.exe
  C:\Windows\System\CyRiXfV.exe
  2⤵
  PID:7292
- C:\Windows\System\esKWxcK.exe
  C:\Windows\System\esKWxcK.exe
  2⤵
  PID:7236
- C:\Windows\System\dGNlsMN.exe
  C:\Windows\System\dGNlsMN.exe
  2⤵
  PID:7396
- C:\Windows\System\xscyxvB.exe
  C:\Windows\System\xscyxvB.exe
  2⤵
  PID:7964
- C:\Windows\System\RCMNUTy.exe
  C:\Windows\System\RCMNUTy.exe
  2⤵
  PID:7684
- C:\Windows\System\hNNKDCX.exe
  C:\Windows\System\hNNKDCX.exe
  2⤵
  PID:7204
- C:\Windows\System\hdaJAsr.exe
  C:\Windows\System\hdaJAsr.exe
  2⤵
  PID:7248
- C:\Windows\System\IkacKOw.exe
  C:\Windows\System\IkacKOw.exe
  2⤵
  PID:8156
- C:\Windows\System\JwaEddb.exe
  C:\Windows\System\JwaEddb.exe
  2⤵
  PID:7464
- C:\Windows\System\kETtgCc.exe
  C:\Windows\System\kETtgCc.exe
  2⤵
  PID:7492
- C:\Windows\System\bgotBdu.exe
  C:\Windows\System\bgotBdu.exe
  2⤵
  PID:7780
- C:\Windows\System\AUuMDzS.exe
  C:\Windows\System\AUuMDzS.exe
  2⤵
  PID:7268
- C:\Windows\System\oMrbcay.exe
  C:\Windows\System\oMrbcay.exe
  2⤵
  PID:8092
- C:\Windows\System\gdCSREb.exe
  C:\Windows\System\gdCSREb.exe
  2⤵
  PID:7392
- C:\Windows\System\AfSIsoh.exe
  C:\Windows\System\AfSIsoh.exe
  2⤵
  PID:7312
- C:\Windows\System\gYLltya.exe
  C:\Windows\System\gYLltya.exe
  2⤵
  PID:7776
- C:\Windows\System\nUFXqcr.exe
  C:\Windows\System\nUFXqcr.exe
  2⤵
  PID:7308
- C:\Windows\System\RxkIXWv.exe
  C:\Windows\System\RxkIXWv.exe
  2⤵
  PID:8200
- C:\Windows\System\DIilJec.exe
  C:\Windows\System\DIilJec.exe
  2⤵
  PID:8216
- C:\Windows\System\zisirnQ.exe
  C:\Windows\System\zisirnQ.exe
  2⤵
  PID:8236
- C:\Windows\System\WVTuuyi.exe
  C:\Windows\System\WVTuuyi.exe
  2⤵
  PID:8252
- C:\Windows\System\EKxbTgl.exe
  C:\Windows\System\EKxbTgl.exe
  2⤵
  PID:8268
- C:\Windows\System\HzPrTqu.exe
  C:\Windows\System\HzPrTqu.exe
  2⤵
  PID:8284
- C:\Windows\System\oROLWYO.exe
  C:\Windows\System\oROLWYO.exe
  2⤵
  PID:8304
- C:\Windows\System\DqkgFvl.exe
  C:\Windows\System\DqkgFvl.exe
  2⤵
  PID:8320
- C:\Windows\System\lVyFHYC.exe
  C:\Windows\System\lVyFHYC.exe
  2⤵
  PID:8336
- C:\Windows\System\pNdyACw.exe
  C:\Windows\System\pNdyACw.exe
  2⤵
  PID:8352
- C:\Windows\System\CcqlrTv.exe
  C:\Windows\System\CcqlrTv.exe
  2⤵
  PID:8368
- C:\Windows\System\NYFYKlh.exe
  C:\Windows\System\NYFYKlh.exe
  2⤵
  PID:8388
- C:\Windows\System\ZEZvCMm.exe
  C:\Windows\System\ZEZvCMm.exe
  2⤵
  PID:8404
- C:\Windows\System\ZiAVtPD.exe
  C:\Windows\System\ZiAVtPD.exe
  2⤵
  PID:8420
- C:\Windows\System\GrSTHaV.exe
  C:\Windows\System\GrSTHaV.exe
  2⤵
  PID:8436
- C:\Windows\System\GNlBOPH.exe
  C:\Windows\System\GNlBOPH.exe
  2⤵
  PID:8452
- C:\Windows\System\nPBQrWc.exe
  C:\Windows\System\nPBQrWc.exe
  2⤵
  PID:8496
- C:\Windows\System\GydBTYF.exe
  C:\Windows\System\GydBTYF.exe
  2⤵
  PID:8532
- C:\Windows\System\TwyMgRV.exe
  C:\Windows\System\TwyMgRV.exe
  2⤵
  PID:8548
- C:\Windows\System\xdXEpsj.exe
  C:\Windows\System\xdXEpsj.exe
  2⤵
  PID:8564
- C:\Windows\System\nJNIUim.exe
  C:\Windows\System\nJNIUim.exe
  2⤵
  PID:8580
- C:\Windows\System\pqKbqqk.exe
  C:\Windows\System\pqKbqqk.exe
  2⤵
  PID:8596
- C:\Windows\System\wVslEcS.exe
  C:\Windows\System\wVslEcS.exe
  2⤵
  PID:8612
- C:\Windows\System\LYKTJru.exe
  C:\Windows\System\LYKTJru.exe
  2⤵
  PID:8628
- C:\Windows\System\ckkBEBC.exe
  C:\Windows\System\ckkBEBC.exe
  2⤵
  PID:8644
- C:\Windows\System\HyGghKs.exe
  C:\Windows\System\HyGghKs.exe
  2⤵
  PID:8660
- C:\Windows\System\eoyZhQG.exe
  C:\Windows\System\eoyZhQG.exe
  2⤵
  PID:8676
- C:\Windows\System\IXZZGDd.exe
  C:\Windows\System\IXZZGDd.exe
  2⤵
  PID:8692
- C:\Windows\System\ZeOaxlJ.exe
  C:\Windows\System\ZeOaxlJ.exe
  2⤵
  PID:8708
- C:\Windows\System\EoAfHxu.exe
  C:\Windows\System\EoAfHxu.exe
  2⤵
  PID:8724
- C:\Windows\System\NULTTMK.exe
  C:\Windows\System\NULTTMK.exe
  2⤵
  PID:8740
- C:\Windows\System\tWXGGdR.exe
  C:\Windows\System\tWXGGdR.exe
  2⤵
  PID:8756
- C:\Windows\System\gIUNbmg.exe
  C:\Windows\System\gIUNbmg.exe
  2⤵
  PID:8772
- C:\Windows\System\uiOvBFE.exe
  C:\Windows\System\uiOvBFE.exe
  2⤵
  PID:8788
- C:\Windows\System\DfQhBpn.exe
  C:\Windows\System\DfQhBpn.exe
  2⤵
  PID:8804
- C:\Windows\System\FqbywPC.exe
  C:\Windows\System\FqbywPC.exe
  2⤵
  PID:8820
- C:\Windows\System\yNjILIb.exe
  C:\Windows\System\yNjILIb.exe
  2⤵
  PID:8836
- C:\Windows\System\VeMemUx.exe
  C:\Windows\System\VeMemUx.exe
  2⤵
  PID:8852
- C:\Windows\System\YeWVcgY.exe
  C:\Windows\System\YeWVcgY.exe
  2⤵
  PID:8868
- C:\Windows\System\wpglrmF.exe
  C:\Windows\System\wpglrmF.exe
  2⤵
  PID:8884
- C:\Windows\System\NaRUeBV.exe
  C:\Windows\System\NaRUeBV.exe
  2⤵
  PID:8900
- C:\Windows\System\vvHZPqn.exe
  C:\Windows\System\vvHZPqn.exe
  2⤵
  PID:8916
- C:\Windows\System\EsNNgnf.exe
  C:\Windows\System\EsNNgnf.exe
  2⤵
  PID:8932
- C:\Windows\System\GLbUtcR.exe
  C:\Windows\System\GLbUtcR.exe
  2⤵
  PID:8948
- C:\Windows\System\ityTtzr.exe
  C:\Windows\System\ityTtzr.exe
  2⤵
  PID:8964
- C:\Windows\System\OaSCISF.exe
  C:\Windows\System\OaSCISF.exe
  2⤵
  PID:8980
- C:\Windows\System\qkurUIX.exe
  C:\Windows\System\qkurUIX.exe
  2⤵
  PID:8996
- C:\Windows\System\iZJnCsA.exe
  C:\Windows\System\iZJnCsA.exe
  2⤵
  PID:9012
- C:\Windows\System\cleMAwe.exe
  C:\Windows\System\cleMAwe.exe
  2⤵
  PID:9028
- C:\Windows\System\UHtbVcG.exe
  C:\Windows\System\UHtbVcG.exe
  2⤵
  PID:9044
- C:\Windows\System\oAWAtnY.exe
  C:\Windows\System\oAWAtnY.exe
  2⤵
  PID:9060
- C:\Windows\System\FMHXkdY.exe
  C:\Windows\System\FMHXkdY.exe
  2⤵
  PID:9080
- C:\Windows\System\ZxsvPZF.exe
  C:\Windows\System\ZxsvPZF.exe
  2⤵
  PID:9116
- C:\Windows\System\jVxwjCG.exe
  C:\Windows\System\jVxwjCG.exe
  2⤵
  PID:9132
- C:\Windows\System\yjkiDYV.exe
  C:\Windows\System\yjkiDYV.exe
  2⤵
  PID:9148
- C:\Windows\System\yguSwtb.exe
  C:\Windows\System\yguSwtb.exe
  2⤵
  PID:9164
- C:\Windows\System\fYGmIcP.exe
  C:\Windows\System\fYGmIcP.exe
  2⤵
  PID:9184
- C:\Windows\System\owtBDNK.exe
  C:\Windows\System\owtBDNK.exe
  2⤵
  PID:9200
- C:\Windows\System\hythGUz.exe
  C:\Windows\System\hythGUz.exe
  2⤵
  PID:8208
- C:\Windows\System\FhfKgeX.exe
  C:\Windows\System\FhfKgeX.exe
  2⤵
  PID:8276
- C:\Windows\System\loPRSls.exe
  C:\Windows\System\loPRSls.exe
  2⤵
  PID:7208
- C:\Windows\System\rcuRvev.exe
  C:\Windows\System\rcuRvev.exe
  2⤵
  PID:8312
- C:\Windows\System\SgxSFPD.exe
  C:\Windows\System\SgxSFPD.exe
  2⤵
  PID:7948
- C:\Windows\System\sLxeJiH.exe
  C:\Windows\System\sLxeJiH.exe
  2⤵
  PID:8260
- C:\Windows\System\dZNaXCH.exe
  C:\Windows\System\dZNaXCH.exe
  2⤵
  PID:7444
- C:\Windows\System\VafxqYY.exe
  C:\Windows\System\VafxqYY.exe
  2⤵
  PID:7792
- C:\Windows\System\eaJTLhc.exe
  C:\Windows\System\eaJTLhc.exe
  2⤵
  PID:8384
- C:\Windows\System\AaaAuXX.exe
  C:\Windows\System\AaaAuXX.exe
  2⤵
  PID:8196
- C:\Windows\System\vVtkEiH.exe
  C:\Windows\System\vVtkEiH.exe
  2⤵
  PID:8264
- C:\Windows\System\rRaeOrE.exe
  C:\Windows\System\rRaeOrE.exe
  2⤵
  PID:8296
- C:\Windows\System\yrWNWOw.exe
  C:\Windows\System\yrWNWOw.exe
  2⤵
  PID:8428
- C:\Windows\System\AiHCPDO.exe
  C:\Windows\System\AiHCPDO.exe
  2⤵
  PID:8448
- C:\Windows\System\OMUuTZV.exe
  C:\Windows\System\OMUuTZV.exe
  2⤵
  PID:8468
- C:\Windows\System\FnHBkVz.exe
  C:\Windows\System\FnHBkVz.exe
  2⤵
  PID:8488
- C:\Windows\System\tEIaGvT.exe
  C:\Windows\System\tEIaGvT.exe
  2⤵
  PID:8556
- C:\Windows\System\WzEWxLz.exe
  C:\Windows\System\WzEWxLz.exe
  2⤵
  PID:8588
- C:\Windows\System\ZluUlaq.exe
  C:\Windows\System\ZluUlaq.exe
  2⤵
  PID:8652
- C:\Windows\System\TDGoJJc.exe
  C:\Windows\System\TDGoJJc.exe
  2⤵
  PID:8576
- C:\Windows\System\ByLRHPg.exe
  C:\Windows\System\ByLRHPg.exe
  2⤵
  PID:8668
- C:\Windows\System\jmOgXLL.exe
  C:\Windows\System\jmOgXLL.exe
  2⤵
  PID:8704
- C:\Windows\System\kFVRjgF.exe
  C:\Windows\System\kFVRjgF.exe
  2⤵
  PID:8716
- C:\Windows\System\nEBPndm.exe
  C:\Windows\System\nEBPndm.exe
  2⤵
  PID:8780
- C:\Windows\System\QYQaRHx.exe
  C:\Windows\System\QYQaRHx.exe
  2⤵
  PID:8844
- C:\Windows\System\bnHUEqg.exe
  C:\Windows\System\bnHUEqg.exe
  2⤵
  PID:8908
- C:\Windows\System\bYxGloS.exe
  C:\Windows\System\bYxGloS.exe
  2⤵
  PID:8976
- C:\Windows\System\BVbIbsu.exe
  C:\Windows\System\BVbIbsu.exe
  2⤵
  PID:9008
- C:\Windows\System\sIaSQrL.exe
  C:\Windows\System\sIaSQrL.exe
  2⤵
  PID:8828
- C:\Windows\System\mgNDoRK.exe
  C:\Windows\System\mgNDoRK.exe
  2⤵
  PID:8960
- C:\Windows\System\NUpUeeI.exe
  C:\Windows\System\NUpUeeI.exe
  2⤵
  PID:9068
- C:\Windows\System\AgModGi.exe
  C:\Windows\System\AgModGi.exe
  2⤵
  PID:9176
- C:\Windows\System\VpOwaaV.exe
  C:\Windows\System\VpOwaaV.exe
  2⤵
  PID:9092
- C:\Windows\System\wiZDidr.exe
  C:\Windows\System\wiZDidr.exe
  2⤵
  PID:9108
- C:\Windows\System\NiyMqfz.exe
  C:\Windows\System\NiyMqfz.exe
  2⤵
  PID:9172
- C:\Windows\System\LTooKaq.exe
  C:\Windows\System\LTooKaq.exe
  2⤵
  PID:9208
- C:\Windows\System\oeNVNYN.exe
  C:\Windows\System\oeNVNYN.exe
  2⤵
  PID:7576
- C:\Windows\System\bfAGDOz.exe
  C:\Windows\System\bfAGDOz.exe
  2⤵
  PID:7512
- C:\Windows\System\QShzscI.exe
  C:\Windows\System\QShzscI.exe
  2⤵
  PID:7440
- C:\Windows\System\alVrysg.exe
  C:\Windows\System\alVrysg.exe
  2⤵
  PID:8328
- C:\Windows\System\CRKuJts.exe
  C:\Windows\System\CRKuJts.exe
  2⤵
  PID:8432
- C:\Windows\System\UWcyTJi.exe
  C:\Windows\System\UWcyTJi.exe
  2⤵
  PID:8528
- C:\Windows\System\lusWCRP.exe
  C:\Windows\System\lusWCRP.exe
  2⤵
  PID:8672
- C:\Windows\System\HDYfjZi.exe
  C:\Windows\System\HDYfjZi.exe
  2⤵
  PID:8880
- C:\Windows\System\NECzTwC.exe
  C:\Windows\System\NECzTwC.exe
  2⤵
  PID:7848
- C:\Windows\System\rguGVDW.exe
  C:\Windows\System\rguGVDW.exe
  2⤵
  PID:8228
- C:\Windows\System\bwmDYOO.exe
  C:\Windows\System\bwmDYOO.exe
  2⤵
  PID:8508
- C:\Windows\System\gbChwkk.exe
  C:\Windows\System\gbChwkk.exe
  2⤵
  PID:8540
- C:\Windows\System\tohkhge.exe
  C:\Windows\System\tohkhge.exe
  2⤵
  PID:8624
- C:\Windows\System\ewOyEoZ.exe
  C:\Windows\System\ewOyEoZ.exe
  2⤵
  PID:8764
- C:\Windows\System\FCqnHCH.exe
  C:\Windows\System\FCqnHCH.exe
  2⤵
  PID:8736
- C:\Windows\System\XBTUwOQ.exe
  C:\Windows\System\XBTUwOQ.exe
  2⤵
  PID:8768
- C:\Windows\System\yWUmWNA.exe
  C:\Windows\System\yWUmWNA.exe
  2⤵
  PID:8380
- C:\Windows\System\DobbJvW.exe
  C:\Windows\System\DobbJvW.exe
  2⤵
  PID:9160
- C:\Windows\System\wFKFcpo.exe
  C:\Windows\System\wFKFcpo.exe
  2⤵
  PID:8924
- C:\Windows\System\cVvXByv.exe
  C:\Windows\System\cVvXByv.exe
  2⤵
  PID:9192
- C:\Windows\System\thIeTwa.exe
  C:\Windows\System\thIeTwa.exe
  2⤵
  PID:9104
- C:\Windows\System\odFaFzk.exe
  C:\Windows\System\odFaFzk.exe
  2⤵
  PID:8108
- C:\Windows\System\FSNWebj.exe
  C:\Windows\System\FSNWebj.exe
  2⤵
  PID:8484
- C:\Windows\System\Mzfjfpj.exe
  C:\Windows\System\Mzfjfpj.exe
  2⤵
  PID:8360
- C:\Windows\System\evNaLxG.exe
  C:\Windows\System\evNaLxG.exe
  2⤵
  PID:8732
- C:\Windows\System\EAoxPIS.exe
  C:\Windows\System\EAoxPIS.exe
  2⤵
  PID:9156
- C:\Windows\System\NXBbtJV.exe
  C:\Windows\System\NXBbtJV.exe
  2⤵
  PID:8244
- C:\Windows\System\uJAuIIB.exe
  C:\Windows\System\uJAuIIB.exe
  2⤵
  PID:8896
- C:\Windows\System\WCLvSOO.exe
  C:\Windows\System\WCLvSOO.exe
  2⤵
  PID:9224
- C:\Windows\System\gZbdkji.exe
  C:\Windows\System\gZbdkji.exe
  2⤵
  PID:9240
- C:\Windows\System\ZlSqbwp.exe
  C:\Windows\System\ZlSqbwp.exe
  2⤵
  PID:9256
- C:\Windows\System\pELrvNr.exe
  C:\Windows\System\pELrvNr.exe
  2⤵
  PID:9272
- C:\Windows\System\mktEEKQ.exe
  C:\Windows\System\mktEEKQ.exe
  2⤵
  PID:9288
- C:\Windows\System\WWXDvaA.exe
  C:\Windows\System\WWXDvaA.exe
  2⤵
  PID:9304
- C:\Windows\System\wZKMtec.exe
  C:\Windows\System\wZKMtec.exe
  2⤵
  PID:9320
- C:\Windows\System\bypsPQQ.exe
  C:\Windows\System\bypsPQQ.exe
  2⤵
  PID:9336
- C:\Windows\System\wCHkYsX.exe
  C:\Windows\System\wCHkYsX.exe
  2⤵
  PID:9352
- C:\Windows\System\JpFXwJe.exe
  C:\Windows\System\JpFXwJe.exe
  2⤵
  PID:9368
- C:\Windows\System\mYgmNKJ.exe
  C:\Windows\System\mYgmNKJ.exe
  2⤵
  PID:9384
- C:\Windows\System\ytEBuUL.exe
  C:\Windows\System\ytEBuUL.exe
  2⤵
  PID:9400
- C:\Windows\System\qiGRZWG.exe
  C:\Windows\System\qiGRZWG.exe
  2⤵
  PID:9416
- C:\Windows\System\uprWVOu.exe
  C:\Windows\System\uprWVOu.exe
  2⤵
  PID:9436
- C:\Windows\System\uSPjBup.exe
  C:\Windows\System\uSPjBup.exe
  2⤵
  PID:9452
- C:\Windows\System\OWkdDLa.exe
  C:\Windows\System\OWkdDLa.exe
  2⤵
  PID:9468
- C:\Windows\System\XTXDCAw.exe
  C:\Windows\System\XTXDCAw.exe
  2⤵
  PID:9484
- C:\Windows\System\eljIhyj.exe
  C:\Windows\System\eljIhyj.exe
  2⤵
  PID:9500
- C:\Windows\System\OeOMOTO.exe
  C:\Windows\System\OeOMOTO.exe
  2⤵
  PID:9516
- C:\Windows\System\MDLDGQk.exe
  C:\Windows\System\MDLDGQk.exe
  2⤵
  PID:9532
- C:\Windows\System\CKeayfg.exe
  C:\Windows\System\CKeayfg.exe
  2⤵
  PID:9548
- C:\Windows\System\lDlovmY.exe
  C:\Windows\System\lDlovmY.exe
  2⤵
  PID:9564
- C:\Windows\System\wKNiUro.exe
  C:\Windows\System\wKNiUro.exe
  2⤵
  PID:9580
- C:\Windows\System\qzKSvFX.exe
  C:\Windows\System\qzKSvFX.exe
  2⤵
  PID:9596
- C:\Windows\System\dLLsHOH.exe
  C:\Windows\System\dLLsHOH.exe
  2⤵
  PID:9612
- C:\Windows\System\wSwIUhI.exe
  C:\Windows\System\wSwIUhI.exe
  2⤵
  PID:9628
- C:\Windows\System\fDHehxy.exe
  C:\Windows\System\fDHehxy.exe
  2⤵
  PID:9644
- C:\Windows\System\YmnFqTO.exe
  C:\Windows\System\YmnFqTO.exe
  2⤵
  PID:9660
- C:\Windows\System\eMZIsCs.exe
  C:\Windows\System\eMZIsCs.exe
  2⤵
  PID:9676
- C:\Windows\System\TVXxCBZ.exe
  C:\Windows\System\TVXxCBZ.exe
  2⤵
  PID:9692
- C:\Windows\System\BaqzqZR.exe
  C:\Windows\System\BaqzqZR.exe
  2⤵
  PID:9708
- C:\Windows\System\Dvwikkb.exe
  C:\Windows\System\Dvwikkb.exe
  2⤵
  PID:9724
- C:\Windows\System\zYfHVsL.exe
  C:\Windows\System\zYfHVsL.exe
  2⤵
  PID:9740
- C:\Windows\System\njdGHIr.exe
  C:\Windows\System\njdGHIr.exe
  2⤵
  PID:9756
- C:\Windows\System\XecAOEo.exe
  C:\Windows\System\XecAOEo.exe
  2⤵
  PID:9772
- C:\Windows\System\JcVWrvD.exe
  C:\Windows\System\JcVWrvD.exe
  2⤵
  PID:9788
- C:\Windows\System\AcuIGPE.exe
  C:\Windows\System\AcuIGPE.exe
  2⤵
  PID:9804
- C:\Windows\System\WhvYDRZ.exe
  C:\Windows\System\WhvYDRZ.exe
  2⤵
  PID:9820
- C:\Windows\System\PfTFWby.exe
  C:\Windows\System\PfTFWby.exe
  2⤵
  PID:9836
- C:\Windows\System\vhzIqyc.exe
  C:\Windows\System\vhzIqyc.exe
  2⤵
  PID:9852
- C:\Windows\System\cZDqrHo.exe
  C:\Windows\System\cZDqrHo.exe
  2⤵
  PID:9868
- C:\Windows\System\ndlGrjr.exe
  C:\Windows\System\ndlGrjr.exe
  2⤵
  PID:9884
- C:\Windows\System\pzopEZD.exe
  C:\Windows\System\pzopEZD.exe
  2⤵
  PID:9900
- C:\Windows\System\QzZQWrk.exe
  C:\Windows\System\QzZQWrk.exe
  2⤵
  PID:9916
- C:\Windows\System\nrgmmOw.exe
  C:\Windows\System\nrgmmOw.exe
  2⤵
  PID:9932
- C:\Windows\System\AZiNSTn.exe
  C:\Windows\System\AZiNSTn.exe
  2⤵
  PID:9948
- C:\Windows\System\VNXxIwV.exe
  C:\Windows\System\VNXxIwV.exe
  2⤵
  PID:9964
- C:\Windows\System\RcoCBdS.exe
  C:\Windows\System\RcoCBdS.exe
  2⤵
  PID:9980
- C:\Windows\System\YiKzslq.exe
  C:\Windows\System\YiKzslq.exe
  2⤵
  PID:9996
- C:\Windows\System\mvtrsxO.exe
  C:\Windows\System\mvtrsxO.exe
  2⤵
  PID:10012
- C:\Windows\System\NDZtUtQ.exe
  C:\Windows\System\NDZtUtQ.exe
  2⤵
  PID:10028
- C:\Windows\System\MaFTKDU.exe
  C:\Windows\System\MaFTKDU.exe
  2⤵
  PID:10044
- C:\Windows\System\zcJXmgq.exe
  C:\Windows\System\zcJXmgq.exe
  2⤵
  PID:10060
- C:\Windows\System\JIAQOuc.exe
  C:\Windows\System\JIAQOuc.exe
  2⤵
  PID:10076
- C:\Windows\System\UsqmKaM.exe
  C:\Windows\System\UsqmKaM.exe
  2⤵
  PID:10092
- C:\Windows\System\NAExksM.exe
  C:\Windows\System\NAExksM.exe
  2⤵
  PID:10108
- C:\Windows\System\dJbEpyJ.exe
  C:\Windows\System\dJbEpyJ.exe
  2⤵
  PID:10124
- C:\Windows\System\LIMQIzL.exe
  C:\Windows\System\LIMQIzL.exe
  2⤵
  PID:10140
- C:\Windows\System\OHUrDbW.exe
  C:\Windows\System\OHUrDbW.exe
  2⤵
  PID:10156
- C:\Windows\System\dHGpYIf.exe
  C:\Windows\System\dHGpYIf.exe
  2⤵
  PID:10172
- C:\Windows\System\arDrLFz.exe
  C:\Windows\System\arDrLFz.exe
  2⤵
  PID:10188
- C:\Windows\System\rShqBiG.exe
  C:\Windows\System\rShqBiG.exe
  2⤵
  PID:10204
- C:\Windows\System\TpUsooF.exe
  C:\Windows\System\TpUsooF.exe
  2⤵
  PID:10220
- C:\Windows\System\delNwWg.exe
  C:\Windows\System\delNwWg.exe
  2⤵
  PID:9232
- C:\Windows\System\xdCPDQy.exe
  C:\Windows\System\xdCPDQy.exe
  2⤵
  PID:9268
- C:\Windows\System\fofLOcm.exe
  C:\Windows\System\fofLOcm.exe
  2⤵
  PID:9328
- C:\Windows\System\luLBPaL.exe
  C:\Windows\System\luLBPaL.exe
  2⤵
  PID:9392
- C:\Windows\System\qvrMksd.exe
  C:\Windows\System\qvrMksd.exe
  2⤵
  PID:9460
- C:\Windows\System\SQGFrsR.exe
  C:\Windows\System\SQGFrsR.exe
  2⤵
  PID:8944
- C:\Windows\System\ivLRpEY.exe
  C:\Windows\System\ivLRpEY.exe
  2⤵
  PID:8972
- C:\Windows\System\XjnSXov.exe
  C:\Windows\System\XjnSXov.exe
  2⤵
  PID:9020
- C:\Windows\System\feWgfql.exe
  C:\Windows\System\feWgfql.exe
  2⤵
  PID:9588
- C:\Windows\System\VkQJmcI.exe
  C:\Windows\System\VkQJmcI.exe
  2⤵
  PID:9592
- C:\Windows\System\hrUJOEX.exe
  C:\Windows\System\hrUJOEX.exe
  2⤵
  PID:9624
- C:\Windows\System\rggCcVw.exe
  C:\Windows\System\rggCcVw.exe
  2⤵
  PID:8524
- C:\Windows\System\gRnArqV.exe
  C:\Windows\System\gRnArqV.exe
  2⤵
  PID:7756
- C:\Windows\System\uJnzzxw.exe
  C:\Windows\System\uJnzzxw.exe
  2⤵
  PID:7884
- C:\Windows\System\RWLXtDv.exe
  C:\Windows\System\RWLXtDv.exe
  2⤵
  PID:8796
- C:\Windows\System\hiabjDw.exe
  C:\Windows\System\hiabjDw.exe
  2⤵
  PID:8348
- C:\Windows\System\BRnrljm.exe
  C:\Windows\System\BRnrljm.exe
  2⤵
  PID:8956
- C:\Windows\System\NluEUxb.exe
  C:\Windows\System\NluEUxb.exe
  2⤵
  PID:9316
- C:\Windows\System\uOelatN.exe
  C:\Windows\System\uOelatN.exe
  2⤵
  PID:9652
- C:\Windows\System\poLVbzj.exe
  C:\Windows\System\poLVbzj.exe
  2⤵
  PID:9444
- C:\Windows\System\odAJcwy.exe
  C:\Windows\System\odAJcwy.exe
  2⤵
  PID:9508
- C:\Windows\System\TzAvgSj.exe
  C:\Windows\System\TzAvgSj.exe
  2⤵
  PID:9604
- C:\Windows\System\TmryiHw.exe
  C:\Windows\System\TmryiHw.exe
  2⤵
  PID:9668
- C:\Windows\System\XSpnGWl.exe
  C:\Windows\System\XSpnGWl.exe
  2⤵
  PID:9720
- C:\Windows\System\GaxyJDo.exe
  C:\Windows\System\GaxyJDo.exe
  2⤵
  PID:9672
- C:\Windows\System\JJRxmqX.exe
  C:\Windows\System\JJRxmqX.exe
  2⤵
  PID:9736
- C:\Windows\System\QFlcBpN.exe
  C:\Windows\System\QFlcBpN.exe
  2⤵
  PID:9800
- C:\Windows\System\BDjIwRG.exe
  C:\Windows\System\BDjIwRG.exe
  2⤵
  PID:9844
- C:\Windows\System\TiEdpSE.exe
  C:\Windows\System\TiEdpSE.exe
  2⤵
  PID:9880
- C:\Windows\System\ZkHVPSt.exe
  C:\Windows\System\ZkHVPSt.exe
  2⤵
  PID:9864
- C:\Windows\System\wrqdbcB.exe
  C:\Windows\System\wrqdbcB.exe
  2⤵
  PID:9972
- C:\Windows\System\cXfVrDo.exe
  C:\Windows\System\cXfVrDo.exe
  2⤵
  PID:10036
- C:\Windows\System\auruOlt.exe
  C:\Windows\System\auruOlt.exe
  2⤵
  PID:10072
- C:\Windows\System\szkicin.exe
  C:\Windows\System\szkicin.exe
  2⤵
  PID:9988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CqXHcmH.exe

Filesize
1.5MB

MD5
680d29919dac45d59933e996fa7edb46

SHA1
219503fc47ae3ec03300a204db0a8df4a7cf21f2

SHA256
b8e8c1673f83cb328c7c8f69f7e3c6e7ed32670ba189f3e42acd9a3ab0e9623b

SHA512
a9363785134ddad510b805e255e1a2089e238248c51d7e8b6ae853c60a8d71e080106d3976887cbb5c938b8f796b2508c806d46bd1565564c4ce7d2c3613a6eb

Download Submit
C:\Windows\system\EetsWwT.exe

Filesize
1.5MB

MD5
f84a2a2eecdafdd23f83ed154a98a7f1

SHA1
87187e5c43f9601297c23f11ddc45fd1196f1825

SHA256
1e5ec06b598a8a8dc81c658de892c4732c9a0614e1e1ed2c6e729196015c7b34

SHA512
8d336c1a7b4c4cd4353370cdb0242989c5545a9c46353b247e951bc9789f7b2276f1ee6b607dea7a765b4c09b269f74d39af1eee81d9b514940af93b605fd5f3

Download Submit
C:\Windows\system\IKrdBHF.exe

Filesize
1.5MB

MD5
6373144fcd119566462aa71032ce59ec

SHA1
97e988f67da5644029a24bb0a8a4637ba4d37d0e

SHA256
359d3762576ccf78eeac550587d91eb7de6f4b2c3b67b63ba18bc3baa477bcea

SHA512
3b8e043fb6df56a5fd50ac9ba03d3bece07114372c429d13b3e4fca5680f598a190cc2443e99ad31fa4c8aa37d66f35a872c4c01c88620a8d6be46fad9a31f16

Download Submit
C:\Windows\system\KyojcTG.exe

Filesize
1.5MB

MD5
759e062bde7c7073554378922f34a77a

SHA1
57dd41261b6bd5195ac47a0caa2aa29ce07377b7

SHA256
a1ad3624d315e0a372243d35589b08c1bc0bb30af75d468d46af703d4c73f040

SHA512
f095be5201598be58a4adaf969188872f365bf7a831099d0952cd46917e68b4f2876786ecfdcc31557097375557678fd3cd76d7a67bd90797b5ddb415a9d6c0a

Download Submit
C:\Windows\system\LboWyIQ.exe

Filesize
1.5MB

MD5
887662ef0884ed561b5237ba5585c120

SHA1
dad0da435f6ec1fd907f23c42efcf9a9e0b0f209

SHA256
b44f30767b4efba8591d3354416033888d406dd9f445a02df3c845a0a9e0899f

SHA512
4dbebd6499b1f381bccc4ecf7237f2959d2310bc7cde9a0cf3f73132821da52452edc291d4547c961eae4a1ca136005797f5580d6d74caa3e71ff82721de7597

Download Submit
C:\Windows\system\OtNsctP.exe

Filesize
1.5MB

MD5
ad8d90f039f52271d6a0f4e49c6e8a6b

SHA1
bea7594594fb044d41a5031344a845e920472e57

SHA256
ea0439142494d70f0cec97df606c3f85a7d972d8ca22b99476a8dea61d4a9879

SHA512
608cfd021ae2d088002e0d02599c79db656a68250547b3a63a72546a7f9f100a3557f368d225f58ec68231470ebd5e0f2d3d04a5fd8ce4f25ee92b3e100e5629

Download Submit
C:\Windows\system\SDbuaOL.exe

Filesize
1.5MB

MD5
5a93b32426dacac4d924805bb66725ef

SHA1
1c01057ce86d5823549310815be80cd5d9bdd17d

SHA256
366bb0f94aff4ae597b61c57af03611bf69ca54f5a2f0b5944b32b661e2ee2fd

SHA512
a0ea09725eea7972c7f871b21a28fae58884710f12d699133f266d3d4a761ed191b3efb01ed4ebe41a69e5378e661a25cb816f134169f7233170c9b10dac9181

Download Submit
C:\Windows\system\ToYFTCm.exe

Filesize
1.5MB

MD5
2b90375a4fb3fa1020eebbdec6fcd721

SHA1
1ed7916f2bb102cb330479f9bbdb710575cca683

SHA256
95764a97f18872db5e91e1314ce41de12cb6d06ec397c1a1ef79f8d0324db123

SHA512
9ab7dd3ef954be80c84f482d5bfe8955633215d95f37ac99361168876692bb3268edd39a5e8bde2bc23907543e0712d2aaf320f9a111f1c5022a3de55e708e9f

Download Submit
C:\Windows\system\UWGKuEh.exe

Filesize
1.5MB

MD5
68d62b762d465b3c4e17310421cf4dec

SHA1
6581eecdd685d5076e57d3933f6904aeab1578f5

SHA256
087423ce6d2d40e157b40e5056b9eae0f8e13546e56eedc5d7fe1f2b7cbbf75c

SHA512
4024137c2459d5517e8f254b62902d101f744d9f14aef748ea6d0f47044a301928984ed7a545e7a6d04c2100584ea56ea6b3a4ef2ded2a508cc44c10a52d7bf9

Download Submit
C:\Windows\system\VYrxhnM.exe

Filesize
1.5MB

MD5
c877d4223aadfa178b04267403e49f04

SHA1
7556fad1d93c45bb4aef703a5e73648734f28ae4

SHA256
f2758126387f883810d98a4a95bbbed2510e4ae8f9cda4d02c17702557e46a13

SHA512
e8d701af687c941777b9c903f5beee608a7052b340d3a9d59c3421516ebe4669f2c9977c6d8c539d43a3365e32360c63160e6dcbe43810e5b0937d9cdae689df

Download Submit
C:\Windows\system\VmkCqGs.exe

Filesize
1.5MB

MD5
c45e97c437399c0744d565ac63dde013

SHA1
fd312210bbe572b86f3c8e2296ceb857eec14388

SHA256
ccacf95e6bbf649749e82deecd543fba70aaeb322d7c0ca2b5d494eb8318dca6

SHA512
192aa1958a93e698008ef91591ab2fb450f3142f19a4db4dcc10590aaaf5dd5383d15628dae127d4b14763bf9eb4f0939a34758e50f122e7413e4b69cb8181a0

Download Submit
C:\Windows\system\XqeZAHM.exe

Filesize
1.5MB

MD5
66316ce6850c560b42b0c6f401ef87f0

SHA1
0cbd4222fdb52b972eccf33f9b1f7f08c174d3c1

SHA256
2da544e503dfb51c3d1fe6461e3500b51f745dca053a3ae34e240c00c48b0f81

SHA512
28da780c7bbaf92952836bc5bbc7fa3a1b1ee00b643393c1122facb2af4d25c10e78b4cd373d73583902a7002c0bea64a6b758648bee7c54a219453cad499411

Download Submit
C:\Windows\system\YHWjnOv.exe

Filesize
1.5MB

MD5
bcf67c15ab33fb1a6d673f43be4dfbaf

SHA1
f8d3c706f9c08e27b9c4b8c1557910df6ea91425

SHA256
b8d9dbd6788835098e9e53f9c7f2db23a1faba5ff19ed9c9da3ec707673292c7

SHA512
a1f3e2a4495dec998d02b9d932157d069dfbf34fa463fc8962467709ad322e75472f098e1f4127061bfea8d2cc61759452b422f55aecbee057b59300ed2f377e

Download Submit
C:\Windows\system\YMPgxZB.exe

Filesize
1.5MB

MD5
ad1940cd3ff2a1dba06fc4fb293afac9

SHA1
1d3a5188c3a574673a6c74276ed44129f5843ab9

SHA256
6c9e9c099aab4c531d704d39ff3539c4f03dfcea9bb9f64823f8d0db50cf39b8

SHA512
d25d78608867708791f0761f25bdc14ddf8373dec0ae64ad196d67e4fb572172971f22c9f1bed1031a2016b4399ddb56f56f2df054921766144633e064fa067d

Download Submit
C:\Windows\system\aAZFCVV.exe

Filesize
1.5MB

MD5
74071da1742af6bc68bf6241838ae519

SHA1
fb66875f4db7843c4873a525e09e1368b1bf306f

SHA256
9c02eafd6037c0f39367ca5a63b4d5df6c4cd8c231f183c8b15788277110fd65

SHA512
d1c578ccaa39ec70c80e51e97cefdc24c2696ff07751f8a4387e61bc721d3b60dd86ff78a5ffeefbafc58039ebd0f58025ff9b3b1c9fb9a3bbefaf20662e7b7a

Download Submit
C:\Windows\system\boaZdTa.exe

Filesize
1.5MB

MD5
b23554eca29d5a65737200052d862a48

SHA1
7c215aa6cc1999ebe2cac31f107b69b4fb4b8f25

SHA256
fd74258c7f5ac3ddd15bd3513fd1e1bc019c18397c3fbc78aa031f31958fc8cc

SHA512
10a9892120f7afe0ca99d4960378f2f52a3e235b047b32bb77850405859db8d65678d5655fe1ba7e865a8786ccd651549d2dfdf2a8f96d86182caf36baf99b75

Download Submit
C:\Windows\system\buFzGri.exe

Filesize
1.5MB

MD5
d5503b5ba2aa4d4d4105a3eb195d8c94

SHA1
96da4e9aa9ddcdaefc1d80c2e41f11f7fb2a16dd

SHA256
146f2101356057444dd135cc73d8c4f7e05dfb0b0ab9f6d0c34b5a0914311b5b

SHA512
63176f8a820c3dc9590a8cec0834b907bc34a3ba0bd372a4b54c357fd99b5d799df6f92ea20a68d3fc9a6c38391330dccd1553078bdcedf35cf860ea683c94aa

Download Submit
C:\Windows\system\fUfMzMB.exe

Filesize
1.5MB

MD5
105e7b1e69610a75c441c24f0031f88b

SHA1
d042092f422c796e0d7dc78825b9fc286099e14c

SHA256
15bcfb20bbc4bb11af071352caec7125aa722984773fd34841abe8e41d15b310

SHA512
37063f9a27549815c25073e72bdeeebeffdd867cde5d30f3e4ffdfa1365a077b2fb059ae30f8c00602f105483dd1e750d8a10fc7eddf1e7556686086b4d58db8

Download Submit
C:\Windows\system\fvgXoRM.exe

Filesize
1.5MB

MD5
6d8d6d052fe5dd90500274598f530eba

SHA1
bd8d9a787fa41607bf8adcbff5b7ce4329a888db

SHA256
a17f5ca0403b9d6b6638c9d7c21a54b22b94062b87c7e277960d47ba0e248e4b

SHA512
195a2fa8b2ddb52578daf289ee3f1f59761eff15718e7872dddcca0105008372ec451ced667a9b96ad01fbd03fa308851f5f78fd7ec5297735386ba2fae8791b

Download Submit
C:\Windows\system\kQhBlBq.exe

Filesize
1.5MB

MD5
bc5e77708f7a2e82ea374fd45dfca256

SHA1
8f4d5afaac7fa89e1adcd2f01c44c5c9e66adb36

SHA256
c8ee861f476519ade7f89af6c82741052a41fe3af2d9d41d8570507469edf84c

SHA512
289d1ad38fa7adbf9b9431e24264ceb06a06cee4330d1602104159240b0d3dcc00dc29ef6ea62986df102fba732c7d74710dbef012564a2b1e166e72e8e2eab5

Download Submit
C:\Windows\system\mApwTnd.exe

Filesize
1.5MB

MD5
98b3f5d1556d1cdb7381b4413415b8b7

SHA1
a0c54d9d137df137a584866727fefb4cd4f6b797

SHA256
f21dab3aeb4f56cecdbd36a91e42386600e68aaac056367d23fdfcdb7dbb4937

SHA512
5d47811ef5d514e502a7ff865b1fa50b3ad1293bb4cde34496cde2267a7e51f2a002f67377ba4721e6c9fba1c760ddd7020356976d8a63719dd790f517d5de8e

Download Submit
C:\Windows\system\oJipwrw.exe

Filesize
1.5MB

MD5
91e59cac210fe01753b7ed6bba2c3de5

SHA1
9cd2661391127ad8a3c5f88e3a53402cdae88523

SHA256
661c8b8c360cf6dc12b7b86a9f1433dfc6c744cf477cd45ed4f02b7fdfb9c0cf

SHA512
f14828953bd5331c1c0973afd7efd42852419ff60819919029ff9670edcaa8f04ca42cb621a0be197090d7f228c1ebd11b65e60d907bc42623011d095a152b2f

Download Submit
C:\Windows\system\rDJLEQB.exe

Filesize
1.5MB

MD5
28a19ea2cea56d8d0ec47c6326861abd

SHA1
0bf43a5a47000f27cacae71b6602cc013b323c62

SHA256
7002209a0dd7696edaf021ab60c1f636f82df38f40bac06fc4557adf76f66ae6

SHA512
82aa5bc827fd9d5818b7e7c081262222efd610ead572fb781705f08e082addc2257782f7b874c20897e5bf56d009b0fc855e33370b24faa2c89209fa6487cb94

Download Submit
C:\Windows\system\sLJWoIS.exe

Filesize
1.5MB

MD5
a423d32e79e8e665b1ba064aa01139fa

SHA1
89a2d3be3bf914c5947a15942bf4f15592430f80

SHA256
a8b45cfb9f2f1e06f812a9583b84e892d6ecad30888c7b73da7ab6322f026a9a

SHA512
32314210275908aa4b16d99f5ce438eee1f7bc10684f904c216d8fd00fdb342f45bbd6b765f447da596e6e1cb1185dc6de1ac22f7a8bb2d9eca7fd6e8e6d56f8

Download Submit
C:\Windows\system\vMMSxEr.exe

Filesize
1.5MB

MD5
864722b6158b41e4a6f348dfcc7558b8

SHA1
94eb1915ccf892bed487165acccdabbeeefe56cf

SHA256
d4c2bebbdeaef06b838acae1bfc344a33c1d78cd726f9ea54b43575f3158ef83

SHA512
21ad8332a8aa33e534d8f4f6980a2d3273dd383f0cbe5e2ed489a4ace40a292ce076ce91c8b9e9573133150eef3b9a795f9ce219e8016f39203b8e798f86fdfb

Download Submit
C:\Windows\system\yUPiFCM.exe

Filesize
1.5MB

MD5
cc55e0aa0985c4cf37379a23a30cf8b9

SHA1
1e8ed46b50dbd27bd508d50122f90c509d3aef1e

SHA256
ec9253924c0378412184d3425e1d7b6a4778f0407fddaffbcb570748e0357f23

SHA512
4d98276bf68884f0e411cad0f481a871a5a5dda5f1d94f2296bd6f433f0d2356e4e2f7a908e6635991c80652ed21bfdaf679781ea81d0290a34e2da222339636

Download Submit
\Windows\system\EDrttoR.exe

Filesize
1.5MB

MD5
c252da6ac5d4e2140913b77be66a2d98

SHA1
852ab022bf34cb51cf25c92ca0c38e5479a387f6

SHA256
8854fb477e1d9468000d369d09f76bd5d56362c368c947a9d78e321827d624ec

SHA512
4a6fa6f9a40d94fd027f84a3337f7b93449802171f5691fcaab0ef8b15048669c78bf49c65a374d77a67918512de608e80e6d0419ebf4f2d952a758195dbec0c

Download Submit
\Windows\system\HEAwhkz.exe

Filesize
1.5MB

MD5
2f3a5f568f6765a833b777fa241f0caa

SHA1
7b9fa5442076373443c04610b1f1a3510f03d441

SHA256
0bba13bd0ebcf1a7b018d34e08e5bd6dd882f4f1cfa52431cd04ada1046bf69d

SHA512
4c80b947bc9faad400865a4a198b0a1ae6fda5b62ede2bd97c60a286dab44b81318162a8c9e96dd1e2e5d2c6c7b553f64addb4d22c6db788b41ad31d36e2ecf2

Download Submit
\Windows\system\HaXSXwN.exe

Filesize
1.5MB

MD5
e4b2a81ae3f794ef1143a3ef6a07037b

SHA1
a94f74ce433c5c3f0a320f1e71898cdf460e5569

SHA256
789e3b14a253a2dc0385c5c09a7b4e2fd9b6146181af9080ff23fcadb3888474

SHA512
e60ba37e13fc4ac764fbae2720452a8174f5186b92392147d40435b52ffa17896dddab69f1bfe7a3699dc189504ae68e110fc72c62a86d47ef3a5aa0a1d647be

Download Submit
\Windows\system\LphQXTN.exe

Filesize
1.5MB

MD5
6c1aa0f7a154415621c786eeac441405

SHA1
5f43984fc80d10bb07b6fd4b8f69cf0dd526b028

SHA256
4ba7a23eed09970b9434c46f6aa08c05011d77ffb16d527a66fa7c8eed65ddf1

SHA512
d026182cb08b22f6011154e984a0dd545f0899421efcee22799858fcfe90dffb4c0b14873e50ae24af938c3be3620e6aa6d962672c0ec3e7933923ee5c6cd4e2

Download Submit
\Windows\system\MBaAVVy.exe

Filesize
1.5MB

MD5
e417dbeb27a70e97d3ecc4f9360ca52c

SHA1
501477ab02d2462a9159b4b6025de3ea05a6098e

SHA256
8c9258b1844f73cf74c2d28fbfd73cf7c0f671fd1c07c8791234837ba5203c38

SHA512
f860bf2853a42d7d5eb3eb5e50de3cd74d855f87724addb3774e50d89f0afbec8e2e6393dc6c3e50feb51f31959941ff30543493b660654ebdb8f8a7c74b173c

Download Submit
\Windows\system\YCuciRV.exe

Filesize
1.5MB

MD5
bc7cd3fec9ce51d8043e6a98637e2526

SHA1
bf8c3dfc1ca9b79b4667af6d17a55e8eb95e70c5

SHA256
9cd196fb24aed704faa4c792f2f5fb25131dd08c60ee10fac4c661ce85770938

SHA512
bd50062b0de2f8610cd42d355391a4fc77eb32d7d9e7a3b044cb55e496fec9ba29e920eef9e38c1af85535e1778bc9dfed777f3410175ed7b0549fbdb5173e70

Download Submit
\Windows\system\hnvkCqE.exe

Filesize
1.5MB

MD5
30c06ceb5289f96291737682a56a5632

SHA1
870868b873f452c5a47338219aba9bec48150e86

SHA256
2203e93b2ed22fd19f28bfb14683a3664659001841bc58a3850bd4a55cc3b772

SHA512
af00a6825ada0ab008482cd1e5d9f37ecab090e6f6680eafd9af8610f52b6635831a6a24bb559055ff2377aff2bc798c4c2a6cfabd89c2d22e66a5ceb053e195

Download Submit
\Windows\system\jxgOSVS.exe

Filesize
1.5MB

MD5
002b8f58870043d2c5539887c872c648

SHA1
417a6bf16cb8078225a55eb7f149ccc4aa06af49

SHA256
77a03724850983793dcb06ca11e4ed2c5e30799a553e2611a9852ecc7ffd5092

SHA512
7ef244ef25ce96dc643a7573d1edc0a12e2d599674e4a9cf70a2ad01f1ea0d805874fb59f83fe527ffc36a182c4008e2227f043370fa3ccf0ed2340d494e0c0f

Download Submit
\Windows\system\oxoMNEQ.exe

Filesize
1.5MB

MD5
4a5ff3f184113e6ff6a755b9253e031f

SHA1
3b22a322b3a2c799e2b7b2f903ee3074bee5d043

SHA256
1f4204b2056e4b278aab6bad4253843267d8e81e3d8fe575778ff2af02aabe7e

SHA512
a36b5d7606d1c8e97fb14f99e98f24704f0e77318cf21ec68ff3fdf47cb4e9161be3a3f88925578a483b46d837df947d504873c2144a9c28fff09188a67bcfdf

Download Submit
\Windows\system\qhmZdAo.exe

Filesize
1.5MB

MD5
17b0efc0e17b1a2d045a3ed344b7b17e

SHA1
f04993c24eba446cc472a1a0089bb32f016229fe

SHA256
0a8643ddcdd83e5c333c8ab8f1c13d31f4db50d67f50c062ab0da7acdc3ecb86

SHA512
49110c3193e41f4863e865dd8dc3635b726a4cac3f60359adae2375312ac7519e506207ab0b72996a9ba33e4f5f507a8f7397fa463ba40e4e518edb2f1cefe6f

Download Submit
\Windows\system\uUheNVa.exe

Filesize
1.5MB

MD5
71bb3e944295bd16f3547eee230d0f2a

SHA1
2ac034cd3ff597cf0bbad86b4b630d29f5e41194

SHA256
d9028e4efc77899496d126e1919201e3014b0d5225baa9755027f32bacfea881

SHA512
3e7c38ee76276a0374954b0c806ba9ae3b345a153a0d73b39fec65c5fa16232e805d6d61cbeff405e4e16dc9135b8373ec293fc73bfd4086e02ab3f7f6a69617

Download Submit
memory/396-1-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/396-115-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/396-111-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/396-0-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/396-109-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/396-7-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/396-107-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/396-119-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/396-103-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/396-7657-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/396-105-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/396-117-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/396-113-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/396-123-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/396-121-0x0000000002EB0000-0x00000000032A2000-memory.dmp

Filesize
3.9MB

Download
memory/564-124-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/564-6231-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/808-6086-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/808-116-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/864-8-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/864-6587-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1316-6588-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1316-110-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1932-106-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1932-6089-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-6085-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2288-112-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2376-104-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2376-101-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2376-102-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2376-17-0x000007FEF621E000-0x000007FEF621F000-memory.dmp

Filesize
4KB

Download
memory/2376-100-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download
memory/2376-473-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2516-4847-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-118-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-120-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2596-6165-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2776-6115-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2776-114-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2780-108-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-6716-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-125-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-6261-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-6091-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-122-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download