xmrig | c552d0a3b2404624b98d8fbaff57cc0992504f0fc85af3902e4a41b2bcbaea73

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
Size

3.0MB
MD5

28e78c37c1a70aa3d7099ccf3c99bbb0
SHA1

168414ab76e99983ed4fba5de1c755a3e4ba4c02
SHA256

c552d0a3b2404624b98d8fbaff57cc0992504f0fc85af3902e4a41b2bcbaea73
SHA512

42d377f7aeb3ab0340ad234e6c15a6b72519eb3a55e2fa2306d0eae7aaf1e538e988874494989fb67ee8f1d943b2be65ca10edcf150f893c2d4da6877c7bd8d1
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mi1:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/memory/2348-0-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	xmrig
behavioral1/files/0x000f000000012272-3.dat	xmrig
behavioral1/memory/2392-8-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/files/0x0032000000014415-11.dat	xmrig
behavioral1/files/0x00080000000145c7-18.dat	xmrig
behavioral1/files/0x000f000000003683-27.dat	xmrig
behavioral1/files/0x0032000000014508-34.dat	xmrig
behavioral1/files/0x0008000000014733-41.dat	xmrig
behavioral1/files/0x000700000001473e-46.dat	xmrig
behavioral1/files/0x0007000000015caf-53.dat	xmrig
behavioral1/files/0x0007000000014856-48.dat	xmrig
behavioral1/files/0x0006000000015cbf-66.dat	xmrig
behavioral1/files/0x0006000000015cd6-71.dat	xmrig
behavioral1/files/0x0006000000015cf3-85.dat	xmrig
behavioral1/files/0x0006000000015d20-103.dat	xmrig
behavioral1/files/0x0006000000015d72-114.dat	xmrig
behavioral1/files/0x0006000000015cfd-89.dat	xmrig
behavioral1/files/0x0006000000015d13-98.dat	xmrig
behavioral1/files/0x0006000000015d97-124.dat	xmrig
behavioral1/files/0x0006000000016133-148.dat	xmrig
behavioral1/files/0x0006000000016824-174.dat	xmrig
behavioral1/memory/2532-1156-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	xmrig
behavioral1/memory/2348-1298-0x0000000003A30000-0x0000000003E26000-memory.dmp	xmrig
behavioral1/memory/2688-1281-0x000000013FB90000-0x000000013FF86000-memory.dmp	xmrig
behavioral1/files/0x0006000000016572-164.dat	xmrig
behavioral1/files/0x00060000000165d4-167.dat	xmrig
behavioral1/files/0x0006000000016448-158.dat	xmrig
behavioral1/files/0x00060000000162cc-153.dat	xmrig
behavioral1/files/0x00060000000160f3-143.dat	xmrig
behavioral1/files/0x0006000000015fd4-138.dat	xmrig
behavioral1/files/0x0006000000015f54-134.dat	xmrig
behavioral1/files/0x0006000000015d42-120.dat	xmrig
behavioral1/files/0x0006000000015de5-127.dat	xmrig
behavioral1/files/0x0006000000015cea-82.dat	xmrig
behavioral1/files/0x0006000000015d09-96.dat	xmrig
behavioral1/files/0x0006000000015ce2-76.dat	xmrig
behavioral1/files/0x0006000000015cb7-61.dat	xmrig
behavioral1/memory/2728-31-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/2424-1353-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/memory/2348-1412-0x000000013FC90000-0x0000000140086000-memory.dmp	xmrig
behavioral1/memory/2544-1409-0x000000013F360000-0x000000013F756000-memory.dmp	xmrig
behavioral1/memory/2960-1444-0x000000013FC90000-0x0000000140086000-memory.dmp	xmrig
behavioral1/memory/2348-1468-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig
behavioral1/memory/2700-1458-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/1700-2034-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig
behavioral1/memory/2348-2040-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2588-2339-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2728-4279-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/2392-4281-0x000000013F080000-0x000000013F476000-memory.dmp	xmrig
behavioral1/memory/2532-4282-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	xmrig
behavioral1/memory/2688-4283-0x000000013FB90000-0x000000013FF86000-memory.dmp	xmrig
behavioral1/memory/2728-4284-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	xmrig
behavioral1/memory/2544-4285-0x000000013F360000-0x000000013F756000-memory.dmp	xmrig
behavioral1/memory/2700-4286-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/memory/2424-4289-0x000000013F780000-0x000000013FB76000-memory.dmp	xmrig
behavioral1/memory/2588-4288-0x000000013FDE0000-0x00000001401D6000-memory.dmp	xmrig
behavioral1/memory/2960-4287-0x000000013FC90000-0x0000000140086000-memory.dmp	xmrig
behavioral1/memory/1700-4290-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2392	juzeays.exe
2728	wxejRlO.exe
2532	ziHkRGJ.exe
2688	eVPBxNE.exe
2424	gbXjRmi.exe
2544	PNBxSga.exe
2960	NgYzOTM.exe
2700	UaaBjPy.exe
1700	jTEgSCT.exe
2588	NFDNpqi.exe
2812	ELKPOXX.exe
2848	vYDBJVK.exe
2972	RQCsILX.exe
1824	xIPbTCp.exe
1896	OGnSaAh.exe
2328	eBPLGxy.exe
2000	FDCglbO.exe
1820	HcrIhfA.exe
2004	IkWepEf.exe
1200	RfjToOM.exe
2176	DNmEjZF.exe
1636	fiWYRSV.exe
1764	ESSKXPj.exe
2080	SlwDYNm.exe
2508	ZJDLqND.exe
1732	jpQPFPo.exe
2900	xNBSkyx.exe
2292	iEoXQpy.exe
780	SMYEkCj.exe
1032	VhOULHA.exe
612	iMpvFfE.exe
1912	pBslRKu.exe
1804	yrnBTJu.exe
1592	pAfvSUq.exe
2380	XtcVDjO.exe
1084	MwuinyK.exe
1776	uxerjUx.exe
404	AbqhCkW.exe
1852	zDUBzIg.exe
1324	YXxbmfh.exe
2368	PdxUKBJ.exe
1548	iSOQPwz.exe
1860	udTeGUR.exe
2988	SYvWdiv.exe
1620	iiecJLf.exe
1156	hSRjIZQ.exe
904	QTUDMJh.exe
2864	fIIUbVq.exe
2136	nSOGrKc.exe
652	xHaPZrX.exe
1720	SXxlRHe.exe
896	qwqnBoR.exe
2444	sfeLlsp.exe
1284	SqzdGMT.exe
1608	smrtQQt.exe
1796	chzKxqN.exe
3064	EmlEHTf.exe
2468	QVMvjXb.exe
3028	aLpSjWt.exe
2800	rBpYwoJ.exe
2748	OWXuQQx.exe
2524	cgXnbiX.exe
2536	tpxNFFT.exe
3040	gErDKyo.exe

Loads dropped DLL 64 IoCs

pid	Process
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-0-0x000000013F2C0000-0x000000013F6B6000-memory.dmp	upx
behavioral1/files/0x000f000000012272-3.dat	upx
behavioral1/memory/2392-8-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/files/0x0032000000014415-11.dat	upx
behavioral1/files/0x00080000000145c7-18.dat	upx
behavioral1/files/0x000f000000003683-27.dat	upx
behavioral1/files/0x0032000000014508-34.dat	upx
behavioral1/files/0x0008000000014733-41.dat	upx
behavioral1/files/0x000700000001473e-46.dat	upx
behavioral1/files/0x0007000000015caf-53.dat	upx
behavioral1/files/0x0007000000014856-48.dat	upx
behavioral1/files/0x0006000000015cbf-66.dat	upx
behavioral1/files/0x0006000000015cd6-71.dat	upx
behavioral1/files/0x0006000000015cf3-85.dat	upx
behavioral1/files/0x0006000000015d20-103.dat	upx
behavioral1/files/0x0006000000015d72-114.dat	upx
behavioral1/files/0x0006000000015cfd-89.dat	upx
behavioral1/files/0x0006000000015d13-98.dat	upx
behavioral1/files/0x0006000000015d97-124.dat	upx
behavioral1/files/0x0006000000016133-148.dat	upx
behavioral1/files/0x0006000000016824-174.dat	upx
behavioral1/memory/2532-1156-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	upx
behavioral1/memory/2688-1281-0x000000013FB90000-0x000000013FF86000-memory.dmp	upx
behavioral1/files/0x0006000000016572-164.dat	upx
behavioral1/files/0x00060000000165d4-167.dat	upx
behavioral1/files/0x0006000000016448-158.dat	upx
behavioral1/files/0x00060000000162cc-153.dat	upx
behavioral1/files/0x00060000000160f3-143.dat	upx
behavioral1/files/0x0006000000015fd4-138.dat	upx
behavioral1/files/0x0006000000015f54-134.dat	upx
behavioral1/files/0x0006000000015d42-120.dat	upx
behavioral1/files/0x0006000000015de5-127.dat	upx
behavioral1/files/0x0006000000015cea-82.dat	upx
behavioral1/files/0x0006000000015d09-96.dat	upx
behavioral1/files/0x0006000000015ce2-76.dat	upx
behavioral1/files/0x0006000000015cb7-61.dat	upx
behavioral1/memory/2728-31-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/2424-1353-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/memory/2544-1409-0x000000013F360000-0x000000013F756000-memory.dmp	upx
behavioral1/memory/2960-1444-0x000000013FC90000-0x0000000140086000-memory.dmp	upx
behavioral1/memory/2700-1458-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/1700-2034-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	upx
behavioral1/memory/2588-2339-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2728-4279-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/2392-4281-0x000000013F080000-0x000000013F476000-memory.dmp	upx
behavioral1/memory/2532-4282-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	upx
behavioral1/memory/2688-4283-0x000000013FB90000-0x000000013FF86000-memory.dmp	upx
behavioral1/memory/2728-4284-0x000000013F3D0000-0x000000013F7C6000-memory.dmp	upx
behavioral1/memory/2544-4285-0x000000013F360000-0x000000013F756000-memory.dmp	upx
behavioral1/memory/2700-4286-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/memory/2424-4289-0x000000013F780000-0x000000013FB76000-memory.dmp	upx
behavioral1/memory/2588-4288-0x000000013FDE0000-0x00000001401D6000-memory.dmp	upx
behavioral1/memory/2960-4287-0x000000013FC90000-0x0000000140086000-memory.dmp	upx
behavioral1/memory/1700-4290-0x000000013F9B0000-0x000000013FDA6000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bjmNAFB.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\FNLvBcy.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\dlsNtIT.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\cEJBwyc.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\TLaBADO.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\MQXTvVn.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\IMVhZMk.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\gVYbyLg.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\utHphgP.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ogKeyxF.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ENRNjjr.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\FUybxBG.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\iwFvZtT.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\AJXCPsy.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\kqcRHct.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\DyjpdNx.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\mDxWdNJ.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\rbmoWIm.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\VBtGFjz.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\qbRizfs.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ihsUZXX.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\AqzvSuS.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\TpPbyBn.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\bBSsyqf.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\iflIfuA.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\LzVtnwx.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ISIPtiq.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\pZrAzai.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\rggmDzP.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\HsqLvXb.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\MfIiPvN.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\JcNlsaf.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\GZZsCec.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\vjOLDIt.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\YITvYwt.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\tjlULpD.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\BnmcTdW.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ujRoJCY.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\aOVCBgI.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\cqAQgQY.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\EzitNHW.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\YBMOlVB.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\YOcLxHp.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\wByVEeJ.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\UJNlsnR.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\jWUhUXi.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\DILbTBc.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ejnAaMy.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\AqvfdXm.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\CiHkhWc.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\YAWmFHb.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\eFBKjMg.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\vdVxuGL.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\AXCNPyQ.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\WOlyJgG.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\fKTFxJT.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\LkDshvG.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcpmdQC.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\ADRxvVS.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\shDDKhT.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\JNefsDi.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\JecCFYK.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\vdUVvKy.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
File created	C:\Windows\System\xqpPmrD.exe	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2204	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2204	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2204	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	29
PID 2348 wrote to memory of 2204	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	29
PID 2348 wrote to memory of 2204	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	29
PID 2348 wrote to memory of 2392	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	30
PID 2348 wrote to memory of 2392	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	30
PID 2348 wrote to memory of 2392	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	30
PID 2348 wrote to memory of 2728	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	31
PID 2348 wrote to memory of 2728	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	31
PID 2348 wrote to memory of 2728	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	31
PID 2348 wrote to memory of 2532	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	32
PID 2348 wrote to memory of 2532	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	32
PID 2348 wrote to memory of 2532	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	32
PID 2348 wrote to memory of 2688	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	33
PID 2348 wrote to memory of 2688	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	33
PID 2348 wrote to memory of 2688	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	33
PID 2348 wrote to memory of 2424	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	34
PID 2348 wrote to memory of 2424	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	34
PID 2348 wrote to memory of 2424	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	34
PID 2348 wrote to memory of 2544	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	35
PID 2348 wrote to memory of 2544	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	35
PID 2348 wrote to memory of 2544	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	35
PID 2348 wrote to memory of 2960	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	36
PID 2348 wrote to memory of 2960	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	36
PID 2348 wrote to memory of 2960	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	36
PID 2348 wrote to memory of 2700	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	37
PID 2348 wrote to memory of 2700	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	37
PID 2348 wrote to memory of 2700	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	37
PID 2348 wrote to memory of 1700	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	38
PID 2348 wrote to memory of 1700	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	38
PID 2348 wrote to memory of 1700	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	38
PID 2348 wrote to memory of 2588	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	39
PID 2348 wrote to memory of 2588	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	39
PID 2348 wrote to memory of 2588	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	39
PID 2348 wrote to memory of 2812	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	40
PID 2348 wrote to memory of 2812	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	40
PID 2348 wrote to memory of 2812	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	40
PID 2348 wrote to memory of 2848	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	41
PID 2348 wrote to memory of 2848	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	41
PID 2348 wrote to memory of 2848	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	41
PID 2348 wrote to memory of 2972	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	42
PID 2348 wrote to memory of 2972	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	42
PID 2348 wrote to memory of 2972	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	42
PID 2348 wrote to memory of 1824	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	43
PID 2348 wrote to memory of 1824	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	43
PID 2348 wrote to memory of 1824	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	43
PID 2348 wrote to memory of 1896	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	44
PID 2348 wrote to memory of 1896	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	44
PID 2348 wrote to memory of 1896	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	44
PID 2348 wrote to memory of 2328	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	45
PID 2348 wrote to memory of 2328	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	45
PID 2348 wrote to memory of 2328	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	45
PID 2348 wrote to memory of 2000	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	46
PID 2348 wrote to memory of 2000	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	46
PID 2348 wrote to memory of 2000	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	46
PID 2348 wrote to memory of 2004	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	47
PID 2348 wrote to memory of 2004	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	47
PID 2348 wrote to memory of 2004	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	47
PID 2348 wrote to memory of 1820	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	48
PID 2348 wrote to memory of 1820	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	48
PID 2348 wrote to memory of 1820	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	48
PID 2348 wrote to memory of 2176	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	49
PID 2348 wrote to memory of 2176	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	49
PID 2348 wrote to memory of 2176	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	49
PID 2348 wrote to memory of 1200	2348	28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\28e78c37c1a70aa3d7099ccf3c99bbb0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\System\juzeays.exe
  C:\Windows\System\juzeays.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\wxejRlO.exe
  C:\Windows\System\wxejRlO.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ziHkRGJ.exe
  C:\Windows\System\ziHkRGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\eVPBxNE.exe
  C:\Windows\System\eVPBxNE.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\gbXjRmi.exe
  C:\Windows\System\gbXjRmi.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\PNBxSga.exe
  C:\Windows\System\PNBxSga.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\NgYzOTM.exe
  C:\Windows\System\NgYzOTM.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\UaaBjPy.exe
  C:\Windows\System\UaaBjPy.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\jTEgSCT.exe
  C:\Windows\System\jTEgSCT.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\NFDNpqi.exe
  C:\Windows\System\NFDNpqi.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ELKPOXX.exe
  C:\Windows\System\ELKPOXX.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\vYDBJVK.exe
  C:\Windows\System\vYDBJVK.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\RQCsILX.exe
  C:\Windows\System\RQCsILX.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\xIPbTCp.exe
  C:\Windows\System\xIPbTCp.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\OGnSaAh.exe
  C:\Windows\System\OGnSaAh.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\eBPLGxy.exe
  C:\Windows\System\eBPLGxy.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\FDCglbO.exe
  C:\Windows\System\FDCglbO.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\IkWepEf.exe
  C:\Windows\System\IkWepEf.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\HcrIhfA.exe
  C:\Windows\System\HcrIhfA.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\DNmEjZF.exe
  C:\Windows\System\DNmEjZF.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\RfjToOM.exe
  C:\Windows\System\RfjToOM.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\fiWYRSV.exe
  C:\Windows\System\fiWYRSV.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ESSKXPj.exe
  C:\Windows\System\ESSKXPj.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\SlwDYNm.exe
  C:\Windows\System\SlwDYNm.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ZJDLqND.exe
  C:\Windows\System\ZJDLqND.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\jpQPFPo.exe
  C:\Windows\System\jpQPFPo.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\xNBSkyx.exe
  C:\Windows\System\xNBSkyx.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\iEoXQpy.exe
  C:\Windows\System\iEoXQpy.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\SMYEkCj.exe
  C:\Windows\System\SMYEkCj.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\VhOULHA.exe
  C:\Windows\System\VhOULHA.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\iMpvFfE.exe
  C:\Windows\System\iMpvFfE.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\pBslRKu.exe
  C:\Windows\System\pBslRKu.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\yrnBTJu.exe
  C:\Windows\System\yrnBTJu.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\MwuinyK.exe
  C:\Windows\System\MwuinyK.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\pAfvSUq.exe
  C:\Windows\System\pAfvSUq.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\AbqhCkW.exe
  C:\Windows\System\AbqhCkW.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\XtcVDjO.exe
  C:\Windows\System\XtcVDjO.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\PdxUKBJ.exe
  C:\Windows\System\PdxUKBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\uxerjUx.exe
  C:\Windows\System\uxerjUx.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\iSOQPwz.exe
  C:\Windows\System\iSOQPwz.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\zDUBzIg.exe
  C:\Windows\System\zDUBzIg.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\iiecJLf.exe
  C:\Windows\System\iiecJLf.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\YXxbmfh.exe
  C:\Windows\System\YXxbmfh.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\hSRjIZQ.exe
  C:\Windows\System\hSRjIZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\udTeGUR.exe
  C:\Windows\System\udTeGUR.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\QTUDMJh.exe
  C:\Windows\System\QTUDMJh.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\SYvWdiv.exe
  C:\Windows\System\SYvWdiv.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\fIIUbVq.exe
  C:\Windows\System\fIIUbVq.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\nSOGrKc.exe
  C:\Windows\System\nSOGrKc.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\xHaPZrX.exe
  C:\Windows\System\xHaPZrX.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\SXxlRHe.exe
  C:\Windows\System\SXxlRHe.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\sfeLlsp.exe
  C:\Windows\System\sfeLlsp.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\qwqnBoR.exe
  C:\Windows\System\qwqnBoR.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\chzKxqN.exe
  C:\Windows\System\chzKxqN.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\SqzdGMT.exe
  C:\Windows\System\SqzdGMT.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\EmlEHTf.exe
  C:\Windows\System\EmlEHTf.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\smrtQQt.exe
  C:\Windows\System\smrtQQt.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\QVMvjXb.exe
  C:\Windows\System\QVMvjXb.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\aLpSjWt.exe
  C:\Windows\System\aLpSjWt.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\OWXuQQx.exe
  C:\Windows\System\OWXuQQx.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\rBpYwoJ.exe
  C:\Windows\System\rBpYwoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\cgXnbiX.exe
  C:\Windows\System\cgXnbiX.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\tpxNFFT.exe
  C:\Windows\System\tpxNFFT.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\gErDKyo.exe
  C:\Windows\System\gErDKyo.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\epJTCwp.exe
  C:\Windows\System\epJTCwp.exe
  2⤵
  PID:2604
- C:\Windows\System\tTUKuro.exe
  C:\Windows\System\tTUKuro.exe
  2⤵
  PID:2976
- C:\Windows\System\MbFzUSy.exe
  C:\Windows\System\MbFzUSy.exe
  2⤵
  PID:2616
- C:\Windows\System\zsiTELD.exe
  C:\Windows\System\zsiTELD.exe
  2⤵
  PID:2844
- C:\Windows\System\aOWDxuv.exe
  C:\Windows\System\aOWDxuv.exe
  2⤵
  PID:1920
- C:\Windows\System\fzUiriG.exe
  C:\Windows\System\fzUiriG.exe
  2⤵
  PID:1816
- C:\Windows\System\PehdkQD.exe
  C:\Windows\System\PehdkQD.exe
  2⤵
  PID:3004
- C:\Windows\System\jajpnpI.exe
  C:\Windows\System\jajpnpI.exe
  2⤵
  PID:768
- C:\Windows\System\Kfbgvjs.exe
  C:\Windows\System\Kfbgvjs.exe
  2⤵
  PID:3048
- C:\Windows\System\AeZSzgw.exe
  C:\Windows\System\AeZSzgw.exe
  2⤵
  PID:1884
- C:\Windows\System\cOOPbZp.exe
  C:\Windows\System\cOOPbZp.exe
  2⤵
  PID:696
- C:\Windows\System\GpYCUNf.exe
  C:\Windows\System\GpYCUNf.exe
  2⤵
  PID:1748
- C:\Windows\System\RHyBZIh.exe
  C:\Windows\System\RHyBZIh.exe
  2⤵
  PID:1564
- C:\Windows\System\cedXoOw.exe
  C:\Windows\System\cedXoOw.exe
  2⤵
  PID:1968
- C:\Windows\System\ZHOJIOu.exe
  C:\Windows\System\ZHOJIOu.exe
  2⤵
  PID:316
- C:\Windows\System\adIPCpl.exe
  C:\Windows\System\adIPCpl.exe
  2⤵
  PID:2896
- C:\Windows\System\qRjEbjK.exe
  C:\Windows\System\qRjEbjK.exe
  2⤵
  PID:1112
- C:\Windows\System\MJHnJTA.exe
  C:\Windows\System\MJHnJTA.exe
  2⤵
  PID:2992
- C:\Windows\System\JJLiNgG.exe
  C:\Windows\System\JJLiNgG.exe
  2⤵
  PID:1364
- C:\Windows\System\kOmjSyp.exe
  C:\Windows\System\kOmjSyp.exe
  2⤵
  PID:1492
- C:\Windows\System\wewMCJD.exe
  C:\Windows\System\wewMCJD.exe
  2⤵
  PID:2404
- C:\Windows\System\dHgUIBd.exe
  C:\Windows\System\dHgUIBd.exe
  2⤵
  PID:1656
- C:\Windows\System\dkrfcPO.exe
  C:\Windows\System\dkrfcPO.exe
  2⤵
  PID:1664
- C:\Windows\System\XXEpDME.exe
  C:\Windows\System\XXEpDME.exe
  2⤵
  PID:2364
- C:\Windows\System\LZtAeQg.exe
  C:\Windows\System\LZtAeQg.exe
  2⤵
  PID:1616
- C:\Windows\System\FJyHGyj.exe
  C:\Windows\System\FJyHGyj.exe
  2⤵
  PID:2172
- C:\Windows\System\EjxpsOo.exe
  C:\Windows\System\EjxpsOo.exe
  2⤵
  PID:1512
- C:\Windows\System\HIRlOUL.exe
  C:\Windows\System\HIRlOUL.exe
  2⤵
  PID:2028
- C:\Windows\System\QFrzHDc.exe
  C:\Windows\System\QFrzHDc.exe
  2⤵
  PID:2236
- C:\Windows\System\eQcIEVQ.exe
  C:\Windows\System\eQcIEVQ.exe
  2⤵
  PID:2112
- C:\Windows\System\wsvtOvp.exe
  C:\Windows\System\wsvtOvp.exe
  2⤵
  PID:2044
- C:\Windows\System\embubpA.exe
  C:\Windows\System\embubpA.exe
  2⤵
  PID:2280
- C:\Windows\System\mxebBsT.exe
  C:\Windows\System\mxebBsT.exe
  2⤵
  PID:2756
- C:\Windows\System\MfIiPvN.exe
  C:\Windows\System\MfIiPvN.exe
  2⤵
  PID:2776
- C:\Windows\System\NbKTAyM.exe
  C:\Windows\System\NbKTAyM.exe
  2⤵
  PID:2856
- C:\Windows\System\vzlPsve.exe
  C:\Windows\System\vzlPsve.exe
  2⤵
  PID:1792
- C:\Windows\System\pWacsXe.exe
  C:\Windows\System\pWacsXe.exe
  2⤵
  PID:2732
- C:\Windows\System\pfYzpAG.exe
  C:\Windows\System\pfYzpAG.exe
  2⤵
  PID:1812
- C:\Windows\System\sZxjaEa.exe
  C:\Windows\System\sZxjaEa.exe
  2⤵
  PID:2744
- C:\Windows\System\HgYmrIS.exe
  C:\Windows\System\HgYmrIS.exe
  2⤵
  PID:2008
- C:\Windows\System\CddXpDk.exe
  C:\Windows\System\CddXpDk.exe
  2⤵
  PID:2672
- C:\Windows\System\tfzBMFB.exe
  C:\Windows\System\tfzBMFB.exe
  2⤵
  PID:2016
- C:\Windows\System\cJsrIeE.exe
  C:\Windows\System\cJsrIeE.exe
  2⤵
  PID:1072
- C:\Windows\System\CcEGTQP.exe
  C:\Windows\System\CcEGTQP.exe
  2⤵
  PID:860
- C:\Windows\System\luUMikQ.exe
  C:\Windows\System\luUMikQ.exe
  2⤵
  PID:1584
- C:\Windows\System\WwVuSYL.exe
  C:\Windows\System\WwVuSYL.exe
  2⤵
  PID:772
- C:\Windows\System\XJiZCxp.exe
  C:\Windows\System\XJiZCxp.exe
  2⤵
  PID:704
- C:\Windows\System\nswwMNQ.exe
  C:\Windows\System\nswwMNQ.exe
  2⤵
  PID:964
- C:\Windows\System\pbEbzSN.exe
  C:\Windows\System\pbEbzSN.exe
  2⤵
  PID:816
- C:\Windows\System\LEoRwku.exe
  C:\Windows\System\LEoRwku.exe
  2⤵
  PID:1924
- C:\Windows\System\qJBlkKC.exe
  C:\Windows\System\qJBlkKC.exe
  2⤵
  PID:284
- C:\Windows\System\SUhzSji.exe
  C:\Windows\System\SUhzSji.exe
  2⤵
  PID:2316
- C:\Windows\System\BuWOdyI.exe
  C:\Windows\System\BuWOdyI.exe
  2⤵
  PID:2320
- C:\Windows\System\cqlrumZ.exe
  C:\Windows\System\cqlrumZ.exe
  2⤵
  PID:1580
- C:\Windows\System\SlaFETQ.exe
  C:\Windows\System\SlaFETQ.exe
  2⤵
  PID:2840
- C:\Windows\System\TxqExAT.exe
  C:\Windows\System\TxqExAT.exe
  2⤵
  PID:848
- C:\Windows\System\xYEAlKJ.exe
  C:\Windows\System\xYEAlKJ.exe
  2⤵
  PID:1208
- C:\Windows\System\PsymGPp.exe
  C:\Windows\System\PsymGPp.exe
  2⤵
  PID:2432
- C:\Windows\System\BgkJslY.exe
  C:\Windows\System\BgkJslY.exe
  2⤵
  PID:2832
- C:\Windows\System\axqSilJ.exe
  C:\Windows\System\axqSilJ.exe
  2⤵
  PID:3052
- C:\Windows\System\kvJAXMA.exe
  C:\Windows\System\kvJAXMA.exe
  2⤵
  PID:1888
- C:\Windows\System\xUHakXi.exe
  C:\Windows\System\xUHakXi.exe
  2⤵
  PID:2220
- C:\Windows\System\bVzvzJd.exe
  C:\Windows\System\bVzvzJd.exe
  2⤵
  PID:1188
- C:\Windows\System\JAhABhl.exe
  C:\Windows\System\JAhABhl.exe
  2⤵
  PID:3084
- C:\Windows\System\UoQRugP.exe
  C:\Windows\System\UoQRugP.exe
  2⤵
  PID:3104
- C:\Windows\System\AQrnuWc.exe
  C:\Windows\System\AQrnuWc.exe
  2⤵
  PID:3124
- C:\Windows\System\CLdoaJe.exe
  C:\Windows\System\CLdoaJe.exe
  2⤵
  PID:3144
- C:\Windows\System\rklGIPH.exe
  C:\Windows\System\rklGIPH.exe
  2⤵
  PID:3164
- C:\Windows\System\dSXtUVT.exe
  C:\Windows\System\dSXtUVT.exe
  2⤵
  PID:3184
- C:\Windows\System\DeXtwSg.exe
  C:\Windows\System\DeXtwSg.exe
  2⤵
  PID:3204
- C:\Windows\System\EkSvTUH.exe
  C:\Windows\System\EkSvTUH.exe
  2⤵
  PID:3224
- C:\Windows\System\qwuJuAS.exe
  C:\Windows\System\qwuJuAS.exe
  2⤵
  PID:3244
- C:\Windows\System\jrFWBBv.exe
  C:\Windows\System\jrFWBBv.exe
  2⤵
  PID:3264
- C:\Windows\System\tRVyPvS.exe
  C:\Windows\System\tRVyPvS.exe
  2⤵
  PID:3284
- C:\Windows\System\VksTCMM.exe
  C:\Windows\System\VksTCMM.exe
  2⤵
  PID:3304
- C:\Windows\System\TRQMrbp.exe
  C:\Windows\System\TRQMrbp.exe
  2⤵
  PID:3324
- C:\Windows\System\exIotiy.exe
  C:\Windows\System\exIotiy.exe
  2⤵
  PID:3344
- C:\Windows\System\icDMOHV.exe
  C:\Windows\System\icDMOHV.exe
  2⤵
  PID:3364
- C:\Windows\System\AAhhXiM.exe
  C:\Windows\System\AAhhXiM.exe
  2⤵
  PID:3384
- C:\Windows\System\fQTPtcH.exe
  C:\Windows\System\fQTPtcH.exe
  2⤵
  PID:3404
- C:\Windows\System\OuEOlZA.exe
  C:\Windows\System\OuEOlZA.exe
  2⤵
  PID:3420
- C:\Windows\System\hLFGUqt.exe
  C:\Windows\System\hLFGUqt.exe
  2⤵
  PID:3444
- C:\Windows\System\mwInPmk.exe
  C:\Windows\System\mwInPmk.exe
  2⤵
  PID:3460
- C:\Windows\System\fqlcSGf.exe
  C:\Windows\System\fqlcSGf.exe
  2⤵
  PID:3476
- C:\Windows\System\oDAPyDF.exe
  C:\Windows\System\oDAPyDF.exe
  2⤵
  PID:3500
- C:\Windows\System\ilWzjia.exe
  C:\Windows\System\ilWzjia.exe
  2⤵
  PID:3520
- C:\Windows\System\lKIyegK.exe
  C:\Windows\System\lKIyegK.exe
  2⤵
  PID:3544
- C:\Windows\System\kfunRyS.exe
  C:\Windows\System\kfunRyS.exe
  2⤵
  PID:3564
- C:\Windows\System\PZryLND.exe
  C:\Windows\System\PZryLND.exe
  2⤵
  PID:3584
- C:\Windows\System\hvWmmWZ.exe
  C:\Windows\System\hvWmmWZ.exe
  2⤵
  PID:3604
- C:\Windows\System\lfTPnxw.exe
  C:\Windows\System\lfTPnxw.exe
  2⤵
  PID:3624
- C:\Windows\System\DwhbMFS.exe
  C:\Windows\System\DwhbMFS.exe
  2⤵
  PID:3644
- C:\Windows\System\DUYkydJ.exe
  C:\Windows\System\DUYkydJ.exe
  2⤵
  PID:3664
- C:\Windows\System\HqauhRi.exe
  C:\Windows\System\HqauhRi.exe
  2⤵
  PID:3684
- C:\Windows\System\cEZMDoL.exe
  C:\Windows\System\cEZMDoL.exe
  2⤵
  PID:3704
- C:\Windows\System\kNoivIs.exe
  C:\Windows\System\kNoivIs.exe
  2⤵
  PID:3724
- C:\Windows\System\ycDpUpm.exe
  C:\Windows\System\ycDpUpm.exe
  2⤵
  PID:3740
- C:\Windows\System\kFIBHsT.exe
  C:\Windows\System\kFIBHsT.exe
  2⤵
  PID:3760
- C:\Windows\System\oHqCFfm.exe
  C:\Windows\System\oHqCFfm.exe
  2⤵
  PID:3784
- C:\Windows\System\YbHviQj.exe
  C:\Windows\System\YbHviQj.exe
  2⤵
  PID:3804
- C:\Windows\System\AChmQOV.exe
  C:\Windows\System\AChmQOV.exe
  2⤵
  PID:3824
- C:\Windows\System\tenewRY.exe
  C:\Windows\System\tenewRY.exe
  2⤵
  PID:3844
- C:\Windows\System\EhUoNXV.exe
  C:\Windows\System\EhUoNXV.exe
  2⤵
  PID:3860
- C:\Windows\System\sncbZNS.exe
  C:\Windows\System\sncbZNS.exe
  2⤵
  PID:3884
- C:\Windows\System\GvhwDNZ.exe
  C:\Windows\System\GvhwDNZ.exe
  2⤵
  PID:3904
- C:\Windows\System\SpONVYC.exe
  C:\Windows\System\SpONVYC.exe
  2⤵
  PID:3924
- C:\Windows\System\GOcWVRy.exe
  C:\Windows\System\GOcWVRy.exe
  2⤵
  PID:3944
- C:\Windows\System\LbenWtF.exe
  C:\Windows\System\LbenWtF.exe
  2⤵
  PID:3964
- C:\Windows\System\gcyRFUb.exe
  C:\Windows\System\gcyRFUb.exe
  2⤵
  PID:3984
- C:\Windows\System\LQRNcIf.exe
  C:\Windows\System\LQRNcIf.exe
  2⤵
  PID:4004
- C:\Windows\System\HnYNXGk.exe
  C:\Windows\System\HnYNXGk.exe
  2⤵
  PID:4024
- C:\Windows\System\clNTMIy.exe
  C:\Windows\System\clNTMIy.exe
  2⤵
  PID:4044
- C:\Windows\System\aRgFbdb.exe
  C:\Windows\System\aRgFbdb.exe
  2⤵
  PID:4064
- C:\Windows\System\VIvWzJh.exe
  C:\Windows\System\VIvWzJh.exe
  2⤵
  PID:4084
- C:\Windows\System\yRHIWim.exe
  C:\Windows\System\yRHIWim.exe
  2⤵
  PID:2108
- C:\Windows\System\jdZYBYx.exe
  C:\Windows\System\jdZYBYx.exe
  2⤵
  PID:1536
- C:\Windows\System\FOQdLtT.exe
  C:\Windows\System\FOQdLtT.exe
  2⤵
  PID:948
- C:\Windows\System\aHfCnJr.exe
  C:\Windows\System\aHfCnJr.exe
  2⤵
  PID:1712
- C:\Windows\System\phljXAw.exe
  C:\Windows\System\phljXAw.exe
  2⤵
  PID:1312
- C:\Windows\System\yuduiYT.exe
  C:\Windows\System\yuduiYT.exe
  2⤵
  PID:588
- C:\Windows\System\wnIQizf.exe
  C:\Windows\System\wnIQizf.exe
  2⤵
  PID:1848
- C:\Windows\System\GFRJbLc.exe
  C:\Windows\System\GFRJbLc.exe
  2⤵
  PID:2484
- C:\Windows\System\OAJTNpH.exe
  C:\Windows\System\OAJTNpH.exe
  2⤵
  PID:3068
- C:\Windows\System\hTgjMBD.exe
  C:\Windows\System\hTgjMBD.exe
  2⤵
  PID:2932
- C:\Windows\System\qoPnYwT.exe
  C:\Windows\System\qoPnYwT.exe
  2⤵
  PID:2824
- C:\Windows\System\MVHaCWe.exe
  C:\Windows\System\MVHaCWe.exe
  2⤵
  PID:2300
- C:\Windows\System\dRkXjQn.exe
  C:\Windows\System\dRkXjQn.exe
  2⤵
  PID:3112
- C:\Windows\System\HyNQSUu.exe
  C:\Windows\System\HyNQSUu.exe
  2⤵
  PID:3120
- C:\Windows\System\ArtovmH.exe
  C:\Windows\System\ArtovmH.exe
  2⤵
  PID:3132
- C:\Windows\System\yPUAhtZ.exe
  C:\Windows\System\yPUAhtZ.exe
  2⤵
  PID:3180
- C:\Windows\System\UdaZCJx.exe
  C:\Windows\System\UdaZCJx.exe
  2⤵
  PID:3176
- C:\Windows\System\GcYzcWu.exe
  C:\Windows\System\GcYzcWu.exe
  2⤵
  PID:3220
- C:\Windows\System\kBhDGNm.exe
  C:\Windows\System\kBhDGNm.exe
  2⤵
  PID:3312
- C:\Windows\System\wgdVewr.exe
  C:\Windows\System\wgdVewr.exe
  2⤵
  PID:3296
- C:\Windows\System\QmWXPlh.exe
  C:\Windows\System\QmWXPlh.exe
  2⤵
  PID:3332
- C:\Windows\System\mkmjgLf.exe
  C:\Windows\System\mkmjgLf.exe
  2⤵
  PID:3372
- C:\Windows\System\LrvofSL.exe
  C:\Windows\System\LrvofSL.exe
  2⤵
  PID:3436
- C:\Windows\System\hmyeGun.exe
  C:\Windows\System\hmyeGun.exe
  2⤵
  PID:3472
- C:\Windows\System\GMzSozZ.exe
  C:\Windows\System\GMzSozZ.exe
  2⤵
  PID:3512
- C:\Windows\System\KBBHmDO.exe
  C:\Windows\System\KBBHmDO.exe
  2⤵
  PID:3536
- C:\Windows\System\UBnfHYq.exe
  C:\Windows\System\UBnfHYq.exe
  2⤵
  PID:3492
- C:\Windows\System\GfdGVjc.exe
  C:\Windows\System\GfdGVjc.exe
  2⤵
  PID:3600
- C:\Windows\System\dpQCSAc.exe
  C:\Windows\System\dpQCSAc.exe
  2⤵
  PID:3612
- C:\Windows\System\EQXiikE.exe
  C:\Windows\System\EQXiikE.exe
  2⤵
  PID:3672
- C:\Windows\System\oMpEYwr.exe
  C:\Windows\System\oMpEYwr.exe
  2⤵
  PID:3656
- C:\Windows\System\WnmZZBq.exe
  C:\Windows\System\WnmZZBq.exe
  2⤵
  PID:3756
- C:\Windows\System\ZVGEAnh.exe
  C:\Windows\System\ZVGEAnh.exe
  2⤵
  PID:3736
- C:\Windows\System\JDhdLED.exe
  C:\Windows\System\JDhdLED.exe
  2⤵
  PID:3776
- C:\Windows\System\dqAVCqQ.exe
  C:\Windows\System\dqAVCqQ.exe
  2⤵
  PID:3780
- C:\Windows\System\tSveDqV.exe
  C:\Windows\System\tSveDqV.exe
  2⤵
  PID:3816
- C:\Windows\System\LIkyVFI.exe
  C:\Windows\System\LIkyVFI.exe
  2⤵
  PID:3872
- C:\Windows\System\KJCLRdT.exe
  C:\Windows\System\KJCLRdT.exe
  2⤵
  PID:3912
- C:\Windows\System\GVNQpYs.exe
  C:\Windows\System\GVNQpYs.exe
  2⤵
  PID:3952
- C:\Windows\System\caUItWI.exe
  C:\Windows\System\caUItWI.exe
  2⤵
  PID:3956
- C:\Windows\System\pqLhdti.exe
  C:\Windows\System\pqLhdti.exe
  2⤵
  PID:3976
- C:\Windows\System\VppPnoH.exe
  C:\Windows\System\VppPnoH.exe
  2⤵
  PID:4036
- C:\Windows\System\javJTvO.exe
  C:\Windows\System\javJTvO.exe
  2⤵
  PID:4080
- C:\Windows\System\CxcorrV.exe
  C:\Windows\System\CxcorrV.exe
  2⤵
  PID:4076
- C:\Windows\System\XgSAkkO.exe
  C:\Windows\System\XgSAkkO.exe
  2⤵
  PID:1448
- C:\Windows\System\yCTWmzx.exe
  C:\Windows\System\yCTWmzx.exe
  2⤵
  PID:1868
- C:\Windows\System\MDdJHEm.exe
  C:\Windows\System\MDdJHEm.exe
  2⤵
  PID:1788
- C:\Windows\System\ShWMZFu.exe
  C:\Windows\System\ShWMZFu.exe
  2⤵
  PID:1744
- C:\Windows\System\NCQQNVk.exe
  C:\Windows\System\NCQQNVk.exe
  2⤵
  PID:808
- C:\Windows\System\gKCcYMz.exe
  C:\Windows\System\gKCcYMz.exe
  2⤵
  PID:2876
- C:\Windows\System\ooWrXCN.exe
  C:\Windows\System\ooWrXCN.exe
  2⤵
  PID:2144
- C:\Windows\System\gIJuEMs.exe
  C:\Windows\System\gIJuEMs.exe
  2⤵
  PID:3076
- C:\Windows\System\jtaedvi.exe
  C:\Windows\System\jtaedvi.exe
  2⤵
  PID:3156
- C:\Windows\System\mYhjOSR.exe
  C:\Windows\System\mYhjOSR.exe
  2⤵
  PID:3216
- C:\Windows\System\KmFNOdI.exe
  C:\Windows\System\KmFNOdI.exe
  2⤵
  PID:3316
- C:\Windows\System\XdCserc.exe
  C:\Windows\System\XdCserc.exe
  2⤵
  PID:3292
- C:\Windows\System\UlCpwXn.exe
  C:\Windows\System\UlCpwXn.exe
  2⤵
  PID:3356
- C:\Windows\System\OVMJORo.exe
  C:\Windows\System\OVMJORo.exe
  2⤵
  PID:3412
- C:\Windows\System\oFiifUh.exe
  C:\Windows\System\oFiifUh.exe
  2⤵
  PID:3540
- C:\Windows\System\LFAarDx.exe
  C:\Windows\System\LFAarDx.exe
  2⤵
  PID:2788
- C:\Windows\System\xkrvtdt.exe
  C:\Windows\System\xkrvtdt.exe
  2⤵
  PID:3620
- C:\Windows\System\hkcOekr.exe
  C:\Windows\System\hkcOekr.exe
  2⤵
  PID:3528
- C:\Windows\System\djlYguD.exe
  C:\Windows\System\djlYguD.exe
  2⤵
  PID:3632
- C:\Windows\System\ZNYSfGX.exe
  C:\Windows\System\ZNYSfGX.exe
  2⤵
  PID:3840
- C:\Windows\System\XkyiqOt.exe
  C:\Windows\System\XkyiqOt.exe
  2⤵
  PID:3896
- C:\Windows\System\ftwXEfC.exe
  C:\Windows\System\ftwXEfC.exe
  2⤵
  PID:3960
- C:\Windows\System\ikorHDx.exe
  C:\Windows\System\ikorHDx.exe
  2⤵
  PID:3796
- C:\Windows\System\DVkuySq.exe
  C:\Windows\System\DVkuySq.exe
  2⤵
  PID:3900
- C:\Windows\System\TWLlCjt.exe
  C:\Windows\System\TWLlCjt.exe
  2⤵
  PID:1856
- C:\Windows\System\qRCIOVe.exe
  C:\Windows\System\qRCIOVe.exe
  2⤵
  PID:1136
- C:\Windows\System\qtEiQRu.exe
  C:\Windows\System\qtEiQRu.exe
  2⤵
  PID:4020
- C:\Windows\System\LoJvjWZ.exe
  C:\Windows\System\LoJvjWZ.exe
  2⤵
  PID:2324
- C:\Windows\System\fZYJzpV.exe
  C:\Windows\System\fZYJzpV.exe
  2⤵
  PID:1124
- C:\Windows\System\HSSRHTO.exe
  C:\Windows\System\HSSRHTO.exe
  2⤵
  PID:3116
- C:\Windows\System\wmndAEd.exe
  C:\Windows\System\wmndAEd.exe
  2⤵
  PID:2592
- C:\Windows\System\XWGnwYg.exe
  C:\Windows\System\XWGnwYg.exe
  2⤵
  PID:3140
- C:\Windows\System\tSecnRs.exe
  C:\Windows\System\tSecnRs.exe
  2⤵
  PID:3260
- C:\Windows\System\NOmvOby.exe
  C:\Windows\System\NOmvOby.exe
  2⤵
  PID:3256
- C:\Windows\System\XuftgDY.exe
  C:\Windows\System\XuftgDY.exe
  2⤵
  PID:3400
- C:\Windows\System\ScXgzAB.exe
  C:\Windows\System\ScXgzAB.exe
  2⤵
  PID:3556
- C:\Windows\System\PARBdgp.exe
  C:\Windows\System\PARBdgp.exe
  2⤵
  PID:3716
- C:\Windows\System\rnmIdOC.exe
  C:\Windows\System\rnmIdOC.exe
  2⤵
  PID:3652
- C:\Windows\System\EKFjqJJ.exe
  C:\Windows\System\EKFjqJJ.exe
  2⤵
  PID:3576
- C:\Windows\System\hezWQZA.exe
  C:\Windows\System\hezWQZA.exe
  2⤵
  PID:3892
- C:\Windows\System\esyzDlU.exe
  C:\Windows\System\esyzDlU.exe
  2⤵
  PID:3880
- C:\Windows\System\mDYpcVw.exe
  C:\Windows\System\mDYpcVw.exe
  2⤵
  PID:4032
- C:\Windows\System\CXNofFd.exe
  C:\Windows\System\CXNofFd.exe
  2⤵
  PID:3972
- C:\Windows\System\raxdIUU.exe
  C:\Windows\System\raxdIUU.exe
  2⤵
  PID:2340
- C:\Windows\System\ByQYsSP.exe
  C:\Windows\System\ByQYsSP.exe
  2⤵
  PID:3196
- C:\Windows\System\FOoQric.exe
  C:\Windows\System\FOoQric.exe
  2⤵
  PID:852
- C:\Windows\System\uysRMav.exe
  C:\Windows\System\uysRMav.exe
  2⤵
  PID:3280
- C:\Windows\System\RyOCQMB.exe
  C:\Windows\System\RyOCQMB.exe
  2⤵
  PID:3468
- C:\Windows\System\JHCciAa.exe
  C:\Windows\System\JHCciAa.exe
  2⤵
  PID:3616
- C:\Windows\System\NTpouZO.exe
  C:\Windows\System\NTpouZO.exe
  2⤵
  PID:4112
- C:\Windows\System\VSRAoyM.exe
  C:\Windows\System\VSRAoyM.exe
  2⤵
  PID:4132
- C:\Windows\System\rCnPVoK.exe
  C:\Windows\System\rCnPVoK.exe
  2⤵
  PID:4152
- C:\Windows\System\cdTDwBC.exe
  C:\Windows\System\cdTDwBC.exe
  2⤵
  PID:4172
- C:\Windows\System\CUvUQoN.exe
  C:\Windows\System\CUvUQoN.exe
  2⤵
  PID:4192
- C:\Windows\System\aIPDcxe.exe
  C:\Windows\System\aIPDcxe.exe
  2⤵
  PID:4212
- C:\Windows\System\PzsCEAB.exe
  C:\Windows\System\PzsCEAB.exe
  2⤵
  PID:4232
- C:\Windows\System\AGsPRzc.exe
  C:\Windows\System\AGsPRzc.exe
  2⤵
  PID:4252
- C:\Windows\System\kJsXcIQ.exe
  C:\Windows\System\kJsXcIQ.exe
  2⤵
  PID:4272
- C:\Windows\System\rGzBUyi.exe
  C:\Windows\System\rGzBUyi.exe
  2⤵
  PID:4292
- C:\Windows\System\lsQeORF.exe
  C:\Windows\System\lsQeORF.exe
  2⤵
  PID:4312
- C:\Windows\System\jaoqpRp.exe
  C:\Windows\System\jaoqpRp.exe
  2⤵
  PID:4332
- C:\Windows\System\GexTSlZ.exe
  C:\Windows\System\GexTSlZ.exe
  2⤵
  PID:4352
- C:\Windows\System\zpHImRW.exe
  C:\Windows\System\zpHImRW.exe
  2⤵
  PID:4372
- C:\Windows\System\jINwhvq.exe
  C:\Windows\System\jINwhvq.exe
  2⤵
  PID:4392
- C:\Windows\System\AJjuCSw.exe
  C:\Windows\System\AJjuCSw.exe
  2⤵
  PID:4412
- C:\Windows\System\hNbhnyR.exe
  C:\Windows\System\hNbhnyR.exe
  2⤵
  PID:4432
- C:\Windows\System\YmKiOtx.exe
  C:\Windows\System\YmKiOtx.exe
  2⤵
  PID:4452
- C:\Windows\System\bDthOms.exe
  C:\Windows\System\bDthOms.exe
  2⤵
  PID:4472
- C:\Windows\System\irAafXN.exe
  C:\Windows\System\irAafXN.exe
  2⤵
  PID:4492
- C:\Windows\System\uubmYBn.exe
  C:\Windows\System\uubmYBn.exe
  2⤵
  PID:4512
- C:\Windows\System\AcFoxOn.exe
  C:\Windows\System\AcFoxOn.exe
  2⤵
  PID:4528
- C:\Windows\System\WHHURJC.exe
  C:\Windows\System\WHHURJC.exe
  2⤵
  PID:4552
- C:\Windows\System\oJfCiiM.exe
  C:\Windows\System\oJfCiiM.exe
  2⤵
  PID:4568
- C:\Windows\System\poMqNWI.exe
  C:\Windows\System\poMqNWI.exe
  2⤵
  PID:4588
- C:\Windows\System\EEEPVvl.exe
  C:\Windows\System\EEEPVvl.exe
  2⤵
  PID:4612
- C:\Windows\System\wAUHwCY.exe
  C:\Windows\System\wAUHwCY.exe
  2⤵
  PID:4632
- C:\Windows\System\myGuuvU.exe
  C:\Windows\System\myGuuvU.exe
  2⤵
  PID:4652
- C:\Windows\System\LgRkTDp.exe
  C:\Windows\System\LgRkTDp.exe
  2⤵
  PID:4672
- C:\Windows\System\doYZHQb.exe
  C:\Windows\System\doYZHQb.exe
  2⤵
  PID:4692
- C:\Windows\System\lmXwjPE.exe
  C:\Windows\System\lmXwjPE.exe
  2⤵
  PID:4712
- C:\Windows\System\ueZKnSw.exe
  C:\Windows\System\ueZKnSw.exe
  2⤵
  PID:4732
- C:\Windows\System\HmhbXlk.exe
  C:\Windows\System\HmhbXlk.exe
  2⤵
  PID:4752
- C:\Windows\System\rlBMmpN.exe
  C:\Windows\System\rlBMmpN.exe
  2⤵
  PID:4772
- C:\Windows\System\ZhHyrLJ.exe
  C:\Windows\System\ZhHyrLJ.exe
  2⤵
  PID:4792
- C:\Windows\System\cQPTBVA.exe
  C:\Windows\System\cQPTBVA.exe
  2⤵
  PID:4812
- C:\Windows\System\pSnibks.exe
  C:\Windows\System\pSnibks.exe
  2⤵
  PID:4832
- C:\Windows\System\bZVELCL.exe
  C:\Windows\System\bZVELCL.exe
  2⤵
  PID:4848
- C:\Windows\System\mORjxIs.exe
  C:\Windows\System\mORjxIs.exe
  2⤵
  PID:4868
- C:\Windows\System\DGIZGQL.exe
  C:\Windows\System\DGIZGQL.exe
  2⤵
  PID:4888
- C:\Windows\System\TSoesOp.exe
  C:\Windows\System\TSoesOp.exe
  2⤵
  PID:4908
- C:\Windows\System\frTAHur.exe
  C:\Windows\System\frTAHur.exe
  2⤵
  PID:4928
- C:\Windows\System\PxnsqSL.exe
  C:\Windows\System\PxnsqSL.exe
  2⤵
  PID:4948
- C:\Windows\System\FlQRhRg.exe
  C:\Windows\System\FlQRhRg.exe
  2⤵
  PID:4968
- C:\Windows\System\DMzpzjU.exe
  C:\Windows\System\DMzpzjU.exe
  2⤵
  PID:4988
- C:\Windows\System\uOoKvoD.exe
  C:\Windows\System\uOoKvoD.exe
  2⤵
  PID:5008
- C:\Windows\System\zexCqXI.exe
  C:\Windows\System\zexCqXI.exe
  2⤵
  PID:5028
- C:\Windows\System\gGGaDfa.exe
  C:\Windows\System\gGGaDfa.exe
  2⤵
  PID:5048
- C:\Windows\System\UMhqxGG.exe
  C:\Windows\System\UMhqxGG.exe
  2⤵
  PID:5068
- C:\Windows\System\dhoWSpj.exe
  C:\Windows\System\dhoWSpj.exe
  2⤵
  PID:5088
- C:\Windows\System\SLzPDsB.exe
  C:\Windows\System\SLzPDsB.exe
  2⤵
  PID:5108
- C:\Windows\System\XCekzAj.exe
  C:\Windows\System\XCekzAj.exe
  2⤵
  PID:3720
- C:\Windows\System\nrPvbhf.exe
  C:\Windows\System\nrPvbhf.exe
  2⤵
  PID:3660
- C:\Windows\System\cxuDtRQ.exe
  C:\Windows\System\cxuDtRQ.exe
  2⤵
  PID:3868
- C:\Windows\System\AtxUvHi.exe
  C:\Windows\System\AtxUvHi.exe
  2⤵
  PID:4016
- C:\Windows\System\WvadsrN.exe
  C:\Windows\System\WvadsrN.exe
  2⤵
  PID:3136
- C:\Windows\System\jgouTgJ.exe
  C:\Windows\System\jgouTgJ.exe
  2⤵
  PID:1520
- C:\Windows\System\HYyBqac.exe
  C:\Windows\System\HYyBqac.exe
  2⤵
  PID:3416
- C:\Windows\System\MoBqQPo.exe
  C:\Windows\System\MoBqQPo.exe
  2⤵
  PID:4108
- C:\Windows\System\MemBgtE.exe
  C:\Windows\System\MemBgtE.exe
  2⤵
  PID:1660
- C:\Windows\System\KzYxMrz.exe
  C:\Windows\System\KzYxMrz.exe
  2⤵
  PID:4128
- C:\Windows\System\JyTOnMT.exe
  C:\Windows\System\JyTOnMT.exe
  2⤵
  PID:4184
- C:\Windows\System\zpbqwgT.exe
  C:\Windows\System\zpbqwgT.exe
  2⤵
  PID:4224
- C:\Windows\System\fkzvLHy.exe
  C:\Windows\System\fkzvLHy.exe
  2⤵
  PID:4268
- C:\Windows\System\ALcRMBy.exe
  C:\Windows\System\ALcRMBy.exe
  2⤵
  PID:4280
- C:\Windows\System\MVtRsOy.exe
  C:\Windows\System\MVtRsOy.exe
  2⤵
  PID:4340
- C:\Windows\System\SOfvMPJ.exe
  C:\Windows\System\SOfvMPJ.exe
  2⤵
  PID:4348
- C:\Windows\System\TesOyzT.exe
  C:\Windows\System\TesOyzT.exe
  2⤵
  PID:2436
- C:\Windows\System\qhWoxKo.exe
  C:\Windows\System\qhWoxKo.exe
  2⤵
  PID:4368
- C:\Windows\System\Ljnvssf.exe
  C:\Windows\System\Ljnvssf.exe
  2⤵
  PID:4400
- C:\Windows\System\wxtTdbj.exe
  C:\Windows\System\wxtTdbj.exe
  2⤵
  PID:4460
- C:\Windows\System\vBrFJre.exe
  C:\Windows\System\vBrFJre.exe
  2⤵
  PID:4444
- C:\Windows\System\THKVpbE.exe
  C:\Windows\System\THKVpbE.exe
  2⤵
  PID:4484
- C:\Windows\System\Xywazhu.exe
  C:\Windows\System\Xywazhu.exe
  2⤵
  PID:4540
- C:\Windows\System\Gxdqutz.exe
  C:\Windows\System\Gxdqutz.exe
  2⤵
  PID:4580
- C:\Windows\System\hdrKgNH.exe
  C:\Windows\System\hdrKgNH.exe
  2⤵
  PID:4604
- C:\Windows\System\NugBaYN.exe
  C:\Windows\System\NugBaYN.exe
  2⤵
  PID:4660
- C:\Windows\System\AaJnEwO.exe
  C:\Windows\System\AaJnEwO.exe
  2⤵
  PID:4704
- C:\Windows\System\LOeRAWU.exe
  C:\Windows\System\LOeRAWU.exe
  2⤵
  PID:4784
- C:\Windows\System\kBQQZyn.exe
  C:\Windows\System\kBQQZyn.exe
  2⤵
  PID:4684
- C:\Windows\System\YChiYpN.exe
  C:\Windows\System\YChiYpN.exe
  2⤵
  PID:4820
- C:\Windows\System\vtTEzFt.exe
  C:\Windows\System\vtTEzFt.exe
  2⤵
  PID:4760
- C:\Windows\System\aTKSVAF.exe
  C:\Windows\System\aTKSVAF.exe
  2⤵
  PID:4864
- C:\Windows\System\kOVuAdR.exe
  C:\Windows\System\kOVuAdR.exe
  2⤵
  PID:4804
- C:\Windows\System\saRdUdm.exe
  C:\Windows\System\saRdUdm.exe
  2⤵
  PID:4944
- C:\Windows\System\JGtLNSK.exe
  C:\Windows\System\JGtLNSK.exe
  2⤵
  PID:4980
- C:\Windows\System\CplrqBt.exe
  C:\Windows\System\CplrqBt.exe
  2⤵
  PID:4880
- C:\Windows\System\IpBarDk.exe
  C:\Windows\System\IpBarDk.exe
  2⤵
  PID:4916
- C:\Windows\System\MawFcbG.exe
  C:\Windows\System\MawFcbG.exe
  2⤵
  PID:5060
- C:\Windows\System\ZXrnWjn.exe
  C:\Windows\System\ZXrnWjn.exe
  2⤵
  PID:5104
- C:\Windows\System\vRfomdM.exe
  C:\Windows\System\vRfomdM.exe
  2⤵
  PID:5004
- C:\Windows\System\xpHrmut.exe
  C:\Windows\System\xpHrmut.exe
  2⤵
  PID:3692
- C:\Windows\System\srvYUKz.exe
  C:\Windows\System\srvYUKz.exe
  2⤵
  PID:2716
- C:\Windows\System\CxrwqgR.exe
  C:\Windows\System\CxrwqgR.exe
  2⤵
  PID:5116
- C:\Windows\System\ObKXnGd.exe
  C:\Windows\System\ObKXnGd.exe
  2⤵
  PID:4040
- C:\Windows\System\SbmuSGY.exe
  C:\Windows\System\SbmuSGY.exe
  2⤵
  PID:3996
- C:\Windows\System\aOrkDlF.exe
  C:\Windows\System\aOrkDlF.exe
  2⤵
  PID:1532
- C:\Windows\System\oUhdFac.exe
  C:\Windows\System\oUhdFac.exe
  2⤵
  PID:2768
- C:\Windows\System\BHzohNf.exe
  C:\Windows\System\BHzohNf.exe
  2⤵
  PID:4100
- C:\Windows\System\OfiMTFD.exe
  C:\Windows\System\OfiMTFD.exe
  2⤵
  PID:4148
- C:\Windows\System\yHtejzM.exe
  C:\Windows\System\yHtejzM.exe
  2⤵
  PID:3044
- C:\Windows\System\pDQMoVo.exe
  C:\Windows\System\pDQMoVo.exe
  2⤵
  PID:4228
- C:\Windows\System\ckVVwFO.exe
  C:\Windows\System\ckVVwFO.exe
  2⤵
  PID:1484
- C:\Windows\System\NalJaMc.exe
  C:\Windows\System\NalJaMc.exe
  2⤵
  PID:1864
- C:\Windows\System\RdYetTf.exe
  C:\Windows\System\RdYetTf.exe
  2⤵
  PID:4360
- C:\Windows\System\niqoCAG.exe
  C:\Windows\System\niqoCAG.exe
  2⤵
  PID:4420
- C:\Windows\System\JAnYTjI.exe
  C:\Windows\System\JAnYTjI.exe
  2⤵
  PID:4508
- C:\Windows\System\jWhABKx.exe
  C:\Windows\System\jWhABKx.exe
  2⤵
  PID:4440
- C:\Windows\System\aLoJPay.exe
  C:\Windows\System\aLoJPay.exe
  2⤵
  PID:4576
- C:\Windows\System\qlnbxEp.exe
  C:\Windows\System\qlnbxEp.exe
  2⤵
  PID:4548
- C:\Windows\System\XPgNqUN.exe
  C:\Windows\System\XPgNqUN.exe
  2⤵
  PID:4596
- C:\Windows\System\dbbxgMO.exe
  C:\Windows\System\dbbxgMO.exe
  2⤵
  PID:4780
- C:\Windows\System\wkafbSF.exe
  C:\Windows\System\wkafbSF.exe
  2⤵
  PID:1972
- C:\Windows\System\yksRdeA.exe
  C:\Windows\System\yksRdeA.exe
  2⤵
  PID:4720
- C:\Windows\System\TgUamrg.exe
  C:\Windows\System\TgUamrg.exe
  2⤵
  PID:2076
- C:\Windows\System\TvQKTEu.exe
  C:\Windows\System\TvQKTEu.exe
  2⤵
  PID:2888
- C:\Windows\System\ZHYGRtz.exe
  C:\Windows\System\ZHYGRtz.exe
  2⤵
  PID:4860
- C:\Windows\System\JCmWeZe.exe
  C:\Windows\System\JCmWeZe.exe
  2⤵
  PID:1624
- C:\Windows\System\VkbDfPL.exe
  C:\Windows\System\VkbDfPL.exe
  2⤵
  PID:2548
- C:\Windows\System\CZFYyTE.exe
  C:\Windows\System\CZFYyTE.exe
  2⤵
  PID:4900
- C:\Windows\System\hGZyojx.exe
  C:\Windows\System\hGZyojx.exe
  2⤵
  PID:4800
- C:\Windows\System\TczPHll.exe
  C:\Windows\System\TczPHll.exe
  2⤵
  PID:1328
- C:\Windows\System\vrkbPLk.exe
  C:\Windows\System\vrkbPLk.exe
  2⤵
  PID:2440
- C:\Windows\System\fMORJgV.exe
  C:\Windows\System\fMORJgV.exe
  2⤵
  PID:844
- C:\Windows\System\VUvQVJw.exe
  C:\Windows\System\VUvQVJw.exe
  2⤵
  PID:2428
- C:\Windows\System\kRrGVHi.exe
  C:\Windows\System\kRrGVHi.exe
  2⤵
  PID:4956
- C:\Windows\System\jDUYMye.exe
  C:\Windows\System\jDUYMye.exe
  2⤵
  PID:324
- C:\Windows\System\UuhcorX.exe
  C:\Windows\System\UuhcorX.exe
  2⤵
  PID:5096
- C:\Windows\System\KKtdFxr.exe
  C:\Windows\System\KKtdFxr.exe
  2⤵
  PID:4208
- C:\Windows\System\ivkaZYa.exe
  C:\Windows\System\ivkaZYa.exe
  2⤵
  PID:4240
- C:\Windows\System\AhcolPJ.exe
  C:\Windows\System\AhcolPJ.exe
  2⤵
  PID:4124
- C:\Windows\System\sSsoLlk.exe
  C:\Windows\System\sSsoLlk.exe
  2⤵
  PID:5084
- C:\Windows\System\UCMRYHQ.exe
  C:\Windows\System\UCMRYHQ.exe
  2⤵
  PID:4628
- C:\Windows\System\edgHDDV.exe
  C:\Windows\System\edgHDDV.exe
  2⤵
  PID:4160
- C:\Windows\System\LLVuPNa.exe
  C:\Windows\System\LLVuPNa.exe
  2⤵
  PID:4764
- C:\Windows\System\NHuBFWh.exe
  C:\Windows\System\NHuBFWh.exe
  2⤵
  PID:4608
- C:\Windows\System\fvnLSig.exe
  C:\Windows\System\fvnLSig.exe
  2⤵
  PID:684
- C:\Windows\System\CbVkOTs.exe
  C:\Windows\System\CbVkOTs.exe
  2⤵
  PID:4200
- C:\Windows\System\gbnGQCw.exe
  C:\Windows\System\gbnGQCw.exe
  2⤵
  PID:1540
- C:\Windows\System\bFDlNmI.exe
  C:\Windows\System\bFDlNmI.exe
  2⤵
  PID:4464
- C:\Windows\System\EnnQrBr.exe
  C:\Windows\System\EnnQrBr.exe
  2⤵
  PID:4320
- C:\Windows\System\SmpFFWt.exe
  C:\Windows\System\SmpFFWt.exe
  2⤵
  PID:2228
- C:\Windows\System\eVzrYGw.exe
  C:\Windows\System\eVzrYGw.exe
  2⤵
  PID:3236
- C:\Windows\System\CiEEVsL.exe
  C:\Windows\System\CiEEVsL.exe
  2⤵
  PID:4140
- C:\Windows\System\IVBbusc.exe
  C:\Windows\System\IVBbusc.exe
  2⤵
  PID:4936
- C:\Windows\System\NdrPIXi.exe
  C:\Windows\System\NdrPIXi.exe
  2⤵
  PID:576
- C:\Windows\System\ZCtqbtm.exe
  C:\Windows\System\ZCtqbtm.exe
  2⤵
  PID:4744
- C:\Windows\System\mncewfy.exe
  C:\Windows\System\mncewfy.exe
  2⤵
  PID:4844
- C:\Windows\System\feiqIvG.exe
  C:\Windows\System\feiqIvG.exe
  2⤵
  PID:1524
- C:\Windows\System\GWfyAqA.exe
  C:\Windows\System\GWfyAqA.exe
  2⤵
  PID:1784
- C:\Windows\System\tAqrQGy.exe
  C:\Windows\System\tAqrQGy.exe
  2⤵
  PID:4600
- C:\Windows\System\jSmcBmt.exe
  C:\Windows\System\jSmcBmt.exe
  2⤵
  PID:4244
- C:\Windows\System\AKyqERJ.exe
  C:\Windows\System\AKyqERJ.exe
  2⤵
  PID:1344
- C:\Windows\System\slWPahv.exe
  C:\Windows\System\slWPahv.exe
  2⤵
  PID:2968
- C:\Windows\System\GLYUCsA.exe
  C:\Windows\System\GLYUCsA.exe
  2⤵
  PID:1504
- C:\Windows\System\FembZNO.exe
  C:\Windows\System\FembZNO.exe
  2⤵
  PID:5036
- C:\Windows\System\TOHhuUX.exe
  C:\Windows\System\TOHhuUX.exe
  2⤵
  PID:4384
- C:\Windows\System\ccURDwy.exe
  C:\Windows\System\ccURDwy.exe
  2⤵
  PID:4644
- C:\Windows\System\tsxAUXL.exe
  C:\Windows\System\tsxAUXL.exe
  2⤵
  PID:4188
- C:\Windows\System\QtfSqjy.exe
  C:\Windows\System\QtfSqjy.exe
  2⤵
  PID:2564
- C:\Windows\System\dgXoSxB.exe
  C:\Windows\System\dgXoSxB.exe
  2⤵
  PID:2264
- C:\Windows\System\zaYootx.exe
  C:\Windows\System\zaYootx.exe
  2⤵
  PID:4728
- C:\Windows\System\DmdWmyM.exe
  C:\Windows\System\DmdWmyM.exe
  2⤵
  PID:1008
- C:\Windows\System\pTaHbSd.exe
  C:\Windows\System\pTaHbSd.exe
  2⤵
  PID:1800
- C:\Windows\System\dpjssZt.exe
  C:\Windows\System\dpjssZt.exe
  2⤵
  PID:4808
- C:\Windows\System\EYsARZB.exe
  C:\Windows\System\EYsARZB.exe
  2⤵
  PID:5136
- C:\Windows\System\sONsEUT.exe
  C:\Windows\System\sONsEUT.exe
  2⤵
  PID:5156
- C:\Windows\System\rPSjzxl.exe
  C:\Windows\System\rPSjzxl.exe
  2⤵
  PID:5176
- C:\Windows\System\nedlQAV.exe
  C:\Windows\System\nedlQAV.exe
  2⤵
  PID:5196
- C:\Windows\System\QsUhOtz.exe
  C:\Windows\System\QsUhOtz.exe
  2⤵
  PID:5216
- C:\Windows\System\vZxfGrd.exe
  C:\Windows\System\vZxfGrd.exe
  2⤵
  PID:5232
- C:\Windows\System\WCFfkuP.exe
  C:\Windows\System\WCFfkuP.exe
  2⤵
  PID:5252
- C:\Windows\System\HiJaFmD.exe
  C:\Windows\System\HiJaFmD.exe
  2⤵
  PID:5272
- C:\Windows\System\Wubqdxy.exe
  C:\Windows\System\Wubqdxy.exe
  2⤵
  PID:5292
- C:\Windows\System\NISZCIs.exe
  C:\Windows\System\NISZCIs.exe
  2⤵
  PID:5356
- C:\Windows\System\VsPhyDr.exe
  C:\Windows\System\VsPhyDr.exe
  2⤵
  PID:5372
- C:\Windows\System\RqgzDZd.exe
  C:\Windows\System\RqgzDZd.exe
  2⤵
  PID:5388
- C:\Windows\System\VgxUQYW.exe
  C:\Windows\System\VgxUQYW.exe
  2⤵
  PID:5404
- C:\Windows\System\YMcTbKT.exe
  C:\Windows\System\YMcTbKT.exe
  2⤵
  PID:5424
- C:\Windows\System\nFDfqEk.exe
  C:\Windows\System\nFDfqEk.exe
  2⤵
  PID:5448
- C:\Windows\System\ecxvMYL.exe
  C:\Windows\System\ecxvMYL.exe
  2⤵
  PID:5476
- C:\Windows\System\Pxmwyhc.exe
  C:\Windows\System\Pxmwyhc.exe
  2⤵
  PID:5492
- C:\Windows\System\dKgkzKc.exe
  C:\Windows\System\dKgkzKc.exe
  2⤵
  PID:5520
- C:\Windows\System\oEkgwlU.exe
  C:\Windows\System\oEkgwlU.exe
  2⤵
  PID:5540
- C:\Windows\System\DLwVUXB.exe
  C:\Windows\System\DLwVUXB.exe
  2⤵
  PID:5556
- C:\Windows\System\SRvSAiA.exe
  C:\Windows\System\SRvSAiA.exe
  2⤵
  PID:5576
- C:\Windows\System\Kpgbkuk.exe
  C:\Windows\System\Kpgbkuk.exe
  2⤵
  PID:5604
- C:\Windows\System\HMAZmwV.exe
  C:\Windows\System\HMAZmwV.exe
  2⤵
  PID:5620
- C:\Windows\System\HFJQXyT.exe
  C:\Windows\System\HFJQXyT.exe
  2⤵
  PID:5636
- C:\Windows\System\olUtWpd.exe
  C:\Windows\System\olUtWpd.exe
  2⤵
  PID:5656
- C:\Windows\System\GvQXKaD.exe
  C:\Windows\System\GvQXKaD.exe
  2⤵
  PID:5676
- C:\Windows\System\rQyZWSS.exe
  C:\Windows\System\rQyZWSS.exe
  2⤵
  PID:5692
- C:\Windows\System\qvkQpeD.exe
  C:\Windows\System\qvkQpeD.exe
  2⤵
  PID:5708
- C:\Windows\System\rBgeSFM.exe
  C:\Windows\System\rBgeSFM.exe
  2⤵
  PID:5724
- C:\Windows\System\AOjzZmA.exe
  C:\Windows\System\AOjzZmA.exe
  2⤵
  PID:5744
- C:\Windows\System\FjBtWPI.exe
  C:\Windows\System\FjBtWPI.exe
  2⤵
  PID:5760
- C:\Windows\System\JHqLXxG.exe
  C:\Windows\System\JHqLXxG.exe
  2⤵
  PID:5780
- C:\Windows\System\gxfyJiF.exe
  C:\Windows\System\gxfyJiF.exe
  2⤵
  PID:5800
- C:\Windows\System\ttpipmk.exe
  C:\Windows\System\ttpipmk.exe
  2⤵
  PID:5816
- C:\Windows\System\euFpTKZ.exe
  C:\Windows\System\euFpTKZ.exe
  2⤵
  PID:5832
- C:\Windows\System\HCJUoBQ.exe
  C:\Windows\System\HCJUoBQ.exe
  2⤵
  PID:5860
- C:\Windows\System\bbdDuvb.exe
  C:\Windows\System\bbdDuvb.exe
  2⤵
  PID:5880
- C:\Windows\System\uTjpJGk.exe
  C:\Windows\System\uTjpJGk.exe
  2⤵
  PID:5900
- C:\Windows\System\CYFbdOd.exe
  C:\Windows\System\CYFbdOd.exe
  2⤵
  PID:5920
- C:\Windows\System\lYqYMYy.exe
  C:\Windows\System\lYqYMYy.exe
  2⤵
  PID:5936
- C:\Windows\System\YcuGAEo.exe
  C:\Windows\System\YcuGAEo.exe
  2⤵
  PID:5952
- C:\Windows\System\YtLCgZi.exe
  C:\Windows\System\YtLCgZi.exe
  2⤵
  PID:6000
- C:\Windows\System\wHcNtsx.exe
  C:\Windows\System\wHcNtsx.exe
  2⤵
  PID:6020
- C:\Windows\System\NTqPQMT.exe
  C:\Windows\System\NTqPQMT.exe
  2⤵
  PID:6040
- C:\Windows\System\Zogktjp.exe
  C:\Windows\System\Zogktjp.exe
  2⤵
  PID:6056
- C:\Windows\System\dGNtcLP.exe
  C:\Windows\System\dGNtcLP.exe
  2⤵
  PID:6080
- C:\Windows\System\ajhRmJl.exe
  C:\Windows\System\ajhRmJl.exe
  2⤵
  PID:6100
- C:\Windows\System\inbbJnT.exe
  C:\Windows\System\inbbJnT.exe
  2⤵
  PID:6120
- C:\Windows\System\oEfDdWS.exe
  C:\Windows\System\oEfDdWS.exe
  2⤵
  PID:6136
- C:\Windows\System\TjLLjGJ.exe
  C:\Windows\System\TjLLjGJ.exe
  2⤵
  PID:1048
- C:\Windows\System\wiuyLHQ.exe
  C:\Windows\System\wiuyLHQ.exe
  2⤵
  PID:4120
- C:\Windows\System\VTmbIau.exe
  C:\Windows\System\VTmbIau.exe
  2⤵
  PID:4840
- C:\Windows\System\ywAZERt.exe
  C:\Windows\System\ywAZERt.exe
  2⤵
  PID:5172
- C:\Windows\System\JkPgFsc.exe
  C:\Windows\System\JkPgFsc.exe
  2⤵
  PID:5240
- C:\Windows\System\FdHiHJG.exe
  C:\Windows\System\FdHiHJG.exe
  2⤵
  PID:5284
- C:\Windows\System\shATBgx.exe
  C:\Windows\System\shATBgx.exe
  2⤵
  PID:2208
- C:\Windows\System\maLyvdT.exe
  C:\Windows\System\maLyvdT.exe
  2⤵
  PID:2256
- C:\Windows\System\YZLdpXH.exe
  C:\Windows\System\YZLdpXH.exe
  2⤵
  PID:5148
- C:\Windows\System\dbMRmHt.exe
  C:\Windows\System\dbMRmHt.exe
  2⤵
  PID:5188
- C:\Windows\System\lUVOnqZ.exe
  C:\Windows\System\lUVOnqZ.exe
  2⤵
  PID:5344
- C:\Windows\System\llLzgrc.exe
  C:\Windows\System\llLzgrc.exe
  2⤵
  PID:4524
- C:\Windows\System\kwhKZQc.exe
  C:\Windows\System\kwhKZQc.exe
  2⤵
  PID:5316
- C:\Windows\System\EGEyZer.exe
  C:\Windows\System\EGEyZer.exe
  2⤵
  PID:5396
- C:\Windows\System\nWtnNUk.exe
  C:\Windows\System\nWtnNUk.exe
  2⤵
  PID:5412
- C:\Windows\System\bzmOsMK.exe
  C:\Windows\System\bzmOsMK.exe
  2⤵
  PID:5440
- C:\Windows\System\kAJoJNB.exe
  C:\Windows\System\kAJoJNB.exe
  2⤵
  PID:5584
- C:\Windows\System\jIfyNdt.exe
  C:\Windows\System\jIfyNdt.exe
  2⤵
  PID:5588
- C:\Windows\System\NucAWSu.exe
  C:\Windows\System\NucAWSu.exe
  2⤵
  PID:5648
- C:\Windows\System\VXiPTcI.exe
  C:\Windows\System\VXiPTcI.exe
  2⤵
  PID:5720
- C:\Windows\System\ytsaNXt.exe
  C:\Windows\System\ytsaNXt.exe
  2⤵
  PID:5792
- C:\Windows\System\xMWBJqA.exe
  C:\Windows\System\xMWBJqA.exe
  2⤵
  PID:5592
- C:\Windows\System\rNZpKpB.exe
  C:\Windows\System\rNZpKpB.exe
  2⤵
  PID:5668
- C:\Windows\System\upNpXFP.exe
  C:\Windows\System\upNpXFP.exe
  2⤵
  PID:5768
- C:\Windows\System\iakfeqJ.exe
  C:\Windows\System\iakfeqJ.exe
  2⤵
  PID:5840
- C:\Windows\System\vdzrNwW.exe
  C:\Windows\System\vdzrNwW.exe
  2⤵
  PID:5892
- C:\Windows\System\CPYXJJr.exe
  C:\Windows\System\CPYXJJr.exe
  2⤵
  PID:5700
- C:\Windows\System\GrEtchi.exe
  C:\Windows\System\GrEtchi.exe
  2⤵
  PID:5872
- C:\Windows\System\WVJgHuO.exe
  C:\Windows\System\WVJgHuO.exe
  2⤵
  PID:5944
- C:\Windows\System\tJJDvdi.exe
  C:\Windows\System\tJJDvdi.exe
  2⤵
  PID:5532
- C:\Windows\System\mEyBghS.exe
  C:\Windows\System\mEyBghS.exe
  2⤵
  PID:6096
- C:\Windows\System\ufFKNxe.exe
  C:\Windows\System\ufFKNxe.exe
  2⤵
  PID:5984
- C:\Windows\System\MNsxQzw.exe
  C:\Windows\System\MNsxQzw.exe
  2⤵
  PID:4288
- C:\Windows\System\oSiWTpW.exe
  C:\Windows\System\oSiWTpW.exe
  2⤵
  PID:5164
- C:\Windows\System\yCkvTWg.exe
  C:\Windows\System\yCkvTWg.exe
  2⤵
  PID:5328
- C:\Windows\System\zufLKKJ.exe
  C:\Windows\System\zufLKKJ.exe
  2⤵
  PID:5268
- C:\Windows\System\qlFmgVM.exe
  C:\Windows\System\qlFmgVM.exe
  2⤵
  PID:5420
- C:\Windows\System\cKXTFnZ.exe
  C:\Windows\System\cKXTFnZ.exe
  2⤵
  PID:6032
- C:\Windows\System\oCPtWZc.exe
  C:\Windows\System\oCPtWZc.exe
  2⤵
  PID:6108
- C:\Windows\System\ZXEoVMg.exe
  C:\Windows\System\ZXEoVMg.exe
  2⤵
  PID:1876
- C:\Windows\System\nmgLXYC.exe
  C:\Windows\System\nmgLXYC.exe
  2⤵
  PID:4380
- C:\Windows\System\aqOExeC.exe
  C:\Windows\System\aqOExeC.exe
  2⤵
  PID:3696
- C:\Windows\System\SixDXKn.exe
  C:\Windows\System\SixDXKn.exe
  2⤵
  PID:5336
- C:\Windows\System\usiiQHU.exe
  C:\Windows\System\usiiQHU.exe
  2⤵
  PID:5264
- C:\Windows\System\MxPlAqe.exe
  C:\Windows\System\MxPlAqe.exe
  2⤵
  PID:5380
- C:\Windows\System\yDQNklb.exe
  C:\Windows\System\yDQNklb.exe
  2⤵
  PID:5504
- C:\Windows\System\AtPuXGi.exe
  C:\Windows\System\AtPuXGi.exe
  2⤵
  PID:5552
- C:\Windows\System\YrUkBla.exe
  C:\Windows\System\YrUkBla.exe
  2⤵
  PID:5736
- C:\Windows\System\RjheUUK.exe
  C:\Windows\System\RjheUUK.exe
  2⤵
  PID:5852
- C:\Windows\System\JgUrxtM.exe
  C:\Windows\System\JgUrxtM.exe
  2⤵
  PID:5960
- C:\Windows\System\QuJkGhI.exe
  C:\Windows\System\QuJkGhI.exe
  2⤵
  PID:5972
- C:\Windows\System\XkZwngQ.exe
  C:\Windows\System\XkZwngQ.exe
  2⤵
  PID:5704
- C:\Windows\System\hCZjhCt.exe
  C:\Windows\System\hCZjhCt.exe
  2⤵
  PID:5340
- C:\Windows\System\KlRsgfi.exe
  C:\Windows\System\KlRsgfi.exe
  2⤵
  PID:6028
- C:\Windows\System\AVYFyyr.exe
  C:\Windows\System\AVYFyyr.exe
  2⤵
  PID:5756
- C:\Windows\System\LsAiGLr.exe
  C:\Windows\System\LsAiGLr.exe
  2⤵
  PID:5776
- C:\Windows\System\ooXutKR.exe
  C:\Windows\System\ooXutKR.exe
  2⤵
  PID:5212
- C:\Windows\System\bkLLOSx.exe
  C:\Windows\System\bkLLOSx.exe
  2⤵
  PID:5824
- C:\Windows\System\aehqsQC.exe
  C:\Windows\System\aehqsQC.exe
  2⤵
  PID:5980
- C:\Windows\System\oITxbQK.exe
  C:\Windows\System\oITxbQK.exe
  2⤵
  PID:5996
- C:\Windows\System\ZtrfvYc.exe
  C:\Windows\System\ZtrfvYc.exe
  2⤵
  PID:5500
- C:\Windows\System\JQjXevZ.exe
  C:\Windows\System\JQjXevZ.exe
  2⤵
  PID:6048
- C:\Windows\System\DTnSPBb.exe
  C:\Windows\System\DTnSPBb.exe
  2⤵
  PID:5992
- C:\Windows\System\nVQIBnz.exe
  C:\Windows\System\nVQIBnz.exe
  2⤵
  PID:5912
- C:\Windows\System\XGseasZ.exe
  C:\Windows\System\XGseasZ.exe
  2⤵
  PID:5888
- C:\Windows\System\gPTeSiN.exe
  C:\Windows\System\gPTeSiN.exe
  2⤵
  PID:5484
- C:\Windows\System\iQDrinA.exe
  C:\Windows\System\iQDrinA.exe
  2⤵
  PID:6156
- C:\Windows\System\mrqcGgs.exe
  C:\Windows\System\mrqcGgs.exe
  2⤵
  PID:6176
- C:\Windows\System\lMTHaDz.exe
  C:\Windows\System\lMTHaDz.exe
  2⤵
  PID:6196
- C:\Windows\System\evhwTwK.exe
  C:\Windows\System\evhwTwK.exe
  2⤵
  PID:6212
- C:\Windows\System\YcQLEaQ.exe
  C:\Windows\System\YcQLEaQ.exe
  2⤵
  PID:6236
- C:\Windows\System\dBjCWhM.exe
  C:\Windows\System\dBjCWhM.exe
  2⤵
  PID:6256
- C:\Windows\System\QmUrQgt.exe
  C:\Windows\System\QmUrQgt.exe
  2⤵
  PID:6272
- C:\Windows\System\xVpgPFb.exe
  C:\Windows\System\xVpgPFb.exe
  2⤵
  PID:6288
- C:\Windows\System\NuEUqbE.exe
  C:\Windows\System\NuEUqbE.exe
  2⤵
  PID:6304
- C:\Windows\System\abOEYKU.exe
  C:\Windows\System\abOEYKU.exe
  2⤵
  PID:6328
- C:\Windows\System\XZeSnFF.exe
  C:\Windows\System\XZeSnFF.exe
  2⤵
  PID:6344
- C:\Windows\System\kHcUruc.exe
  C:\Windows\System\kHcUruc.exe
  2⤵
  PID:6364
- C:\Windows\System\wPeXPel.exe
  C:\Windows\System\wPeXPel.exe
  2⤵
  PID:6388
- C:\Windows\System\TYGYerO.exe
  C:\Windows\System\TYGYerO.exe
  2⤵
  PID:6416
- C:\Windows\System\xyZlbJI.exe
  C:\Windows\System\xyZlbJI.exe
  2⤵
  PID:6432
- C:\Windows\System\hkfanLm.exe
  C:\Windows\System\hkfanLm.exe
  2⤵
  PID:6448
- C:\Windows\System\lnRhzLo.exe
  C:\Windows\System\lnRhzLo.exe
  2⤵
  PID:6464
- C:\Windows\System\kaUqQRU.exe
  C:\Windows\System\kaUqQRU.exe
  2⤵
  PID:6480
- C:\Windows\System\xXMfaQu.exe
  C:\Windows\System\xXMfaQu.exe
  2⤵
  PID:6500
- C:\Windows\System\JsYWdPY.exe
  C:\Windows\System\JsYWdPY.exe
  2⤵
  PID:6520
- C:\Windows\System\KwxtMFo.exe
  C:\Windows\System\KwxtMFo.exe
  2⤵
  PID:6536
- C:\Windows\System\POUWtKo.exe
  C:\Windows\System\POUWtKo.exe
  2⤵
  PID:6556
- C:\Windows\System\pzCeYhj.exe
  C:\Windows\System\pzCeYhj.exe
  2⤵
  PID:6576
- C:\Windows\System\YCGJMYO.exe
  C:\Windows\System\YCGJMYO.exe
  2⤵
  PID:6592
- C:\Windows\System\HxqKnMq.exe
  C:\Windows\System\HxqKnMq.exe
  2⤵
  PID:6608
- C:\Windows\System\jnQfUIo.exe
  C:\Windows\System\jnQfUIo.exe
  2⤵
  PID:6624
- C:\Windows\System\RNzrxmc.exe
  C:\Windows\System\RNzrxmc.exe
  2⤵
  PID:6644
- C:\Windows\System\LgYfXhX.exe
  C:\Windows\System\LgYfXhX.exe
  2⤵
  PID:6664
- C:\Windows\System\wYiEocC.exe
  C:\Windows\System\wYiEocC.exe
  2⤵
  PID:6680
- C:\Windows\System\BydKCer.exe
  C:\Windows\System\BydKCer.exe
  2⤵
  PID:6696
- C:\Windows\System\ywRkWRx.exe
  C:\Windows\System\ywRkWRx.exe
  2⤵
  PID:6716
- C:\Windows\System\ANQMSfu.exe
  C:\Windows\System\ANQMSfu.exe
  2⤵
  PID:6732
- C:\Windows\System\NLudMtY.exe
  C:\Windows\System\NLudMtY.exe
  2⤵
  PID:6752
- C:\Windows\System\brHgYDn.exe
  C:\Windows\System\brHgYDn.exe
  2⤵
  PID:6772
- C:\Windows\System\XHEZzZb.exe
  C:\Windows\System\XHEZzZb.exe
  2⤵
  PID:6872
- C:\Windows\System\ZLUtGvg.exe
  C:\Windows\System\ZLUtGvg.exe
  2⤵
  PID:6888
- C:\Windows\System\YTNnCyK.exe
  C:\Windows\System\YTNnCyK.exe
  2⤵
  PID:6904
- C:\Windows\System\mwppbeT.exe
  C:\Windows\System\mwppbeT.exe
  2⤵
  PID:6920
- C:\Windows\System\HVgQiBD.exe
  C:\Windows\System\HVgQiBD.exe
  2⤵
  PID:6936
- C:\Windows\System\aoPQUBo.exe
  C:\Windows\System\aoPQUBo.exe
  2⤵
  PID:6956
- C:\Windows\System\LXPYQrm.exe
  C:\Windows\System\LXPYQrm.exe
  2⤵
  PID:6980
- C:\Windows\System\gjtfjIE.exe
  C:\Windows\System\gjtfjIE.exe
  2⤵
  PID:7004
- C:\Windows\System\deButWg.exe
  C:\Windows\System\deButWg.exe
  2⤵
  PID:7020
- C:\Windows\System\QVEJRsj.exe
  C:\Windows\System\QVEJRsj.exe
  2⤵
  PID:7040
- C:\Windows\System\umgTjQw.exe
  C:\Windows\System\umgTjQw.exe
  2⤵
  PID:7064
- C:\Windows\System\oDXNcZi.exe
  C:\Windows\System\oDXNcZi.exe
  2⤵
  PID:7084
- C:\Windows\System\ARgUgcD.exe
  C:\Windows\System\ARgUgcD.exe
  2⤵
  PID:7108
- C:\Windows\System\PjRxDao.exe
  C:\Windows\System\PjRxDao.exe
  2⤵
  PID:7124
- C:\Windows\System\ilurmQH.exe
  C:\Windows\System\ilurmQH.exe
  2⤵
  PID:7144
- C:\Windows\System\hZhepIq.exe
  C:\Windows\System\hZhepIq.exe
  2⤵
  PID:7160
- C:\Windows\System\FvNIPDA.exe
  C:\Windows\System\FvNIPDA.exe
  2⤵
  PID:6204
- C:\Windows\System\ToSFxzj.exe
  C:\Windows\System\ToSFxzj.exe
  2⤵
  PID:6280
- C:\Windows\System\mDhQtGh.exe
  C:\Windows\System\mDhQtGh.exe
  2⤵
  PID:5828
- C:\Windows\System\bOliPmJ.exe
  C:\Windows\System\bOliPmJ.exe
  2⤵
  PID:5848
- C:\Windows\System\vLyXaRe.exe
  C:\Windows\System\vLyXaRe.exe
  2⤵
  PID:6352
- C:\Windows\System\uJaqLqa.exe
  C:\Windows\System\uJaqLqa.exe
  2⤵
  PID:6404
- C:\Windows\System\wodJKzY.exe
  C:\Windows\System\wodJKzY.exe
  2⤵
  PID:5368
- C:\Windows\System\KknYGsw.exe
  C:\Windows\System\KknYGsw.exe
  2⤵
  PID:6476
- C:\Windows\System\ShagpeA.exe
  C:\Windows\System\ShagpeA.exe
  2⤵
  PID:6548
- C:\Windows\System\CAXAmKU.exe
  C:\Windows\System\CAXAmKU.exe
  2⤵
  PID:6588
- C:\Windows\System\monBiFo.exe
  C:\Windows\System\monBiFo.exe
  2⤵
  PID:6656
- C:\Windows\System\urjYkbA.exe
  C:\Windows\System\urjYkbA.exe
  2⤵
  PID:6760
- C:\Windows\System\ORQBaAv.exe
  C:\Windows\System\ORQBaAv.exe
  2⤵
  PID:5076
- C:\Windows\System\DArryME.exe
  C:\Windows\System\DArryME.exe
  2⤵
  PID:5208
- C:\Windows\System\raOyuJI.exe
  C:\Windows\System\raOyuJI.exe
  2⤵
  PID:6192
- C:\Windows\System\dGDsoAJ.exe
  C:\Windows\System\dGDsoAJ.exe
  2⤵
  PID:5312
- C:\Windows\System\CVdtCLy.exe
  C:\Windows\System\CVdtCLy.exe
  2⤵
  PID:5536
- C:\Windows\System\AuRpKYl.exe
  C:\Windows\System\AuRpKYl.exe
  2⤵
  PID:5132
- C:\Windows\System\DTXHAex.exe
  C:\Windows\System\DTXHAex.exe
  2⤵
  PID:5616
- C:\Windows\System\ZXxBTKw.exe
  C:\Windows\System\ZXxBTKw.exe
  2⤵
  PID:6088
- C:\Windows\System\wHeHqDY.exe
  C:\Windows\System\wHeHqDY.exe
  2⤵
  PID:6268
- C:\Windows\System\DbFAwct.exe
  C:\Windows\System\DbFAwct.exe
  2⤵
  PID:6372
- C:\Windows\System\TyJBQrn.exe
  C:\Windows\System\TyJBQrn.exe
  2⤵
  PID:6428
- C:\Windows\System\JecCFYK.exe
  C:\Windows\System\JecCFYK.exe
  2⤵
  PID:6528
- C:\Windows\System\mntxfLt.exe
  C:\Windows\System\mntxfLt.exe
  2⤵
  PID:6632
- C:\Windows\System\giFILLe.exe
  C:\Windows\System\giFILLe.exe
  2⤵
  PID:6676
- C:\Windows\System\HVzEixv.exe
  C:\Windows\System\HVzEixv.exe
  2⤵
  PID:6744
- C:\Windows\System\LfnJOHe.exe
  C:\Windows\System\LfnJOHe.exe
  2⤵
  PID:6792
- C:\Windows\System\aEIcdam.exe
  C:\Windows\System\aEIcdam.exe
  2⤵
  PID:6812
- C:\Windows\System\SxDTCDN.exe
  C:\Windows\System\SxDTCDN.exe
  2⤵
  PID:6828
- C:\Windows\System\RbPiypp.exe
  C:\Windows\System\RbPiypp.exe
  2⤵
  PID:6848
- C:\Windows\System\aBKWekR.exe
  C:\Windows\System\aBKWekR.exe
  2⤵
  PID:6860
- C:\Windows\System\tyDwlwd.exe
  C:\Windows\System\tyDwlwd.exe
  2⤵
  PID:6884
- C:\Windows\System\WaQaMop.exe
  C:\Windows\System\WaQaMop.exe
  2⤵
  PID:6928
- C:\Windows\System\skJWHwS.exe
  C:\Windows\System\skJWHwS.exe
  2⤵
  PID:6968
- C:\Windows\System\lBCHMrA.exe
  C:\Windows\System\lBCHMrA.exe
  2⤵
  PID:7056
- C:\Windows\System\nUfuxTG.exe
  C:\Windows\System\nUfuxTG.exe
  2⤵
  PID:7052
- C:\Windows\System\cTFtDFZ.exe
  C:\Windows\System\cTFtDFZ.exe
  2⤵
  PID:6244
- C:\Windows\System\dSBkOkQ.exe
  C:\Windows\System\dSBkOkQ.exe
  2⤵
  PID:6132
- C:\Windows\System\BLPadtL.exe
  C:\Windows\System\BLPadtL.exe
  2⤵
  PID:6440
- C:\Windows\System\onoSTmu.exe
  C:\Windows\System\onoSTmu.exe
  2⤵
  PID:6072
- C:\Windows\System\dswWuiI.exe
  C:\Windows\System\dswWuiI.exe
  2⤵
  PID:7092
- C:\Windows\System\ZpCllGU.exe
  C:\Windows\System\ZpCllGU.exe
  2⤵
  PID:5488
- C:\Windows\System\QkTeiSY.exe
  C:\Windows\System\QkTeiSY.exe
  2⤵
  PID:6012
- C:\Windows\System\asJUcak.exe
  C:\Windows\System\asJUcak.exe
  2⤵
  PID:5664
- C:\Windows\System\NUewCIj.exe
  C:\Windows\System\NUewCIj.exe
  2⤵
  PID:7132
- C:\Windows\System\lvCtwZS.exe
  C:\Windows\System\lvCtwZS.exe
  2⤵
  PID:6340
- C:\Windows\System\awWObjG.exe
  C:\Windows\System\awWObjG.exe
  2⤵
  PID:6672
- C:\Windows\System\IMteMEl.exe
  C:\Windows\System\IMteMEl.exe
  2⤵
  PID:6784
- C:\Windows\System\TGTZTPg.exe
  C:\Windows\System\TGTZTPg.exe
  2⤵
  PID:6544
- C:\Windows\System\SIHmOOJ.exe
  C:\Windows\System\SIHmOOJ.exe
  2⤵
  PID:6652
- C:\Windows\System\kGXCkBh.exe
  C:\Windows\System\kGXCkBh.exe
  2⤵
  PID:6188
- C:\Windows\System\OZXqBjt.exe
  C:\Windows\System\OZXqBjt.exe
  2⤵
  PID:6800
- C:\Windows\System\yGzpwCf.exe
  C:\Windows\System\yGzpwCf.exe
  2⤵
  PID:6564
- C:\Windows\System\AeOtAQJ.exe
  C:\Windows\System\AeOtAQJ.exe
  2⤵
  PID:6232
- C:\Windows\System\pxXNuGL.exe
  C:\Windows\System\pxXNuGL.exe
  2⤵
  PID:6572
- C:\Windows\System\WeBPNiC.exe
  C:\Windows\System\WeBPNiC.exe
  2⤵
  PID:6808
- C:\Windows\System\biGvEGR.exe
  C:\Windows\System\biGvEGR.exe
  2⤵
  PID:6880
- C:\Windows\System\fEloIVP.exe
  C:\Windows\System\fEloIVP.exe
  2⤵
  PID:7028
- C:\Windows\System\FZTaKdy.exe
  C:\Windows\System\FZTaKdy.exe
  2⤵
  PID:6952
- C:\Windows\System\CTLvgPp.exe
  C:\Windows\System\CTLvgPp.exe
  2⤵
  PID:6976
- C:\Windows\System\DmnBWVl.exe
  C:\Windows\System\DmnBWVl.exe
  2⤵
  PID:7036
- C:\Windows\System\EmyGMwt.exe
  C:\Windows\System\EmyGMwt.exe
  2⤵
  PID:5280
- C:\Windows\System\OOAQjvC.exe
  C:\Windows\System\OOAQjvC.exe
  2⤵
  PID:4648
- C:\Windows\System\ZNqsAUU.exe
  C:\Windows\System\ZNqsAUU.exe
  2⤵
  PID:6496
- C:\Windows\System\ERNEZMn.exe
  C:\Windows\System\ERNEZMn.exe
  2⤵
  PID:6768
- C:\Windows\System\rgrTwwh.exe
  C:\Windows\System\rgrTwwh.exe
  2⤵
  PID:6068
- C:\Windows\System\rWPQexX.exe
  C:\Windows\System\rWPQexX.exe
  2⤵
  PID:5632
- C:\Windows\System\YzxWpSI.exe
  C:\Windows\System\YzxWpSI.exe
  2⤵
  PID:6780
- C:\Windows\System\nWZSxVp.exe
  C:\Windows\System\nWZSxVp.exe
  2⤵
  PID:6152
- C:\Windows\System\LYHmPTu.exe
  C:\Windows\System\LYHmPTu.exe
  2⤵
  PID:6380
- C:\Windows\System\qjJXibk.exe
  C:\Windows\System\qjJXibk.exe
  2⤵
  PID:6840
- C:\Windows\System\XgXpqoz.exe
  C:\Windows\System\XgXpqoz.exe
  2⤵
  PID:6944
- C:\Windows\System\GRgEsUH.exe
  C:\Windows\System\GRgEsUH.exe
  2⤵
  PID:6692
- C:\Windows\System\dAiudXu.exe
  C:\Windows\System\dAiudXu.exe
  2⤵
  PID:7016
- C:\Windows\System\ecwzNcF.exe
  C:\Windows\System\ecwzNcF.exe
  2⤵
  PID:5364
- C:\Windows\System\vUDRzCr.exe
  C:\Windows\System\vUDRzCr.exe
  2⤵
  PID:6856
- C:\Windows\System\gpqxqzz.exe
  C:\Windows\System\gpqxqzz.exe
  2⤵
  PID:6604
- C:\Windows\System\WuGwOOd.exe
  C:\Windows\System\WuGwOOd.exe
  2⤵
  PID:7080
- C:\Windows\System\XVEZAbz.exe
  C:\Windows\System\XVEZAbz.exe
  2⤵
  PID:6300
- C:\Windows\System\PgYVZeA.exe
  C:\Windows\System\PgYVZeA.exe
  2⤵
  PID:7076
- C:\Windows\System\yQueAsQ.exe
  C:\Windows\System\yQueAsQ.exe
  2⤵
  PID:6076
- C:\Windows\System\MmTlsZX.exe
  C:\Windows\System\MmTlsZX.exe
  2⤵
  PID:5928
- C:\Windows\System\ZSAYvLE.exe
  C:\Windows\System\ZSAYvLE.exe
  2⤵
  PID:6600
- C:\Windows\System\OhrUCxJ.exe
  C:\Windows\System\OhrUCxJ.exe
  2⤵
  PID:6396
- C:\Windows\System\XVkOLuG.exe
  C:\Windows\System\XVkOLuG.exe
  2⤵
  PID:6408
- C:\Windows\System\MojCtku.exe
  C:\Windows\System\MojCtku.exe
  2⤵
  PID:7116
- C:\Windows\System\nxudHXh.exe
  C:\Windows\System\nxudHXh.exe
  2⤵
  PID:6324
- C:\Windows\System\eHlPPpw.exe
  C:\Windows\System\eHlPPpw.exe
  2⤵
  PID:6516
- C:\Windows\System\NvgQKbO.exe
  C:\Windows\System\NvgQKbO.exe
  2⤵
  PID:7152
- C:\Windows\System\FjfaRDv.exe
  C:\Windows\System\FjfaRDv.exe
  2⤵
  PID:7180
- C:\Windows\System\VUOYxqe.exe
  C:\Windows\System\VUOYxqe.exe
  2⤵
  PID:7196
- C:\Windows\System\pCSLriR.exe
  C:\Windows\System\pCSLriR.exe
  2⤵
  PID:7212
- C:\Windows\System\CWSaVtt.exe
  C:\Windows\System\CWSaVtt.exe
  2⤵
  PID:7228
- C:\Windows\System\tJPqoeN.exe
  C:\Windows\System\tJPqoeN.exe
  2⤵
  PID:7252
- C:\Windows\System\roXUwpY.exe
  C:\Windows\System\roXUwpY.exe
  2⤵
  PID:7272
- C:\Windows\System\RAukMtB.exe
  C:\Windows\System\RAukMtB.exe
  2⤵
  PID:7292
- C:\Windows\System\IqaRFlR.exe
  C:\Windows\System\IqaRFlR.exe
  2⤵
  PID:7332
- C:\Windows\System\srgAPVU.exe
  C:\Windows\System\srgAPVU.exe
  2⤵
  PID:7352
- C:\Windows\System\HeUvXYX.exe
  C:\Windows\System\HeUvXYX.exe
  2⤵
  PID:7368
- C:\Windows\System\UCQPMTI.exe
  C:\Windows\System\UCQPMTI.exe
  2⤵
  PID:7392
- C:\Windows\System\LUAJUlw.exe
  C:\Windows\System\LUAJUlw.exe
  2⤵
  PID:7416
- C:\Windows\System\YtilVUq.exe
  C:\Windows\System\YtilVUq.exe
  2⤵
  PID:7436
- C:\Windows\System\TeyHbNk.exe
  C:\Windows\System\TeyHbNk.exe
  2⤵
  PID:7456
- C:\Windows\System\cCtkWKU.exe
  C:\Windows\System\cCtkWKU.exe
  2⤵
  PID:7472
- C:\Windows\System\RrjjrSh.exe
  C:\Windows\System\RrjjrSh.exe
  2⤵
  PID:7488
- C:\Windows\System\JWRKKRb.exe
  C:\Windows\System\JWRKKRb.exe
  2⤵
  PID:7512
- C:\Windows\System\goukJzM.exe
  C:\Windows\System\goukJzM.exe
  2⤵
  PID:7528
- C:\Windows\System\xbAZTho.exe
  C:\Windows\System\xbAZTho.exe
  2⤵
  PID:7552
- C:\Windows\System\KfDETCC.exe
  C:\Windows\System\KfDETCC.exe
  2⤵
  PID:7568
- C:\Windows\System\SEzZfJh.exe
  C:\Windows\System\SEzZfJh.exe
  2⤵
  PID:7584
- C:\Windows\System\vZJiLpn.exe
  C:\Windows\System\vZJiLpn.exe
  2⤵
  PID:7604
- C:\Windows\System\ROTPIUD.exe
  C:\Windows\System\ROTPIUD.exe
  2⤵
  PID:7624
- C:\Windows\System\eWjBRXO.exe
  C:\Windows\System\eWjBRXO.exe
  2⤵
  PID:7644
- C:\Windows\System\SGUWWHD.exe
  C:\Windows\System\SGUWWHD.exe
  2⤵
  PID:7668
- C:\Windows\System\nXQuzMu.exe
  C:\Windows\System\nXQuzMu.exe
  2⤵
  PID:7684
- C:\Windows\System\TUFBIct.exe
  C:\Windows\System\TUFBIct.exe
  2⤵
  PID:7700
- C:\Windows\System\ssmfYtR.exe
  C:\Windows\System\ssmfYtR.exe
  2⤵
  PID:7736
- C:\Windows\System\uoboihj.exe
  C:\Windows\System\uoboihj.exe
  2⤵
  PID:7752
- C:\Windows\System\McIJSrr.exe
  C:\Windows\System\McIJSrr.exe
  2⤵
  PID:7768
- C:\Windows\System\AnefYCM.exe
  C:\Windows\System\AnefYCM.exe
  2⤵
  PID:7788
- C:\Windows\System\GgigOho.exe
  C:\Windows\System\GgigOho.exe
  2⤵
  PID:7808
- C:\Windows\System\mNdHRoU.exe
  C:\Windows\System\mNdHRoU.exe
  2⤵
  PID:7836
- C:\Windows\System\KhURakN.exe
  C:\Windows\System\KhURakN.exe
  2⤵
  PID:7856
- C:\Windows\System\iVFYRjF.exe
  C:\Windows\System\iVFYRjF.exe
  2⤵
  PID:7876
- C:\Windows\System\PBwaqeU.exe
  C:\Windows\System\PBwaqeU.exe
  2⤵
  PID:7896
- C:\Windows\System\vtyvqIQ.exe
  C:\Windows\System\vtyvqIQ.exe
  2⤵
  PID:7912
- C:\Windows\System\qDzAejU.exe
  C:\Windows\System\qDzAejU.exe
  2⤵
  PID:7932
- C:\Windows\System\SeZfwQX.exe
  C:\Windows\System\SeZfwQX.exe
  2⤵
  PID:7948
- C:\Windows\System\eUCrPNy.exe
  C:\Windows\System\eUCrPNy.exe
  2⤵
  PID:7968
- C:\Windows\System\axAEojr.exe
  C:\Windows\System\axAEojr.exe
  2⤵
  PID:7984
- C:\Windows\System\zwLdgIl.exe
  C:\Windows\System\zwLdgIl.exe
  2⤵
  PID:8000
- C:\Windows\System\cuUpjFd.exe
  C:\Windows\System\cuUpjFd.exe
  2⤵
  PID:8020
- C:\Windows\System\jMkXgRi.exe
  C:\Windows\System\jMkXgRi.exe
  2⤵
  PID:8044
- C:\Windows\System\yuLznLr.exe
  C:\Windows\System\yuLznLr.exe
  2⤵
  PID:8060
- C:\Windows\System\BzUICfS.exe
  C:\Windows\System\BzUICfS.exe
  2⤵
  PID:8080
- C:\Windows\System\eFeQhWf.exe
  C:\Windows\System\eFeQhWf.exe
  2⤵
  PID:8096
- C:\Windows\System\UdrzYTl.exe
  C:\Windows\System\UdrzYTl.exe
  2⤵
  PID:8116
- C:\Windows\System\aNiUMYm.exe
  C:\Windows\System\aNiUMYm.exe
  2⤵
  PID:8136
- C:\Windows\System\PruhpUF.exe
  C:\Windows\System\PruhpUF.exe
  2⤵
  PID:8152
- C:\Windows\System\DwXzIGM.exe
  C:\Windows\System\DwXzIGM.exe
  2⤵
  PID:8168
- C:\Windows\System\QSBYHxx.exe
  C:\Windows\System\QSBYHxx.exe
  2⤵
  PID:8184
- C:\Windows\System\pdMhsQh.exe
  C:\Windows\System\pdMhsQh.exe
  2⤵
  PID:7188
- C:\Windows\System\UENTcoL.exe
  C:\Windows\System\UENTcoL.exe
  2⤵
  PID:7260
- C:\Windows\System\xORaOSm.exe
  C:\Windows\System\xORaOSm.exe
  2⤵
  PID:7300
- C:\Windows\System\pwdpIoD.exe
  C:\Windows\System\pwdpIoD.exe
  2⤵
  PID:7320
- C:\Windows\System\wuKIRNz.exe
  C:\Windows\System\wuKIRNz.exe
  2⤵
  PID:6804
- C:\Windows\System\achRNUz.exe
  C:\Windows\System\achRNUz.exe
  2⤵
  PID:7288
- C:\Windows\System\arLSJEo.exe
  C:\Windows\System\arLSJEo.exe
  2⤵
  PID:6568
- C:\Windows\System\fcYQlfw.exe
  C:\Windows\System\fcYQlfw.exe
  2⤵
  PID:6488
- C:\Windows\System\jBvBJJJ.exe
  C:\Windows\System\jBvBJJJ.exe
  2⤵
  PID:7404
- C:\Windows\System\AorJxRa.exe
  C:\Windows\System\AorJxRa.exe
  2⤵
  PID:6852
- C:\Windows\System\GqPpIfY.exe
  C:\Windows\System\GqPpIfY.exe
  2⤵
  PID:7280
- C:\Windows\System\Hfsbrkb.exe
  C:\Windows\System\Hfsbrkb.exe
  2⤵
  PID:7464
- C:\Windows\System\GgnlpTR.exe
  C:\Windows\System\GgnlpTR.exe
  2⤵
  PID:7708
- C:\Windows\System\OLCjGuR.exe
  C:\Windows\System\OLCjGuR.exe
  2⤵
  PID:7504
- C:\Windows\System\TUgMODV.exe
  C:\Windows\System\TUgMODV.exe
  2⤵
  PID:7724
- C:\Windows\System\ZvBtxVL.exe
  C:\Windows\System\ZvBtxVL.exe
  2⤵
  PID:7764
- C:\Windows\System\KtIpRYl.exe
  C:\Windows\System\KtIpRYl.exe
  2⤵
  PID:7664
- C:\Windows\System\mYDeXEF.exe
  C:\Windows\System\mYDeXEF.exe
  2⤵
  PID:7800
- C:\Windows\System\bwkatWn.exe
  C:\Windows\System\bwkatWn.exe
  2⤵
  PID:7816
- C:\Windows\System\qAZvNic.exe
  C:\Windows\System\qAZvNic.exe
  2⤵
  PID:7888
- C:\Windows\System\uvjHTgt.exe
  C:\Windows\System\uvjHTgt.exe
  2⤵
  PID:7832
- C:\Windows\System\HRRacFb.exe
  C:\Windows\System\HRRacFb.exe
  2⤵
  PID:7964
- C:\Windows\System\foMtPFD.exe
  C:\Windows\System\foMtPFD.exe
  2⤵
  PID:8032
- C:\Windows\System\oOuDBCm.exe
  C:\Windows\System\oOuDBCm.exe
  2⤵
  PID:7824
- C:\Windows\System\cutVOID.exe
  C:\Windows\System\cutVOID.exe
  2⤵
  PID:8076
- C:\Windows\System\fWYMKOO.exe
  C:\Windows\System\fWYMKOO.exe
  2⤵
  PID:8144
- C:\Windows\System\wgpxdul.exe
  C:\Windows\System\wgpxdul.exe
  2⤵
  PID:7224
- C:\Windows\System\FwzcXjh.exe
  C:\Windows\System\FwzcXjh.exe
  2⤵
  PID:7316
- C:\Windows\System\TrABYzI.exe
  C:\Windows\System\TrABYzI.exe
  2⤵
  PID:7868
- C:\Windows\System\ZRzKiIU.exe
  C:\Windows\System\ZRzKiIU.exe
  2⤵
  PID:7360
- C:\Windows\System\mSHTqva.exe
  C:\Windows\System\mSHTqva.exe
  2⤵
  PID:8040
- C:\Windows\System\hyESYnC.exe
  C:\Windows\System\hyESYnC.exe
  2⤵
  PID:2128
- C:\Windows\System\bgeowRv.exe
  C:\Windows\System\bgeowRv.exe
  2⤵
  PID:7976
- C:\Windows\System\KGwfrhq.exe
  C:\Windows\System\KGwfrhq.exe
  2⤵
  PID:8128
- C:\Windows\System\EvXuKIF.exe
  C:\Windows\System\EvXuKIF.exe
  2⤵
  PID:8164
- C:\Windows\System\ZZloXDV.exe
  C:\Windows\System\ZZloXDV.exe
  2⤵
  PID:7172
- C:\Windows\System\WHAzYfV.exe
  C:\Windows\System\WHAzYfV.exe
  2⤵
  PID:7340
- C:\Windows\System\iOaNNDv.exe
  C:\Windows\System\iOaNNDv.exe
  2⤵
  PID:7632
- C:\Windows\System\XQoxRui.exe
  C:\Windows\System\XQoxRui.exe
  2⤵
  PID:7544
- C:\Windows\System\pTVGtqA.exe
  C:\Windows\System\pTVGtqA.exe
  2⤵
  PID:7712
- C:\Windows\System\NrSLbaC.exe
  C:\Windows\System\NrSLbaC.exe
  2⤵
  PID:7448
- C:\Windows\System\aLKCzWd.exe
  C:\Windows\System\aLKCzWd.exe
  2⤵
  PID:7620
- C:\Windows\System\HHdZRWZ.exe
  C:\Windows\System\HHdZRWZ.exe
  2⤵
  PID:7576
- C:\Windows\System\isrVDQm.exe
  C:\Windows\System\isrVDQm.exe
  2⤵
  PID:7780
- C:\Windows\System\kfdzrNS.exe
  C:\Windows\System\kfdzrNS.exe
  2⤵
  PID:7892
- C:\Windows\System\MLEAtkc.exe
  C:\Windows\System\MLEAtkc.exe
  2⤵
  PID:7864
- C:\Windows\System\tgzpnmS.exe
  C:\Windows\System\tgzpnmS.exe
  2⤵
  PID:7312
- C:\Windows\System\wJhQnFd.exe
  C:\Windows\System\wJhQnFd.exe
  2⤵
  PID:5144
- C:\Windows\System\rCZLpbp.exe
  C:\Windows\System\rCZLpbp.exe
  2⤵
  PID:6164
- C:\Windows\System\ZNRZRBn.exe
  C:\Windows\System\ZNRZRBn.exe
  2⤵
  PID:7784
- C:\Windows\System\XZFyClG.exe
  C:\Windows\System\XZFyClG.exe
  2⤵
  PID:8132
- C:\Windows\System\UOwFQOS.exe
  C:\Windows\System\UOwFQOS.exe
  2⤵
  PID:6916
- C:\Windows\System\gPMdIym.exe
  C:\Windows\System\gPMdIym.exe
  2⤵
  PID:7208
- C:\Windows\System\NFUaMjK.exe
  C:\Windows\System\NFUaMjK.exe
  2⤵
  PID:7408
- C:\Windows\System\mSGmHqu.exe
  C:\Windows\System\mSGmHqu.exe
  2⤵
  PID:7600
- C:\Windows\System\NtmCXco.exe
  C:\Windows\System\NtmCXco.exe
  2⤵
  PID:7596
- C:\Windows\System\ieoeGzY.exe
  C:\Windows\System\ieoeGzY.exe
  2⤵
  PID:7424
- C:\Windows\System\qYGSCtZ.exe
  C:\Windows\System\qYGSCtZ.exe
  2⤵
  PID:7652
- C:\Windows\System\IseznkO.exe
  C:\Windows\System\IseznkO.exe
  2⤵
  PID:7960
- C:\Windows\System\eLgyUmb.exe
  C:\Windows\System\eLgyUmb.exe
  2⤵
  PID:8112
- C:\Windows\System\lWorhOs.exe
  C:\Windows\System\lWorhOs.exe
  2⤵
  PID:7944
- C:\Windows\System\AUVXwBR.exe
  C:\Windows\System\AUVXwBR.exe
  2⤵
  PID:8092
- C:\Windows\System\afehJEK.exe
  C:\Windows\System\afehJEK.exe
  2⤵
  PID:7996
- C:\Windows\System\KQkNVlk.exe
  C:\Windows\System\KQkNVlk.exe
  2⤵
  PID:7884
- C:\Windows\System\INQNwCZ.exe
  C:\Windows\System\INQNwCZ.exe
  2⤵
  PID:6896
- C:\Windows\System\zgyOwvx.exe
  C:\Windows\System\zgyOwvx.exe
  2⤵
  PID:7380
- C:\Windows\System\kZYZmmM.exe
  C:\Windows\System\kZYZmmM.exe
  2⤵
  PID:7592
- C:\Windows\System\ZOmETUF.exe
  C:\Windows\System\ZOmETUF.exe
  2⤵
  PID:7412
- C:\Windows\System\bqYIPMx.exe
  C:\Windows\System\bqYIPMx.exe
  2⤵
  PID:8088
- C:\Windows\System\HIglKdm.exe
  C:\Windows\System\HIglKdm.exe
  2⤵
  PID:6824
- C:\Windows\System\SwjlaOI.exe
  C:\Windows\System\SwjlaOI.exe
  2⤵
  PID:7956
- C:\Windows\System\lSfAlxI.exe
  C:\Windows\System\lSfAlxI.exe
  2⤵
  PID:8208
- C:\Windows\System\qjpzPef.exe
  C:\Windows\System\qjpzPef.exe
  2⤵
  PID:8224
- C:\Windows\System\zXIOoZp.exe
  C:\Windows\System\zXIOoZp.exe
  2⤵
  PID:8240
- C:\Windows\System\vubptmD.exe
  C:\Windows\System\vubptmD.exe
  2⤵
  PID:8256
- C:\Windows\System\RAjmbBL.exe
  C:\Windows\System\RAjmbBL.exe
  2⤵
  PID:8292
- C:\Windows\System\RKvVFVs.exe
  C:\Windows\System\RKvVFVs.exe
  2⤵
  PID:8340
- C:\Windows\System\phguXmL.exe
  C:\Windows\System\phguXmL.exe
  2⤵
  PID:8396
- C:\Windows\System\rvqSqXf.exe
  C:\Windows\System\rvqSqXf.exe
  2⤵
  PID:8412
- C:\Windows\System\mlYCiTf.exe
  C:\Windows\System\mlYCiTf.exe
  2⤵
  PID:8428
- C:\Windows\System\kPTTYiV.exe
  C:\Windows\System\kPTTYiV.exe
  2⤵
  PID:8444
- C:\Windows\System\PTkijyf.exe
  C:\Windows\System\PTkijyf.exe
  2⤵
  PID:8460
- C:\Windows\System\EuXkgvO.exe
  C:\Windows\System\EuXkgvO.exe
  2⤵
  PID:8476
- C:\Windows\System\MZrUfHr.exe
  C:\Windows\System\MZrUfHr.exe
  2⤵
  PID:8492
- C:\Windows\System\kSFvMVv.exe
  C:\Windows\System\kSFvMVv.exe
  2⤵
  PID:8508
- C:\Windows\System\ejrxYKe.exe
  C:\Windows\System\ejrxYKe.exe
  2⤵
  PID:8524
- C:\Windows\System\hZAQrOH.exe
  C:\Windows\System\hZAQrOH.exe
  2⤵
  PID:8544
- C:\Windows\System\HfkWOeR.exe
  C:\Windows\System\HfkWOeR.exe
  2⤵
  PID:8560
- C:\Windows\System\cZpkGdQ.exe
  C:\Windows\System\cZpkGdQ.exe
  2⤵
  PID:8588
- C:\Windows\System\qriDhNm.exe
  C:\Windows\System\qriDhNm.exe
  2⤵
  PID:8604
- C:\Windows\System\VdWVKCK.exe
  C:\Windows\System\VdWVKCK.exe
  2⤵
  PID:8656
- C:\Windows\System\hrgUuIV.exe
  C:\Windows\System\hrgUuIV.exe
  2⤵
  PID:8672
- C:\Windows\System\gLDQnej.exe
  C:\Windows\System\gLDQnej.exe
  2⤵
  PID:8692
- C:\Windows\System\TNxHGVA.exe
  C:\Windows\System\TNxHGVA.exe
  2⤵
  PID:8708
- C:\Windows\System\yGmWGSR.exe
  C:\Windows\System\yGmWGSR.exe
  2⤵
  PID:8724
- C:\Windows\System\vyxhyyQ.exe
  C:\Windows\System\vyxhyyQ.exe
  2⤵
  PID:8744
- C:\Windows\System\tZmKAdc.exe
  C:\Windows\System\tZmKAdc.exe
  2⤵
  PID:8760
- C:\Windows\System\JsOhkbT.exe
  C:\Windows\System\JsOhkbT.exe
  2⤵
  PID:8780
- C:\Windows\System\PJldUgD.exe
  C:\Windows\System\PJldUgD.exe
  2⤵
  PID:8796
- C:\Windows\System\JuYODPT.exe
  C:\Windows\System\JuYODPT.exe
  2⤵
  PID:8812
- C:\Windows\System\EhxuOEW.exe
  C:\Windows\System\EhxuOEW.exe
  2⤵
  PID:8828
- C:\Windows\System\urtbJKw.exe
  C:\Windows\System\urtbJKw.exe
  2⤵
  PID:8848
- C:\Windows\System\WYqTSXB.exe
  C:\Windows\System\WYqTSXB.exe
  2⤵
  PID:8868
- C:\Windows\System\wdMKDmE.exe
  C:\Windows\System\wdMKDmE.exe
  2⤵
  PID:8888
- C:\Windows\System\khzViPX.exe
  C:\Windows\System\khzViPX.exe
  2⤵
  PID:8908
- C:\Windows\System\ebLDwTM.exe
  C:\Windows\System\ebLDwTM.exe
  2⤵
  PID:8960
- C:\Windows\System\aQWPByJ.exe
  C:\Windows\System\aQWPByJ.exe
  2⤵
  PID:8976
- C:\Windows\System\LzClmjQ.exe
  C:\Windows\System\LzClmjQ.exe
  2⤵
  PID:8992
- C:\Windows\System\QBZAegW.exe
  C:\Windows\System\QBZAegW.exe
  2⤵
  PID:9008
- C:\Windows\System\vYxVnsf.exe
  C:\Windows\System\vYxVnsf.exe
  2⤵
  PID:9024
- C:\Windows\System\PKdzpHN.exe
  C:\Windows\System\PKdzpHN.exe
  2⤵
  PID:9040
- C:\Windows\System\ZsuTsfU.exe
  C:\Windows\System\ZsuTsfU.exe
  2⤵
  PID:9056
- C:\Windows\System\vJBHQfv.exe
  C:\Windows\System\vJBHQfv.exe
  2⤵
  PID:9072
- C:\Windows\System\aiDoBaQ.exe
  C:\Windows\System\aiDoBaQ.exe
  2⤵
  PID:9092
- C:\Windows\System\lTzbDik.exe
  C:\Windows\System\lTzbDik.exe
  2⤵
  PID:9108
- C:\Windows\System\PlYiIHR.exe
  C:\Windows\System\PlYiIHR.exe
  2⤵
  PID:9124
- C:\Windows\System\BBRQSKf.exe
  C:\Windows\System\BBRQSKf.exe
  2⤵
  PID:9140
- C:\Windows\System\LLDOzan.exe
  C:\Windows\System\LLDOzan.exe
  2⤵
  PID:9160
- C:\Windows\System\sGAQzFa.exe
  C:\Windows\System\sGAQzFa.exe
  2⤵
  PID:9176
- C:\Windows\System\CTrRPts.exe
  C:\Windows\System\CTrRPts.exe
  2⤵
  PID:9192
- C:\Windows\System\qQnlfYx.exe
  C:\Windows\System\qQnlfYx.exe
  2⤵
  PID:9208
- C:\Windows\System\SgsFEiW.exe
  C:\Windows\System\SgsFEiW.exe
  2⤵
  PID:8200
- C:\Windows\System\MxMwjvo.exe
  C:\Windows\System\MxMwjvo.exe
  2⤵
  PID:7432
- C:\Windows\System\ZHOTFhV.exe
  C:\Windows\System\ZHOTFhV.exe
  2⤵
  PID:7496
- C:\Windows\System\zLjLmHz.exe
  C:\Windows\System\zLjLmHz.exe
  2⤵
  PID:7612
- C:\Windows\System\OTPzRWN.exe
  C:\Windows\System\OTPzRWN.exe
  2⤵
  PID:7060
- C:\Windows\System\nHotQUP.exe
  C:\Windows\System\nHotQUP.exe
  2⤵
  PID:7384
- C:\Windows\System\PFCmjvR.exe
  C:\Windows\System\PFCmjvR.exe
  2⤵
  PID:8280
- C:\Windows\System\lwBdLUI.exe
  C:\Windows\System\lwBdLUI.exe
  2⤵
  PID:8288
- C:\Windows\System\QvSPtUs.exe
  C:\Windows\System\QvSPtUs.exe
  2⤵
  PID:8264
- C:\Windows\System\jHwrIiF.exe
  C:\Windows\System\jHwrIiF.exe
  2⤵
  PID:8308
- C:\Windows\System\JSIBckb.exe
  C:\Windows\System\JSIBckb.exe
  2⤵
  PID:8328
- C:\Windows\System\clGpBYM.exe
  C:\Windows\System\clGpBYM.exe
  2⤵
  PID:8596
- C:\Windows\System\WSQpuPd.exe
  C:\Windows\System\WSQpuPd.exe
  2⤵
  PID:8500
- C:\Windows\System\DajJfOy.exe
  C:\Windows\System\DajJfOy.exe
  2⤵
  PID:8536
- C:\Windows\System\FVZBJRh.exe
  C:\Windows\System\FVZBJRh.exe
  2⤵
  PID:8580
- C:\Windows\System\BIcFkco.exe
  C:\Windows\System\BIcFkco.exe
  2⤵
  PID:8632
- C:\Windows\System\waRVvvJ.exe
  C:\Windows\System\waRVvvJ.exe
  2⤵
  PID:8648
- C:\Windows\System\FJVQgcl.exe
  C:\Windows\System\FJVQgcl.exe
  2⤵
  PID:8680
- C:\Windows\System\MQaDZOu.exe
  C:\Windows\System\MQaDZOu.exe
  2⤵
  PID:8704
- C:\Windows\System\roWzSSd.exe
  C:\Windows\System\roWzSSd.exe
  2⤵
  PID:8768
- C:\Windows\System\wsIDRey.exe
  C:\Windows\System\wsIDRey.exe
  2⤵
  PID:8808
- C:\Windows\System\WmYFvJD.exe
  C:\Windows\System\WmYFvJD.exe
  2⤵
  PID:8920
- C:\Windows\System\xSmgfAI.exe
  C:\Windows\System\xSmgfAI.exe
  2⤵
  PID:8896
- C:\Windows\System\PHAECcI.exe
  C:\Windows\System\PHAECcI.exe
  2⤵
  PID:8856
- C:\Windows\System\wLAjPBm.exe
  C:\Windows\System\wLAjPBm.exe
  2⤵
  PID:8928
- C:\Windows\System\DSEaCME.exe
  C:\Windows\System\DSEaCME.exe
  2⤵
  PID:8948
- C:\Windows\System\gTpdYsS.exe
  C:\Windows\System\gTpdYsS.exe
  2⤵
  PID:8968
- C:\Windows\System\jeLkRkT.exe
  C:\Windows\System\jeLkRkT.exe
  2⤵
  PID:9088
- C:\Windows\System\rqLqufo.exe
  C:\Windows\System\rqLqufo.exe
  2⤵
  PID:9000
- C:\Windows\System\WjcYzUm.exe
  C:\Windows\System\WjcYzUm.exe
  2⤵
  PID:9068
- C:\Windows\System\KBRykQa.exe
  C:\Windows\System\KBRykQa.exe
  2⤵
  PID:9120
- C:\Windows\System\xDaGAxE.exe
  C:\Windows\System\xDaGAxE.exe
  2⤵
  PID:7696
- C:\Windows\System\LHgKUfw.exe
  C:\Windows\System\LHgKUfw.exe
  2⤵
  PID:9116
- C:\Windows\System\HvFomKS.exe
  C:\Windows\System\HvFomKS.exe
  2⤵
  PID:9184
- C:\Windows\System\ucXjPhs.exe
  C:\Windows\System\ucXjPhs.exe
  2⤵
  PID:8268
- C:\Windows\System\fNlFKoL.exe
  C:\Windows\System\fNlFKoL.exe
  2⤵
  PID:8232
- C:\Windows\System\VUVzFGT.exe
  C:\Windows\System\VUVzFGT.exe
  2⤵
  PID:8324
- C:\Windows\System\hioaDff.exe
  C:\Windows\System\hioaDff.exe
  2⤵
  PID:8356
- C:\Windows\System\TlpZUvg.exe
  C:\Windows\System\TlpZUvg.exe
  2⤵
  PID:8408
- C:\Windows\System\cNNryFy.exe
  C:\Windows\System\cNNryFy.exe
  2⤵
  PID:8384
- C:\Windows\System\uNUoBTJ.exe
  C:\Windows\System\uNUoBTJ.exe
  2⤵
  PID:8452
- C:\Windows\System\mqsTPsQ.exe
  C:\Windows\System\mqsTPsQ.exe
  2⤵
  PID:8516
- C:\Windows\System\llJQWfp.exe
  C:\Windows\System\llJQWfp.exe
  2⤵
  PID:8600
- C:\Windows\System\IDFOUQo.exe
  C:\Windows\System\IDFOUQo.exe
  2⤵
  PID:8576
- C:\Windows\System\qSCIUCR.exe
  C:\Windows\System\qSCIUCR.exe
  2⤵
  PID:8644
- C:\Windows\System\zoTKPWm.exe
  C:\Windows\System\zoTKPWm.exe
  2⤵
  PID:8840
- C:\Windows\System\WoWjdjS.exe
  C:\Windows\System\WoWjdjS.exe
  2⤵
  PID:8776
- C:\Windows\System\cVZLEsh.exe
  C:\Windows\System\cVZLEsh.exe
  2⤵
  PID:8792
- C:\Windows\System\VWHqKSy.exe
  C:\Windows\System\VWHqKSy.exe
  2⤵
  PID:8788
- C:\Windows\System\GMMIDPa.exe
  C:\Windows\System\GMMIDPa.exe
  2⤵
  PID:8940
- C:\Windows\System\AfHsQuh.exe
  C:\Windows\System\AfHsQuh.exe
  2⤵
  PID:9016
- C:\Windows\System\PbQuymk.exe
  C:\Windows\System\PbQuymk.exe
  2⤵
  PID:8388
- C:\Windows\System\qmXirgR.exe
  C:\Windows\System\qmXirgR.exe
  2⤵
  PID:9100
- C:\Windows\System\nNaXIim.exe
  C:\Windows\System\nNaXIim.exe
  2⤵
  PID:9204
- C:\Windows\System\oXyTRuI.exe
  C:\Windows\System\oXyTRuI.exe
  2⤵
  PID:9152
- C:\Windows\System\fumqZgo.exe
  C:\Windows\System\fumqZgo.exe
  2⤵
  PID:8304
- C:\Windows\System\dEVLeAW.exe
  C:\Windows\System\dEVLeAW.exe
  2⤵
  PID:8336
- C:\Windows\System\MmaYaDq.exe
  C:\Windows\System\MmaYaDq.exe
  2⤵
  PID:8364
- C:\Windows\System\brmufBn.exe
  C:\Windows\System\brmufBn.exe
  2⤵
  PID:8440
- C:\Windows\System\ILwQrYm.exe
  C:\Windows\System\ILwQrYm.exe
  2⤵
  PID:8456
- C:\Windows\System\lQnNRhL.exe
  C:\Windows\System\lQnNRhL.exe
  2⤵
  PID:8568
- C:\Windows\System\rSdXAzj.exe
  C:\Windows\System\rSdXAzj.exe
  2⤵
  PID:8620
- C:\Windows\System\SZZSDsW.exe
  C:\Windows\System\SZZSDsW.exe
  2⤵
  PID:8736
- C:\Windows\System\bYnXiEJ.exe
  C:\Windows\System\bYnXiEJ.exe
  2⤵
  PID:8904
- C:\Windows\System\VgNByVk.exe
  C:\Windows\System\VgNByVk.exe
  2⤵
  PID:8952
- C:\Windows\System\UxwNWpz.exe
  C:\Windows\System\UxwNWpz.exe
  2⤵
  PID:1576
- C:\Windows\System\sZCMWgO.exe
  C:\Windows\System\sZCMWgO.exe
  2⤵
  PID:9036
- C:\Windows\System\kUZlLmQ.exe
  C:\Windows\System\kUZlLmQ.exe
  2⤵
  PID:7872
- C:\Windows\System\sQyzVTE.exe
  C:\Windows\System\sQyzVTE.exe
  2⤵
  PID:7468
- C:\Windows\System\HrCaLjl.exe
  C:\Windows\System\HrCaLjl.exe
  2⤵
  PID:8360
- C:\Windows\System\TWQNGTQ.exe
  C:\Windows\System\TWQNGTQ.exe
  2⤵
  PID:8424
- C:\Windows\System\eBUvpWU.exe
  C:\Windows\System\eBUvpWU.exe
  2⤵
  PID:8556
- C:\Windows\System\ZXNkjvR.exe
  C:\Windows\System\ZXNkjvR.exe
  2⤵
  PID:8664
- C:\Windows\System\fPudlyG.exe
  C:\Windows\System\fPudlyG.exe
  2⤵
  PID:8880
- C:\Windows\System\mIMKwgA.exe
  C:\Windows\System\mIMKwgA.exe
  2⤵
  PID:8864
- C:\Windows\System\ARYPQjB.exe
  C:\Windows\System\ARYPQjB.exe
  2⤵
  PID:9004
- C:\Windows\System\kOWIsoQ.exe
  C:\Windows\System\kOWIsoQ.exe
  2⤵
  PID:7940
- C:\Windows\System\osHCBox.exe
  C:\Windows\System\osHCBox.exe
  2⤵
  PID:8320
- C:\Windows\System\VYbzZcg.exe
  C:\Windows\System\VYbzZcg.exe
  2⤵
  PID:7848
- C:\Windows\System\FzduTZR.exe
  C:\Windows\System\FzduTZR.exe
  2⤵
  PID:8612
- C:\Windows\System\dulojrn.exe
  C:\Windows\System\dulojrn.exe
  2⤵
  PID:9136
- C:\Windows\System\LubLuCn.exe
  C:\Windows\System\LubLuCn.exe
  2⤵
  PID:8820
- C:\Windows\System\oeobSrR.exe
  C:\Windows\System\oeobSrR.exe
  2⤵
  PID:9236
- C:\Windows\System\jixFMcD.exe
  C:\Windows\System\jixFMcD.exe
  2⤵
  PID:9252
- C:\Windows\System\bGGrLyc.exe
  C:\Windows\System\bGGrLyc.exe
  2⤵
  PID:9268
- C:\Windows\System\PMFBotF.exe
  C:\Windows\System\PMFBotF.exe
  2⤵
  PID:9292
- C:\Windows\System\MwMSZCL.exe
  C:\Windows\System\MwMSZCL.exe
  2⤵
  PID:9328
- C:\Windows\System\yyGEqiX.exe
  C:\Windows\System\yyGEqiX.exe
  2⤵
  PID:9352
- C:\Windows\System\nyDowTs.exe
  C:\Windows\System\nyDowTs.exe
  2⤵
  PID:9372
- C:\Windows\System\WpOijhi.exe
  C:\Windows\System\WpOijhi.exe
  2⤵
  PID:9392
- C:\Windows\System\wsZAoFJ.exe
  C:\Windows\System\wsZAoFJ.exe
  2⤵
  PID:9408
- C:\Windows\System\KWtnXtI.exe
  C:\Windows\System\KWtnXtI.exe
  2⤵
  PID:9424
- C:\Windows\System\TkUjTQH.exe
  C:\Windows\System\TkUjTQH.exe
  2⤵
  PID:9444
- C:\Windows\System\RJPisxh.exe
  C:\Windows\System\RJPisxh.exe
  2⤵
  PID:9460
- C:\Windows\System\iLWbXIk.exe
  C:\Windows\System\iLWbXIk.exe
  2⤵
  PID:9480
- C:\Windows\System\OKyQNtN.exe
  C:\Windows\System\OKyQNtN.exe
  2⤵
  PID:9496
- C:\Windows\System\rzhPgfv.exe
  C:\Windows\System\rzhPgfv.exe
  2⤵
  PID:9516
- C:\Windows\System\OjlHYLi.exe
  C:\Windows\System\OjlHYLi.exe
  2⤵
  PID:9536
- C:\Windows\System\IjwVbev.exe
  C:\Windows\System\IjwVbev.exe
  2⤵
  PID:9576
- C:\Windows\System\yifTiop.exe
  C:\Windows\System\yifTiop.exe
  2⤵
  PID:9592
- C:\Windows\System\IUPSaTS.exe
  C:\Windows\System\IUPSaTS.exe
  2⤵
  PID:9612
- C:\Windows\System\aROoAbd.exe
  C:\Windows\System\aROoAbd.exe
  2⤵
  PID:9628
- C:\Windows\System\KZpmTud.exe
  C:\Windows\System\KZpmTud.exe
  2⤵
  PID:9652
- C:\Windows\System\DfYrsVq.exe
  C:\Windows\System\DfYrsVq.exe
  2⤵
  PID:9672
- C:\Windows\System\lnhUDJV.exe
  C:\Windows\System\lnhUDJV.exe
  2⤵
  PID:9696
- C:\Windows\System\SZJEiAY.exe
  C:\Windows\System\SZJEiAY.exe
  2⤵
  PID:9712
- C:\Windows\System\mTcYXEu.exe
  C:\Windows\System\mTcYXEu.exe
  2⤵
  PID:9728
- C:\Windows\System\rxIGrOM.exe
  C:\Windows\System\rxIGrOM.exe
  2⤵
  PID:9748
- C:\Windows\System\jvFcCxx.exe
  C:\Windows\System\jvFcCxx.exe
  2⤵
  PID:9764
- C:\Windows\System\fUdxtPM.exe
  C:\Windows\System\fUdxtPM.exe
  2⤵
  PID:9784
- C:\Windows\System\yjUSsHG.exe
  C:\Windows\System\yjUSsHG.exe
  2⤵
  PID:9804
- C:\Windows\System\RzlTZGe.exe
  C:\Windows\System\RzlTZGe.exe
  2⤵
  PID:9832
- C:\Windows\System\nZzKMrY.exe
  C:\Windows\System\nZzKMrY.exe
  2⤵
  PID:9848
- C:\Windows\System\LOQpQfa.exe
  C:\Windows\System\LOQpQfa.exe
  2⤵
  PID:9864
- C:\Windows\System\qitCYNq.exe
  C:\Windows\System\qitCYNq.exe
  2⤵
  PID:9892
- C:\Windows\System\FCvtyRH.exe
  C:\Windows\System\FCvtyRH.exe
  2⤵
  PID:9916
- C:\Windows\System\ezLKaIr.exe
  C:\Windows\System\ezLKaIr.exe
  2⤵
  PID:9940
- C:\Windows\System\uwDAPfA.exe
  C:\Windows\System\uwDAPfA.exe
  2⤵
  PID:9956
- C:\Windows\System\FnlRUUl.exe
  C:\Windows\System\FnlRUUl.exe
  2⤵
  PID:9976
- C:\Windows\System\pixslol.exe
  C:\Windows\System\pixslol.exe
  2⤵
  PID:9992
- C:\Windows\System\saebbVK.exe
  C:\Windows\System\saebbVK.exe
  2⤵
  PID:10012
- C:\Windows\System\QXkQEJQ.exe
  C:\Windows\System\QXkQEJQ.exe
  2⤵
  PID:10028
- C:\Windows\System\jzNRwSO.exe
  C:\Windows\System\jzNRwSO.exe
  2⤵
  PID:10056
- C:\Windows\System\GNYdiwi.exe
  C:\Windows\System\GNYdiwi.exe
  2⤵
  PID:10076
- C:\Windows\System\RbZPVFT.exe
  C:\Windows\System\RbZPVFT.exe
  2⤵
  PID:10096
- C:\Windows\System\ieTjViF.exe
  C:\Windows\System\ieTjViF.exe
  2⤵
  PID:10116
- C:\Windows\System\EjWoQVB.exe
  C:\Windows\System\EjWoQVB.exe
  2⤵
  PID:10132
- C:\Windows\System\xjJoZBF.exe
  C:\Windows\System\xjJoZBF.exe
  2⤵
  PID:10152
- C:\Windows\System\uFfvkxU.exe
  C:\Windows\System\uFfvkxU.exe
  2⤵
  PID:10168
- C:\Windows\System\RiFBcQo.exe
  C:\Windows\System\RiFBcQo.exe
  2⤵
  PID:10188
- C:\Windows\System\tKwcNnr.exe
  C:\Windows\System\tKwcNnr.exe
  2⤵
  PID:10208
- C:\Windows\System\wRXzdzL.exe
  C:\Windows\System\wRXzdzL.exe
  2⤵
  PID:10228
- C:\Windows\System\fnidXlK.exe
  C:\Windows\System\fnidXlK.exe
  2⤵
  PID:8720
- C:\Windows\System\JqEIqPU.exe
  C:\Windows\System\JqEIqPU.exe
  2⤵
  PID:9260
- C:\Windows\System\FEOIhJM.exe
  C:\Windows\System\FEOIhJM.exe
  2⤵
  PID:9300
- C:\Windows\System\jABFyZG.exe
  C:\Windows\System\jABFyZG.exe
  2⤵
  PID:8180
- C:\Windows\System\QiwzhgQ.exe
  C:\Windows\System\QiwzhgQ.exe
  2⤵
  PID:9276
- C:\Windows\System\ItOBNjf.exe
  C:\Windows\System\ItOBNjf.exe
  2⤵
  PID:9312
- C:\Windows\System\PJNaXFZ.exe
  C:\Windows\System\PJNaXFZ.exe
  2⤵
  PID:9364
- C:\Windows\System\SlBPLEA.exe
  C:\Windows\System\SlBPLEA.exe
  2⤵
  PID:9340
- C:\Windows\System\YxOhBdq.exe
  C:\Windows\System\YxOhBdq.exe
  2⤵
  PID:9388
- C:\Windows\System\fqSowsO.exe
  C:\Windows\System\fqSowsO.exe
  2⤵
  PID:9512
- C:\Windows\System\vypSTAY.exe
  C:\Windows\System\vypSTAY.exe
  2⤵
  PID:9384
- C:\Windows\System\ScsiVfa.exe
  C:\Windows\System\ScsiVfa.exe
  2⤵
  PID:9488
- C:\Windows\System\AVNRcya.exe
  C:\Windows\System\AVNRcya.exe
  2⤵
  PID:9556
- C:\Windows\System\aNgtOFl.exe
  C:\Windows\System\aNgtOFl.exe
  2⤵
  PID:9572
- C:\Windows\System\ABnnKow.exe
  C:\Windows\System\ABnnKow.exe
  2⤵
  PID:9604
- C:\Windows\System\WNwJmAL.exe
  C:\Windows\System\WNwJmAL.exe
  2⤵
  PID:9624
- C:\Windows\System\baxDHzm.exe
  C:\Windows\System\baxDHzm.exe
  2⤵
  PID:9684
- C:\Windows\System\UbGyOTk.exe
  C:\Windows\System\UbGyOTk.exe
  2⤵
  PID:9720
- C:\Windows\System\NdlSwTf.exe
  C:\Windows\System\NdlSwTf.exe
  2⤵
  PID:9740
- C:\Windows\System\FWOgNwm.exe
  C:\Windows\System\FWOgNwm.exe
  2⤵
  PID:9792
- C:\Windows\System\oKavmHf.exe
  C:\Windows\System\oKavmHf.exe
  2⤵
  PID:9800
- C:\Windows\System\VdaZSiE.exe
  C:\Windows\System\VdaZSiE.exe
  2⤵
  PID:9820
- C:\Windows\System\sTDnizP.exe
  C:\Windows\System\sTDnizP.exe
  2⤵
  PID:9824
- C:\Windows\System\Xyqiqdv.exe
  C:\Windows\System\Xyqiqdv.exe
  2⤵
  PID:9888
- C:\Windows\System\RUfqjCd.exe
  C:\Windows\System\RUfqjCd.exe
  2⤵
  PID:9928
- C:\Windows\System\TEuhWDv.exe
  C:\Windows\System\TEuhWDv.exe
  2⤵
  PID:9952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DNmEjZF.exe

Filesize
3.0MB

MD5
f6885e23978dae6f8a1d9a208066b9ef

SHA1
6a165679a561b3eeb63e464effa77908c574fc26

SHA256
272353f9cae336c9b24438af03151280c81e90daa1d4944a9e5e86111a665c0f

SHA512
0a7383287a4fb2585b486068c49927b8707bf0a82b52384631acbdceb048e20541c22eaf90a1bd86091973b825421d9102189dc34817a3f60ba61ea5fdf44447

Download Submit
C:\Windows\system\ELKPOXX.exe

Filesize
3.0MB

MD5
55961d449fb48c1703337c2d6606f228

SHA1
6e5c1155d7b3226bdf2e8d24b7c758bb93b8fc54

SHA256
7bb6e52380ec79d6c569396cb5ea171e8fa77c443a986826fac45e0f331d1c80

SHA512
5629378662c2b74c8822e8fa56d3d46f99012e9f0a3dc31e54a629150240e0a019e0187ae78c18919731f3f045a4ed6ba6eeb7e64d4c2367a20134687463c283

Download Submit
C:\Windows\system\ESSKXPj.exe

Filesize
3.0MB

MD5
08900283a4237f9169fb6f866669909b

SHA1
9b1d63c8f15ce260c39f0e3f629adb770afc549b

SHA256
49021b4a6497d72c9b9be9cc164a2e518998406a3c7c89782339a469680b7022

SHA512
e24c1c6e28bcc67683075b98a8376707596780d7cb3982edd058c4e497a745d9604599c6a39e709f1e6907a151ceae4730777edc985b8a2b0272371ff727a082

Download Submit
C:\Windows\system\FDCglbO.exe

Filesize
3.0MB

MD5
9e25b227faa2ad76360bd03dbcd69473

SHA1
eda549ee115b134133fae750e343f162689ca67e

SHA256
b79168e542eb0e98eb827b032a3513c16e0b4c3c15ba7d2f2f9f5b5a7843abfd

SHA512
d9eee7a85fc98dfd3443ef5db92995135176d9b02fb2cd95b9c3889a30ba58df63a6650453ac7b9e209f4a9a9b8fcc417fb450916f7c4a897ac230480b1dccaf

Download Submit
C:\Windows\system\NFDNpqi.exe

Filesize
3.0MB

MD5
32a9707e87ea6f68319957bda4b2b020

SHA1
1f7a41a1ab5435ac40c5f8e94d9ec377a276d747

SHA256
8605aeb24e1c13f3a4c4f847366e5e3f9ee29b1b41df2ba0553ad5be1c32cc25

SHA512
9cb68444348f0e6bb8349eed5b31aabe7d69d5daa362266dd6251b6c01d6a5fa40456f7456130a13393c6e48b0e836927750fef38d697e1184faa3c8fa234b70

Download Submit
C:\Windows\system\NgYzOTM.exe

Filesize
3.0MB

MD5
66144a99e6c1b374b5c132eb6368aca3

SHA1
25c1ddd9fa0e7d74501c31cbaffc1b0a1bced306

SHA256
9c04d89dd02e39aa83a506e4c542462bb084d7d9051206acf90757a037369cf0

SHA512
fa95bf7cce6ce5caab3b3d363ef5ec2b54776f5747b2c0d7236d66a157952b7d3d58ba399f3bf4b3f4e44079d3fd2fd5ca628c38a0bdd4dc11ba13198d533e20

Download Submit
C:\Windows\system\PNBxSga.exe

Filesize
3.0MB

MD5
3d3bf1502cb9c4c83ace42956e7a8516

SHA1
33cf7151d921736e3dc36bf9907c13e0386973b3

SHA256
512c5a77882f6444a957c1dc3f860f30fb9e746d35b0105d771654677f2097f6

SHA512
187b78be15c475adebb99222330140eac9835b78243704f3ab6d89b40969af96fe97deb128dab6a2e15336053e2b84a4e3a29a951270961d0657362b7cf8f3c2

Download Submit
C:\Windows\system\RQCsILX.exe

Filesize
3.0MB

MD5
17d6dbec3696afb3c80d126b09a158e6

SHA1
8fcb335cee3d204e3e5ea75fe7351dabfb3726ff

SHA256
e7e1ae03c8a11cd6b88348093250864af5bc03925d6740b0c68f5cdbd6ece2d2

SHA512
cba5e8443ba3815ac42ad551959709abd7326d4f5eb2f3d10d9ef0722a63c700c7cfad49488e5a2dcb08acf8d88bfaa9a8be5619527ee870c0c0ddd2956f3411

Download Submit
C:\Windows\system\RfjToOM.exe

Filesize
3.0MB

MD5
b74892606a936833037c0fead4ea5ab4

SHA1
125a135123fd0c63d38cd03e7fc56e50fc3bb7dd

SHA256
318637cff0c894a15d7130e471597c972e52a90b06856a1966a2d9a77d031e5e

SHA512
1f3715c47f65122117e8a1318b9509a486ffa51e132b0090f3b4bf2c2a442f0b0f350998298e4ff347240263fd42043197ca8c8df08661f7e48f56d706380f01

Download Submit
C:\Windows\system\SMYEkCj.exe

Filesize
3.0MB

MD5
7cfab80aa4158ca3c6d9e5aea26a369a

SHA1
d0c4cec1baabbdae561fa631d9d3d0e1fa9a48d6

SHA256
95876ef15a41afb2ab1f9aad3df13fe0ce206677e8c52529fd70872fbbda05d9

SHA512
f361dc7c2ece3500681e2767cc9bb9c2b2135fbbbd7e19712d81b52f6a8dcebffc3c0ee213620872ec51ed9c1aef24b15d3dbfbb039238468246e5b32de4e0e7

Download Submit
C:\Windows\system\SlwDYNm.exe

Filesize
3.0MB

MD5
584b4e81e440606bd0357bc11c88f09a

SHA1
1ce5af4d8f8d53ad7b52f0c6d73864b821aae420

SHA256
ad9a84bed04a333980f84c0abb10eb88d0379cde653fa089d7aaef9503a3db12

SHA512
28e40a70ba7abb314488174d7dd5a9dc6501ad371e3e207d8c3350104ccfca42954d54a5adac9d44727c90aba9547a5d46f3a39cb36ec52d152294ddc7418e45

Download Submit
C:\Windows\system\VhOULHA.exe

Filesize
3.0MB

MD5
0e9f2094fb67388a1cdaaeb6e68d0a12

SHA1
181d119dd50fc8408c7d11f7246a254ff4306629

SHA256
ac5623f53aa7844fcc7864601f24e1735e5f0f97603935f9a94c741149f4864a

SHA512
a5c36291e741cc9defb0dec1ac5fc80d1b58e7ddf46a63a169a9236a6ec1a019e5acb0c1faa31df41fcd5746f7648234698e09eb1ce4a8b381c84165dd603e04

Download Submit
C:\Windows\system\ZJDLqND.exe

Filesize
3.0MB

MD5
b2dff7255da7c59789a7a7e74f67102e

SHA1
7ab67fbb1f9104bda04f1c67de7e45c2b7f138d3

SHA256
6290ac622e0d0df059f370c22729c7d0713039f98036bba8fae8a0cecfd7eab3

SHA512
6a2deb9a8faf36a687b9f6e20b4b8e2b57e4354158f494c8b2bd43043341ecaf7c7d514b2180f279fcfcc33fbd2b8b2ef7c2635d6883783e93b8253d91505798

Download Submit
C:\Windows\system\eVPBxNE.exe

Filesize
3.0MB

MD5
b29bb4bf429788f69b82188f9b91d7ab

SHA1
7aebf1bed11784ddc9deca5cffe36c2d0c63c832

SHA256
3b82835b4eb09e084bd7f4265b1a4fe0b5ca4df5b4530be8bb7c7c4914d7e5eb

SHA512
ca8c275df2327b9fb90ac1bdff8710f8ff5137256b895ff2df96817c587cdde6db5ea7b4f19e4fb4d0030f99bc7b5f11f84e670fd37e2c94a2ed16bd20d16780

Download Submit
C:\Windows\system\fiWYRSV.exe

Filesize
3.0MB

MD5
85937511d39c8d4016a962ad4a8ed107

SHA1
e2e946c0e573cde3399d644b0ec3bed4ead8dbd8

SHA256
8aa87d49eba8afaeda2ec379047da9549abc0e6e753316f68c4a4d4002042272

SHA512
f810ce1a20f799ebe9d882da294cb14e366c44b6f131bbdefec6c7a11756cb6ace430685c50d6e4e54909ac40ef0630a268dbcaca3268286357c6f12fe2aab06

Download Submit
C:\Windows\system\iEoXQpy.exe

Filesize
3.0MB

MD5
a2743892c9c449932b73db194cc01b3f

SHA1
25e42011492f0b0897fa8193a250a93efe5caf8f

SHA256
19ab1c250d370c580a8ef887289b3442a8ddb82336fce1ec0ed8b359a909f259

SHA512
e59fa517d9373ce2c3b21c0f6243c9f5974cf6e3612e4dc62c937154071fcb5acec6a867908ea8a7166f2e6b652eb6b3cc23854714e8e61cc2db3b4d76c3f778

Download Submit
C:\Windows\system\iMpvFfE.exe

Filesize
3.0MB

MD5
476955df387d60fc5ea76216808d93d5

SHA1
7f58a7d5128d9244e9d5d2167b0bd9e501ced943

SHA256
6376b219f20c33b642eef17b8e2917ae9ef9e7b19b56ce2c13d26be9914dca5c

SHA512
1d8c744f06ef6e9e8ac92c85b24d8384a75c868b65a40c37b05d01bb89c6ce82f2b35fffe8827bbde5fe08582f909a960fb50251eee415dbe326e846f83b4726

Download Submit
C:\Windows\system\jpQPFPo.exe

Filesize
3.0MB

MD5
cf7952e2608ed659a65f5ef706d9f054

SHA1
d77b92086e33d80307431cac03ee236f37615fc9

SHA256
6a85554b7dc4fff2669b4a421eda52587838c27d64f76f821ad50c8e95f6ea37

SHA512
2e236cc48b5325fa7723b51432164f37a39d851a27ae46f507b270c4e3ad7afd68af85ec5761b63d0a3624511a161d0dd451a52e2168e86ca64838e43ce401fa

Download Submit
C:\Windows\system\pBslRKu.exe

Filesize
3.0MB

MD5
b60f75fd51ddacbaab7cf8afae2d927a

SHA1
81bd0ddc38c398c2f3f67283c610d7ec2d8fe699

SHA256
a81d9a3d835f079304e0762b4a04024cc7563338ee5e355d8dae1c4e8ce885f6

SHA512
94b97e1591704c176fd600a307db9e85fdd3879e8ea54852e646497bc69de8dcef9e5f58533b733dd6a20692bc1c49459423ca061b7e9501bc19b8662f51612a

Download Submit
C:\Windows\system\vYDBJVK.exe

Filesize
3.0MB

MD5
04fc2a0299419cc26bb598d054a31e6c

SHA1
6a539d4ee864aa68a81647c3df868253ef18476a

SHA256
82f64985c1231ef886fe4923e0ea7560b75058272d5cd46d5f62ee04802dab64

SHA512
a59c65963079b9e213706f42a7dcc82ce2616b12b5e441902131055e02234561cc6ccc424b2937ec57dcaa978e22d61ccb9e77305bdaa5d1ab1bff2ba16dd4f4

Download Submit
C:\Windows\system\wxejRlO.exe

Filesize
3.0MB

MD5
8dbc08f5a9c763d3dd7d12f7eef6a602

SHA1
b4971c8169663db3248f128bf2f1f812442169f5

SHA256
40eaeea585c4c2808a1578d159f8520a165c667847c5b82832ca791b096fa286

SHA512
2666edaa29425e5ea5380fdd1d76ac3efb64b3c6f6360296e96c854e61af0aa14b89aeeb0f7fcfe17cb93b410f13262a3c167519e37c0df479651d50d5bd019d

Download Submit
C:\Windows\system\xIPbTCp.exe

Filesize
3.0MB

MD5
b424cbd83b37166f51239033e58e0276

SHA1
28fc936d267b57897ac503542113ff0a741ce72a

SHA256
a99eddc9093df2be8433bcd03faa2aa9a8ff964055152a5e789f9903cbb2133a

SHA512
f8f1bdcef189a98c273d96e9ac090ac15324740a8492ada71426a09620eecf984f7bb8bd1adff40310427f96dc44a582ec8bb118acf355098d8b06d61d7c2bb8

Download Submit
C:\Windows\system\xNBSkyx.exe

Filesize
3.0MB

MD5
d9e8512807f4524ecbb6ed4251792a42

SHA1
92b15a4c026ac2234ded2856cf4d514ddd96cb13

SHA256
13cc23046955cccb02bebe3e58e09192971b3abcd7e7d86fc6a38003d2a1afc8

SHA512
8f59ddf1870aaf663744ae68ab061caa60f93a27df0b3a89a6d0e6b3ac79073e1d68a020f0fd3c95c17c798ecaf3a5c7659092f35fb80476bcb98b48c06e7edb

Download Submit
\Windows\system\HcrIhfA.exe

Filesize
3.0MB

MD5
bd893ffb7edd7d85ee486748d90ead2a

SHA1
af2cfb444676b4e6131a85166b0dc9d376699e7a

SHA256
843115c0017f64f5305c4bdf2c0952450176ab8a90f40d2a82be5fb00075d137

SHA512
44ae8af458534b66dabafa48b549dc887e7a231f90abd2509691218e2acdc7b45fdeb2aacc24dc53929c0c57fc473ef20c35375facd2541ce44c9d95a1ea08ce

Download Submit
\Windows\system\IkWepEf.exe

Filesize
3.0MB

MD5
16d31300148849799901cbf91cf86eb8

SHA1
802eae070be8767dc55200fd0cb484b82326b1f8

SHA256
58e5ece742d7de82865ac6a164df67f83d55678ca0b66940ef27748202051c59

SHA512
00bad6a6b906210959cb1c962a88f8e082439bf774f6147e53a247df93c178ba3f79c0236d6e8be327b0af17bc65f60eb1fd0635171038d22b6aae7e2401b804

Download Submit
\Windows\system\OGnSaAh.exe

Filesize
3.0MB

MD5
9767388bd4975aef874f2150faa407ef

SHA1
9bfc8caff65d1450941e2d4a1ef2557df19eecac

SHA256
980a4e47d94c182d199bee65e2cd4e24a5106e2866723e8e39ee537987c5c88f

SHA512
4dcbb3890c3b998587a7558e90d1b8d946cf09b43e97836cc94ad7cb80c46d3c74b56a67eaaceeb3fdf3ebfca2741ec2e64f8add3b2a01605a9bdfec058bf326

Download Submit
\Windows\system\UaaBjPy.exe

Filesize
3.0MB

MD5
9ef84f63e22db9e02cad67afb68c7999

SHA1
b13c29bef0a79d0b74c5836cdcf99f42984f3968

SHA256
a4d526c53951ef0d4af911d9896c31bab4c50ca8123b3f3df10f83f3f2b43a9e

SHA512
86e012e098169bcdba3c756aebcd16eb5217c39461b79732beddab9409dd96e0c0212657a53fc2a0f1929daf4e8c0698ff31750359d167c39ef91d3c682ca503

Download Submit
\Windows\system\eBPLGxy.exe

Filesize
3.0MB

MD5
85b044d76147fa5c495f732e9256847b

SHA1
dc66b42d0b88e00b47955c72f1007556abc4360b

SHA256
44d494f677d86651363e3deedc8e1f7470d174731f9a54f0740f5828c340c3af

SHA512
509e88d1c55f01423156b4b73ce385820f430f286e0e79a2be9a114caee98b499e9ca01c523fa4a64dc9fdf85d02f5a3f5209c71a535e6eff5be9c1850afffa4

Download Submit
\Windows\system\gbXjRmi.exe

Filesize
3.0MB

MD5
8b50ed4c1d0cd9cc37d62d43342537c4

SHA1
e5f127830253d89395300d8ba65f78867674202c

SHA256
0ba230f3ba38a6acd8ce0ef6e2d4fec9d1ad4f05d46811e57cfaf4b78b1ba615

SHA512
4a9fb00b709a6acfadd22372359fb7d75832f27c793afcea3ec62a97675ea631a12346ea9103c0e5ecc3323b3556fcf284b083791c6022487d865008c41fd231

Download Submit
\Windows\system\jTEgSCT.exe

Filesize
3.0MB

MD5
7dd323d9dc48f03fda239d56aef58cbf

SHA1
7184c42337b3c1b295acd26ec0265f0e0d19ba46

SHA256
8d3ab2170cac2ffdbd0b06968d95310e95568fe30ce4293de06ffcce84a09c4f

SHA512
421f2ff2cc799fe060972bec13635894d2e7b3b93e07b8a2e37d9fdc152bface7162007bf3e9106bbb23aa194c2bdd87a500c737d5001b5ee29e7a1f8987467b

Download Submit
\Windows\system\juzeays.exe

Filesize
3.0MB

MD5
bf71d0cdb0e337ad8ee1d6c42a961baa

SHA1
d092bd00c3a47dfde6d0c200480289676871be34

SHA256
8d141a5d208bb777a4d50786b6884ad23b08f21cd25c893b7cfe677ef792cb0e

SHA512
c26d6ac3d043cab4b323a6ef50958c4fb2ceebd68a218a434360ab6e62362280c68f9ab35ea119ca5931aa4aaa774c07ade8ce75c1d45ec9e602393b12e2667c

Download Submit
\Windows\system\ziHkRGJ.exe

Filesize
3.0MB

MD5
2476152f322ee141b840ac2b79681459

SHA1
a887a165f261a6f55d9ac939f366e67efcb044af

SHA256
5159c13498ae89938b1506aaab8f483630121ca672958e006778d45448b247de

SHA512
a4c6c6416bb248f7793b28c1bdd4f89355327bd7675d4f8bce50a441ca021e164fde422db1d10e7007c110996082cc171faf541c3edb7a2c69466b34016bfd38

Download Submit
memory/1700-2034-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/1700-4290-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2204-83-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/2204-32-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2204-33-0x000007FEF549E000-0x000007FEF549F000-memory.dmp

Filesize
4KB

Download
memory/2204-28-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/2204-19-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2204-4280-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-117-0x000007FEF51E0000-0x000007FEF5B7D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2348-1157-0x000000013FB90000-0x000000013FF86000-memory.dmp

Filesize
4.0MB

Download
memory/2348-0-0x000000013F2C0000-0x000000013F6B6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-1298-0x0000000003A30000-0x0000000003E26000-memory.dmp

Filesize
4.0MB

Download
memory/2348-2341-0x0000000003A30000-0x0000000003E26000-memory.dmp

Filesize
4.0MB

Download
memory/2348-1412-0x000000013FC90000-0x0000000140086000-memory.dmp

Filesize
4.0MB

Download
memory/2348-2342-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2348-17-0x00000000032D0000-0x00000000036C6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-1447-0x0000000003A30000-0x0000000003E26000-memory.dmp

Filesize
4.0MB

Download
memory/2348-1468-0x000000013F9B0000-0x000000013FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2348-2040-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2392-8-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2392-4281-0x000000013F080000-0x000000013F476000-memory.dmp

Filesize
4.0MB

Download
memory/2424-4289-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2424-1353-0x000000013F780000-0x000000013FB76000-memory.dmp

Filesize
4.0MB

Download
memory/2532-4282-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2532-1156-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Filesize
4.0MB

Download
memory/2544-4285-0x000000013F360000-0x000000013F756000-memory.dmp

Filesize
4.0MB

Download
memory/2544-1409-0x000000013F360000-0x000000013F756000-memory.dmp

Filesize
4.0MB

Download
memory/2588-2339-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2588-4288-0x000000013FDE0000-0x00000001401D6000-memory.dmp

Filesize
4.0MB

Download
memory/2688-4283-0x000000013FB90000-0x000000013FF86000-memory.dmp

Filesize
4.0MB

Download
memory/2688-1281-0x000000013FB90000-0x000000013FF86000-memory.dmp

Filesize
4.0MB

Download
memory/2700-1458-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2700-4286-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2728-4279-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-4284-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2728-31-0x000000013F3D0000-0x000000013F7C6000-memory.dmp

Filesize
4.0MB

Download
memory/2960-1444-0x000000013FC90000-0x0000000140086000-memory.dmp

Filesize
4.0MB

Download
memory/2960-4287-0x000000013FC90000-0x0000000140086000-memory.dmp

Filesize
4.0MB

Download