xmrig | 0ebd43078dc042876431735deaa757542b0dddb36dd2a1b6a54b67cf830120ab

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
Size

2.9MB
MD5

560ae8f2a113c175d8bf896e3d8a78c0
SHA1

4a5aa53c96d58d42e7e3914477a6b5dc777f001f
SHA256

0ebd43078dc042876431735deaa757542b0dddb36dd2a1b6a54b67cf830120ab
SHA512

b09b4153c65d4c20142fc61ad6e90222a0f55e80ba9f004954759401ac15cb0e23a22a16f54d2b83e57ddd0649cc5cc5665bc2705691bf63018e681552e47b1a
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdk2a2yKmf:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral1/memory/3064-1-0x000000013F750000-0x000000013FB46000-memory.dmp	xmrig
behavioral1/files/0x000c000000013417-6.dat	xmrig
behavioral1/memory/2972-9-0x000000013FC20000-0x0000000140016000-memory.dmp	xmrig
behavioral1/files/0x0007000000014183-19.dat	xmrig
behavioral1/files/0x0036000000013a53-13.dat	xmrig
behavioral1/memory/2772-27-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/files/0x0016000000005586-28.dat	xmrig
behavioral1/memory/3064-29-0x000000013F110000-0x000000013F506000-memory.dmp	xmrig
behavioral1/memory/2780-23-0x000000013FC80000-0x0000000140076000-memory.dmp	xmrig
behavioral1/files/0x0008000000014251-34.dat	xmrig
behavioral1/files/0x000b00000001431b-41.dat	xmrig
behavioral1/files/0x000800000001432f-47.dat	xmrig
behavioral1/files/0x00070000000143fb-51.dat	xmrig
behavioral1/files/0x0006000000014b1c-59.dat	xmrig
behavioral1/files/0x000600000001507a-76.dat	xmrig
behavioral1/files/0x00060000000150d9-84.dat	xmrig
behavioral1/files/0x0006000000015662-96.dat	xmrig
behavioral1/memory/2464-99-0x000000013F110000-0x000000013F506000-memory.dmp	xmrig
behavioral1/files/0x000600000001565a-92.dat	xmrig
behavioral1/memory/2712-104-0x000000013F510000-0x000000013F906000-memory.dmp	xmrig
behavioral1/files/0x00060000000158d9-102.dat	xmrig
behavioral1/files/0x0006000000015ae3-136.dat	xmrig
behavioral1/files/0x0036000000013a88-144.dat	xmrig
behavioral1/files/0x0006000000015cee-170.dat	xmrig
behavioral1/files/0x0006000000015cd2-165.dat	xmrig
behavioral1/files/0x0006000000015cb1-158.dat	xmrig
behavioral1/files/0x0006000000015c9a-151.dat	xmrig
behavioral1/memory/2472-112-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	xmrig
behavioral1/memory/3048-110-0x000000013FB20000-0x000000013FF16000-memory.dmp	xmrig
behavioral1/memory/2136-108-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2456-106-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/files/0x00060000000153ee-88.dat	xmrig
behavioral1/files/0x0006000000015d39-186.dat	xmrig
behavioral1/files/0x0006000000015ca8-153.dat	xmrig
behavioral1/files/0x0006000000015b85-146.dat	xmrig
behavioral1/files/0x0006000000015cc5-160.dat	xmrig
behavioral1/files/0x0006000000015ce3-167.dat	xmrig
behavioral1/memory/3064-127-0x0000000003790000-0x0000000003B86000-memory.dmp	xmrig
behavioral1/memory/2664-126-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d59-188.dat	xmrig
behavioral1/files/0x0006000000015d21-181.dat	xmrig
behavioral1/files/0x0006000000015cf8-174.dat	xmrig
behavioral1/files/0x0006000000015b50-139.dat	xmrig
behavioral1/memory/3064-2310-0x000000013F750000-0x000000013FB46000-memory.dmp	xmrig
behavioral1/memory/2400-124-0x000000013FFE0000-0x00000001403D6000-memory.dmp	xmrig
behavioral1/memory/2004-122-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d0a-179.dat	xmrig
behavioral1/files/0x0006000000015083-80.dat	xmrig
behavioral1/files/0x0006000000014f57-72.dat	xmrig
behavioral1/files/0x0006000000014c2d-68.dat	xmrig
behavioral1/files/0x0006000000014bd7-63.dat	xmrig
behavioral1/files/0x0006000000014a60-55.dat	xmrig
behavioral1/memory/2456-5235-0x000000013FB00000-0x000000013FEF6000-memory.dmp	xmrig
behavioral1/memory/2136-5239-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2472-5247-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	xmrig
behavioral1/memory/2004-5255-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
behavioral1/memory/2664-5257-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/memory/2136-6560-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	xmrig
behavioral1/memory/2664-6572-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/memory/2004-6570-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1588	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2972	cOpPKno.exe
2780	jzXLPwg.exe
2772	CmHDdKn.exe
2464	iSFNmLG.exe
2712	JbhChrf.exe
2456	zQNKTXu.exe
2136	ruFlqrm.exe
3048	bceFOpa.exe
2472	kzdabqL.exe
2004	KaQnxfW.exe
2400	ZnbAYZb.exe
2664	NjqlSOk.exe
2660	qxXJCWg.exe
2752	bskYIvs.exe
1560	TPrxZDJ.exe
2352	ZVTzXoJ.exe
2000	jmjdKvd.exe
2012	SdYDhqE.exe
1056	ADOYNAI.exe
1568	aJsuveF.exe
2404	TVYDLha.exe
324	aDWpcDG.exe
1408	QigTQYg.exe
1400	vhgUeDw.exe
2288	gvuXzOF.exe
2100	iPSToFO.exe
1184	CqPACAs.exe
2140	xPdqIoH.exe
836	jMOcwFZ.exe
1928	cHYAUzk.exe
1908	yiZnvcL.exe
1132	klGtZBb.exe
2808	aEbtaZO.exe
2764	KxXQyio.exe
2200	zZybeMR.exe
2188	VptzSsc.exe
884	RMdBCEf.exe
1988	SSCgziU.exe
2760	TVsiYsr.exe
1524	IEGBXHq.exe
2556	daiyotC.exe
2324	wVarNht.exe
2596	jpoBryl.exe
2412	ONoBeQn.exe
2340	epXIVLH.exe
2032	mTlumcZ.exe
488	MauiWJZ.exe
2160	rclWdZa.exe
1292	APcEQKr.exe
2108	lGnYqNn.exe
1640	hyZzRNo.exe
1520	IuPRtfu.exe
2864	xIfJuGW.exe
616	eOXUczM.exe
1212	EzqFrXq.exe
1912	oNZwlCR.exe
3092	YcNQeos.exe
3124	graeLWK.exe
3156	iuLZNyz.exe
2252	buLEprW.exe
816	pctlTAS.exe
3188	nFJIkVC.exe
2112	bGyaPkT.exe
848	yODNjSd.exe

Loads dropped DLL 64 IoCs

pid	Process
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3064-1-0x000000013F750000-0x000000013FB46000-memory.dmp	upx
behavioral1/files/0x000c000000013417-6.dat	upx
behavioral1/memory/2972-9-0x000000013FC20000-0x0000000140016000-memory.dmp	upx
behavioral1/files/0x0007000000014183-19.dat	upx
behavioral1/files/0x0036000000013a53-13.dat	upx
behavioral1/memory/2772-27-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/files/0x0016000000005586-28.dat	upx
behavioral1/memory/3064-29-0x000000013F110000-0x000000013F506000-memory.dmp	upx
behavioral1/memory/2780-23-0x000000013FC80000-0x0000000140076000-memory.dmp	upx
behavioral1/files/0x0008000000014251-34.dat	upx
behavioral1/files/0x000b00000001431b-41.dat	upx
behavioral1/files/0x000800000001432f-47.dat	upx
behavioral1/files/0x00070000000143fb-51.dat	upx
behavioral1/files/0x0006000000014b1c-59.dat	upx
behavioral1/files/0x000600000001507a-76.dat	upx
behavioral1/files/0x00060000000150d9-84.dat	upx
behavioral1/files/0x0006000000015662-96.dat	upx
behavioral1/memory/2464-99-0x000000013F110000-0x000000013F506000-memory.dmp	upx
behavioral1/files/0x000600000001565a-92.dat	upx
behavioral1/memory/2712-104-0x000000013F510000-0x000000013F906000-memory.dmp	upx
behavioral1/files/0x00060000000158d9-102.dat	upx
behavioral1/files/0x0006000000015ae3-136.dat	upx
behavioral1/files/0x0036000000013a88-144.dat	upx
behavioral1/files/0x0006000000015cee-170.dat	upx
behavioral1/files/0x0006000000015cd2-165.dat	upx
behavioral1/files/0x0006000000015cb1-158.dat	upx
behavioral1/files/0x0006000000015c9a-151.dat	upx
behavioral1/memory/2472-112-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	upx
behavioral1/memory/3048-110-0x000000013FB20000-0x000000013FF16000-memory.dmp	upx
behavioral1/memory/2136-108-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2456-106-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/files/0x00060000000153ee-88.dat	upx
behavioral1/files/0x0006000000015d39-186.dat	upx
behavioral1/files/0x0006000000015ca8-153.dat	upx
behavioral1/files/0x0006000000015b85-146.dat	upx
behavioral1/files/0x0006000000015cc5-160.dat	upx
behavioral1/files/0x0006000000015ce3-167.dat	upx
behavioral1/memory/2664-126-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/files/0x0006000000015d59-188.dat	upx
behavioral1/files/0x0006000000015d21-181.dat	upx
behavioral1/files/0x0006000000015cf8-174.dat	upx
behavioral1/files/0x0006000000015b50-139.dat	upx
behavioral1/memory/3064-2310-0x000000013F750000-0x000000013FB46000-memory.dmp	upx
behavioral1/memory/2400-124-0x000000013FFE0000-0x00000001403D6000-memory.dmp	upx
behavioral1/memory/2004-122-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
behavioral1/files/0x0006000000015d0a-179.dat	upx
behavioral1/files/0x0006000000015083-80.dat	upx
behavioral1/files/0x0006000000014f57-72.dat	upx
behavioral1/files/0x0006000000014c2d-68.dat	upx
behavioral1/files/0x0006000000014bd7-63.dat	upx
behavioral1/files/0x0006000000014a60-55.dat	upx
behavioral1/memory/2456-5235-0x000000013FB00000-0x000000013FEF6000-memory.dmp	upx
behavioral1/memory/2136-5239-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2472-5247-0x000000013FBC0000-0x000000013FFB6000-memory.dmp	upx
behavioral1/memory/2004-5255-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
behavioral1/memory/2664-5257-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/memory/2136-6560-0x000000013FBE0000-0x000000013FFD6000-memory.dmp	upx
behavioral1/memory/2664-6572-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/memory/2004-6570-0x000000013FD40000-0x0000000140136000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vUKhRYk.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\bcgAVDe.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\qDKXwmG.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\bYeYgLP.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\rXgXBEj.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\MBTZXcR.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\FwqIAPt.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\pMQyodc.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\ydlyAmj.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\DWQDRXd.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\NOCXPpC.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\dpjAXTf.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\jykxTTe.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\GgCQCQW.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\noPMpld.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\WxOVKNN.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\wWSYXyL.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\BxConRn.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\dtqFZXP.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\nLdtfXE.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\hWrZUTg.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\ejLJVNi.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\gmrKwXG.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\eDrXpAA.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\QdOtMRq.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\pLLbDYl.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\oTvLCuM.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\LbXKgmT.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\nVBbbfQ.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\TUgSlNB.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\aUgziRN.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\kxZsSrn.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\vrNFLGp.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\hLETPEV.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\BHHRaJd.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\oXOGOxO.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\IaQmdbE.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\AgZGBNU.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\CCcuChP.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\OGbPlvp.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\PgdjvHT.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\ZijDYYn.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\UQAQbEA.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\qKvoamG.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\hiXOMtd.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\DitAVvu.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\dHqAaNe.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\wCGVNwc.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\lyHgEXY.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\QbjWTBy.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\HovoCgl.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\YkpkPcC.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\HikHExc.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\rGmSNrX.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\LLieWNe.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\aJsgAer.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\bnelFwv.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\fYsXrpc.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\PIQDoEv.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\ThptElI.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\AETFjVv.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\oIbDxlu.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\TVVlVRR.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
File created	C:\Windows\System\uSDxJTv.exe	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1588	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1588	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1588	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	29
PID 3064 wrote to memory of 1588	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	29
PID 3064 wrote to memory of 1588	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	29
PID 3064 wrote to memory of 2972	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	30
PID 3064 wrote to memory of 2972	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	30
PID 3064 wrote to memory of 2972	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	30
PID 3064 wrote to memory of 2780	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	31
PID 3064 wrote to memory of 2780	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	31
PID 3064 wrote to memory of 2780	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	31
PID 3064 wrote to memory of 2772	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	32
PID 3064 wrote to memory of 2772	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	32
PID 3064 wrote to memory of 2772	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	32
PID 3064 wrote to memory of 2464	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	33
PID 3064 wrote to memory of 2464	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	33
PID 3064 wrote to memory of 2464	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	33
PID 3064 wrote to memory of 2712	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	34
PID 3064 wrote to memory of 2712	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	34
PID 3064 wrote to memory of 2712	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	34
PID 3064 wrote to memory of 2456	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	35
PID 3064 wrote to memory of 2456	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	35
PID 3064 wrote to memory of 2456	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	35
PID 3064 wrote to memory of 2136	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	36
PID 3064 wrote to memory of 2136	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	36
PID 3064 wrote to memory of 2136	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	36
PID 3064 wrote to memory of 3048	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	37
PID 3064 wrote to memory of 3048	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	37
PID 3064 wrote to memory of 3048	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	37
PID 3064 wrote to memory of 2472	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	38
PID 3064 wrote to memory of 2472	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	38
PID 3064 wrote to memory of 2472	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	38
PID 3064 wrote to memory of 2004	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	39
PID 3064 wrote to memory of 2004	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	39
PID 3064 wrote to memory of 2004	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	39
PID 3064 wrote to memory of 2400	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	40
PID 3064 wrote to memory of 2400	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	40
PID 3064 wrote to memory of 2400	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	40
PID 3064 wrote to memory of 2664	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	41
PID 3064 wrote to memory of 2664	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	41
PID 3064 wrote to memory of 2664	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	41
PID 3064 wrote to memory of 2660	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	42
PID 3064 wrote to memory of 2660	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	42
PID 3064 wrote to memory of 2660	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	42
PID 3064 wrote to memory of 2752	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	43
PID 3064 wrote to memory of 2752	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	43
PID 3064 wrote to memory of 2752	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	43
PID 3064 wrote to memory of 1560	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	44
PID 3064 wrote to memory of 1560	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	44
PID 3064 wrote to memory of 1560	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	44
PID 3064 wrote to memory of 2352	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	45
PID 3064 wrote to memory of 2352	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	45
PID 3064 wrote to memory of 2352	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	45
PID 3064 wrote to memory of 2000	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	46
PID 3064 wrote to memory of 2000	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	46
PID 3064 wrote to memory of 2000	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	46
PID 3064 wrote to memory of 2012	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	47
PID 3064 wrote to memory of 2012	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	47
PID 3064 wrote to memory of 2012	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	47
PID 3064 wrote to memory of 1056	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	48
PID 3064 wrote to memory of 1056	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	48
PID 3064 wrote to memory of 1056	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	48
PID 3064 wrote to memory of 1568	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	49
PID 3064 wrote to memory of 1568	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	49
PID 3064 wrote to memory of 1568	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	49
PID 3064 wrote to memory of 2404	3064	560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\560ae8f2a113c175d8bf896e3d8a78c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\System\cOpPKno.exe
  C:\Windows\System\cOpPKno.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\jzXLPwg.exe
  C:\Windows\System\jzXLPwg.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\CmHDdKn.exe
  C:\Windows\System\CmHDdKn.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\iSFNmLG.exe
  C:\Windows\System\iSFNmLG.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\JbhChrf.exe
  C:\Windows\System\JbhChrf.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\zQNKTXu.exe
  C:\Windows\System\zQNKTXu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\ruFlqrm.exe
  C:\Windows\System\ruFlqrm.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\bceFOpa.exe
  C:\Windows\System\bceFOpa.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\kzdabqL.exe
  C:\Windows\System\kzdabqL.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\KaQnxfW.exe
  C:\Windows\System\KaQnxfW.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ZnbAYZb.exe
  C:\Windows\System\ZnbAYZb.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\NjqlSOk.exe
  C:\Windows\System\NjqlSOk.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\qxXJCWg.exe
  C:\Windows\System\qxXJCWg.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\bskYIvs.exe
  C:\Windows\System\bskYIvs.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\TPrxZDJ.exe
  C:\Windows\System\TPrxZDJ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ZVTzXoJ.exe
  C:\Windows\System\ZVTzXoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\jmjdKvd.exe
  C:\Windows\System\jmjdKvd.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\SdYDhqE.exe
  C:\Windows\System\SdYDhqE.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\ADOYNAI.exe
  C:\Windows\System\ADOYNAI.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\aJsuveF.exe
  C:\Windows\System\aJsuveF.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\TVYDLha.exe
  C:\Windows\System\TVYDLha.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\buLEprW.exe
  C:\Windows\System\buLEprW.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\aDWpcDG.exe
  C:\Windows\System\aDWpcDG.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\pctlTAS.exe
  C:\Windows\System\pctlTAS.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\QigTQYg.exe
  C:\Windows\System\QigTQYg.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\bGyaPkT.exe
  C:\Windows\System\bGyaPkT.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\vhgUeDw.exe
  C:\Windows\System\vhgUeDw.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\yODNjSd.exe
  C:\Windows\System\yODNjSd.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\gvuXzOF.exe
  C:\Windows\System\gvuXzOF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\oUiGTIK.exe
  C:\Windows\System\oUiGTIK.exe
  2⤵
  PID:812
- C:\Windows\System\iPSToFO.exe
  C:\Windows\System\iPSToFO.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\fXETaip.exe
  C:\Windows\System\fXETaip.exe
  2⤵
  PID:1028
- C:\Windows\System\CqPACAs.exe
  C:\Windows\System\CqPACAs.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\mYjZYsA.exe
  C:\Windows\System\mYjZYsA.exe
  2⤵
  PID:2368
- C:\Windows\System\xPdqIoH.exe
  C:\Windows\System\xPdqIoH.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\TQLtYoI.exe
  C:\Windows\System\TQLtYoI.exe
  2⤵
  PID:1772
- C:\Windows\System\jMOcwFZ.exe
  C:\Windows\System\jMOcwFZ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\rgLexuy.exe
  C:\Windows\System\rgLexuy.exe
  2⤵
  PID:1288
- C:\Windows\System\cHYAUzk.exe
  C:\Windows\System\cHYAUzk.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\NQiHRZi.exe
  C:\Windows\System\NQiHRZi.exe
  2⤵
  PID:1900
- C:\Windows\System\yiZnvcL.exe
  C:\Windows\System\yiZnvcL.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\doUiulX.exe
  C:\Windows\System\doUiulX.exe
  2⤵
  PID:852
- C:\Windows\System\klGtZBb.exe
  C:\Windows\System\klGtZBb.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\NAbUYbX.exe
  C:\Windows\System\NAbUYbX.exe
  2⤵
  PID:2840
- C:\Windows\System\aEbtaZO.exe
  C:\Windows\System\aEbtaZO.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\TcIjvxI.exe
  C:\Windows\System\TcIjvxI.exe
  2⤵
  PID:2920
- C:\Windows\System\KxXQyio.exe
  C:\Windows\System\KxXQyio.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\UEQgKCa.exe
  C:\Windows\System\UEQgKCa.exe
  2⤵
  PID:1984
- C:\Windows\System\zZybeMR.exe
  C:\Windows\System\zZybeMR.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\RxchQDl.exe
  C:\Windows\System\RxchQDl.exe
  2⤵
  PID:1188
- C:\Windows\System\VptzSsc.exe
  C:\Windows\System\VptzSsc.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\owjxSfU.exe
  C:\Windows\System\owjxSfU.exe
  2⤵
  PID:1972
- C:\Windows\System\RMdBCEf.exe
  C:\Windows\System\RMdBCEf.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\uGOqnmO.exe
  C:\Windows\System\uGOqnmO.exe
  2⤵
  PID:3052
- C:\Windows\System\SSCgziU.exe
  C:\Windows\System\SSCgziU.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\EsgfHEJ.exe
  C:\Windows\System\EsgfHEJ.exe
  2⤵
  PID:1700
- C:\Windows\System\TVsiYsr.exe
  C:\Windows\System\TVsiYsr.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\JpRoEnN.exe
  C:\Windows\System\JpRoEnN.exe
  2⤵
  PID:1632
- C:\Windows\System\IEGBXHq.exe
  C:\Windows\System\IEGBXHq.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\kELhwgb.exe
  C:\Windows\System\kELhwgb.exe
  2⤵
  PID:2584
- C:\Windows\System\daiyotC.exe
  C:\Windows\System\daiyotC.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\PCXZWUG.exe
  C:\Windows\System\PCXZWUG.exe
  2⤵
  PID:2728
- C:\Windows\System\wVarNht.exe
  C:\Windows\System\wVarNht.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\lnNZCKh.exe
  C:\Windows\System\lnNZCKh.exe
  2⤵
  PID:2144
- C:\Windows\System\jpoBryl.exe
  C:\Windows\System\jpoBryl.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\pRUMhyZ.exe
  C:\Windows\System\pRUMhyZ.exe
  2⤵
  PID:2008
- C:\Windows\System\ONoBeQn.exe
  C:\Windows\System\ONoBeQn.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\vGwwXdc.exe
  C:\Windows\System\vGwwXdc.exe
  2⤵
  PID:2748
- C:\Windows\System\epXIVLH.exe
  C:\Windows\System\epXIVLH.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\eAnXsTE.exe
  C:\Windows\System\eAnXsTE.exe
  2⤵
  PID:1544
- C:\Windows\System\mTlumcZ.exe
  C:\Windows\System\mTlumcZ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\KfJcysD.exe
  C:\Windows\System\KfJcysD.exe
  2⤵
  PID:2512
- C:\Windows\System\MauiWJZ.exe
  C:\Windows\System\MauiWJZ.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\PcvBEVg.exe
  C:\Windows\System\PcvBEVg.exe
  2⤵
  PID:1800
- C:\Windows\System\rclWdZa.exe
  C:\Windows\System\rclWdZa.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\HgWFCte.exe
  C:\Windows\System\HgWFCte.exe
  2⤵
  PID:2796
- C:\Windows\System\APcEQKr.exe
  C:\Windows\System\APcEQKr.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\bGATjlm.exe
  C:\Windows\System\bGATjlm.exe
  2⤵
  PID:2628
- C:\Windows\System\lGnYqNn.exe
  C:\Windows\System\lGnYqNn.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\pksDVPs.exe
  C:\Windows\System\pksDVPs.exe
  2⤵
  PID:2956
- C:\Windows\System\hyZzRNo.exe
  C:\Windows\System\hyZzRNo.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\bRcpRnr.exe
  C:\Windows\System\bRcpRnr.exe
  2⤵
  PID:2272
- C:\Windows\System\IuPRtfu.exe
  C:\Windows\System\IuPRtfu.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ZxnRNvf.exe
  C:\Windows\System\ZxnRNvf.exe
  2⤵
  PID:2428
- C:\Windows\System\xIfJuGW.exe
  C:\Windows\System\xIfJuGW.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\ComNQgO.exe
  C:\Windows\System\ComNQgO.exe
  2⤵
  PID:1864
- C:\Windows\System\eOXUczM.exe
  C:\Windows\System\eOXUczM.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\zxRBYqo.exe
  C:\Windows\System\zxRBYqo.exe
  2⤵
  PID:2636
- C:\Windows\System\EzqFrXq.exe
  C:\Windows\System\EzqFrXq.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\jTEGbez.exe
  C:\Windows\System\jTEGbez.exe
  2⤵
  PID:1952
- C:\Windows\System\oNZwlCR.exe
  C:\Windows\System\oNZwlCR.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\WSrmiAD.exe
  C:\Windows\System\WSrmiAD.exe
  2⤵
  PID:3076
- C:\Windows\System\YcNQeos.exe
  C:\Windows\System\YcNQeos.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\AlOSYxy.exe
  C:\Windows\System\AlOSYxy.exe
  2⤵
  PID:3108
- C:\Windows\System\graeLWK.exe
  C:\Windows\System\graeLWK.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\UCqSobQ.exe
  C:\Windows\System\UCqSobQ.exe
  2⤵
  PID:3140
- C:\Windows\System\iuLZNyz.exe
  C:\Windows\System\iuLZNyz.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ujnmGNm.exe
  C:\Windows\System\ujnmGNm.exe
  2⤵
  PID:3172
- C:\Windows\System\nFJIkVC.exe
  C:\Windows\System\nFJIkVC.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\yJvTnDR.exe
  C:\Windows\System\yJvTnDR.exe
  2⤵
  PID:3412
- C:\Windows\System\BqkcQqn.exe
  C:\Windows\System\BqkcQqn.exe
  2⤵
  PID:3616
- C:\Windows\System\AxfXoMu.exe
  C:\Windows\System\AxfXoMu.exe
  2⤵
  PID:3636
- C:\Windows\System\aToXxoX.exe
  C:\Windows\System\aToXxoX.exe
  2⤵
  PID:3656
- C:\Windows\System\HJDWxXn.exe
  C:\Windows\System\HJDWxXn.exe
  2⤵
  PID:3676
- C:\Windows\System\hzCVbYZ.exe
  C:\Windows\System\hzCVbYZ.exe
  2⤵
  PID:3696
- C:\Windows\System\rlIteYq.exe
  C:\Windows\System\rlIteYq.exe
  2⤵
  PID:3716
- C:\Windows\System\iyEJbJX.exe
  C:\Windows\System\iyEJbJX.exe
  2⤵
  PID:3736
- C:\Windows\System\PwKNAOK.exe
  C:\Windows\System\PwKNAOK.exe
  2⤵
  PID:3756
- C:\Windows\System\nIbUfRg.exe
  C:\Windows\System\nIbUfRg.exe
  2⤵
  PID:3776
- C:\Windows\System\aazLFDG.exe
  C:\Windows\System\aazLFDG.exe
  2⤵
  PID:3796
- C:\Windows\System\VRwttmJ.exe
  C:\Windows\System\VRwttmJ.exe
  2⤵
  PID:3816
- C:\Windows\System\DGGKlGq.exe
  C:\Windows\System\DGGKlGq.exe
  2⤵
  PID:3836
- C:\Windows\System\yOusjEH.exe
  C:\Windows\System\yOusjEH.exe
  2⤵
  PID:3856
- C:\Windows\System\gzXPueH.exe
  C:\Windows\System\gzXPueH.exe
  2⤵
  PID:3872
- C:\Windows\System\CehJtBq.exe
  C:\Windows\System\CehJtBq.exe
  2⤵
  PID:3892
- C:\Windows\System\sllCiHV.exe
  C:\Windows\System\sllCiHV.exe
  2⤵
  PID:3908
- C:\Windows\System\PvwtyDV.exe
  C:\Windows\System\PvwtyDV.exe
  2⤵
  PID:3932
- C:\Windows\System\uUeLcZs.exe
  C:\Windows\System\uUeLcZs.exe
  2⤵
  PID:3948
- C:\Windows\System\lQjBvJz.exe
  C:\Windows\System\lQjBvJz.exe
  2⤵
  PID:3968
- C:\Windows\System\PPfLchi.exe
  C:\Windows\System\PPfLchi.exe
  2⤵
  PID:3984
- C:\Windows\System\PdNGbuV.exe
  C:\Windows\System\PdNGbuV.exe
  2⤵
  PID:4000
- C:\Windows\System\JRTSdxv.exe
  C:\Windows\System\JRTSdxv.exe
  2⤵
  PID:4016
- C:\Windows\System\FcDLTTp.exe
  C:\Windows\System\FcDLTTp.exe
  2⤵
  PID:4032
- C:\Windows\System\jiOcyGx.exe
  C:\Windows\System\jiOcyGx.exe
  2⤵
  PID:4056
- C:\Windows\System\nAvzRTp.exe
  C:\Windows\System\nAvzRTp.exe
  2⤵
  PID:4072
- C:\Windows\System\jWrmrtD.exe
  C:\Windows\System\jWrmrtD.exe
  2⤵
  PID:4088
- C:\Windows\System\nqAFOfA.exe
  C:\Windows\System\nqAFOfA.exe
  2⤵
  PID:2648
- C:\Windows\System\SCIOVjZ.exe
  C:\Windows\System\SCIOVjZ.exe
  2⤵
  PID:3132
- C:\Windows\System\XOakEij.exe
  C:\Windows\System\XOakEij.exe
  2⤵
  PID:1576
- C:\Windows\System\wbDdOpa.exe
  C:\Windows\System\wbDdOpa.exe
  2⤵
  PID:328
- C:\Windows\System\ZNvIyPB.exe
  C:\Windows\System\ZNvIyPB.exe
  2⤵
  PID:2884
- C:\Windows\System\vRxmsqv.exe
  C:\Windows\System\vRxmsqv.exe
  2⤵
  PID:1704
- C:\Windows\System\oXOGOxO.exe
  C:\Windows\System\oXOGOxO.exe
  2⤵
  PID:2356
- C:\Windows\System\fWJyZKe.exe
  C:\Windows\System\fWJyZKe.exe
  2⤵
  PID:2692
- C:\Windows\System\rONWLwx.exe
  C:\Windows\System\rONWLwx.exe
  2⤵
  PID:3236
- C:\Windows\System\WKcTtyY.exe
  C:\Windows\System\WKcTtyY.exe
  2⤵
  PID:3268
- C:\Windows\System\imxBuAs.exe
  C:\Windows\System\imxBuAs.exe
  2⤵
  PID:3280
- C:\Windows\System\UNLnMlt.exe
  C:\Windows\System\UNLnMlt.exe
  2⤵
  PID:3300
- C:\Windows\System\JgffIpM.exe
  C:\Windows\System\JgffIpM.exe
  2⤵
  PID:3320
- C:\Windows\System\ovAwtAO.exe
  C:\Windows\System\ovAwtAO.exe
  2⤵
  PID:3340
- C:\Windows\System\PpWoQMN.exe
  C:\Windows\System\PpWoQMN.exe
  2⤵
  PID:3356
- C:\Windows\System\BHbAdTc.exe
  C:\Windows\System\BHbAdTc.exe
  2⤵
  PID:3372
- C:\Windows\System\amqdAXC.exe
  C:\Windows\System\amqdAXC.exe
  2⤵
  PID:912
- C:\Windows\System\YOOGJjq.exe
  C:\Windows\System\YOOGJjq.exe
  2⤵
  PID:3396
- C:\Windows\System\FQPfYyN.exe
  C:\Windows\System\FQPfYyN.exe
  2⤵
  PID:1852
- C:\Windows\System\gchXGxU.exe
  C:\Windows\System\gchXGxU.exe
  2⤵
  PID:3400
- C:\Windows\System\sNKHrSg.exe
  C:\Windows\System\sNKHrSg.exe
  2⤵
  PID:1496
- C:\Windows\System\fnihCte.exe
  C:\Windows\System\fnihCte.exe
  2⤵
  PID:1792
- C:\Windows\System\wnjLrJF.exe
  C:\Windows\System\wnjLrJF.exe
  2⤵
  PID:2212
- C:\Windows\System\zXnyOZK.exe
  C:\Windows\System\zXnyOZK.exe
  2⤵
  PID:844
- C:\Windows\System\jUzykaw.exe
  C:\Windows\System\jUzykaw.exe
  2⤵
  PID:3532
- C:\Windows\System\hOvNXNB.exe
  C:\Windows\System\hOvNXNB.exe
  2⤵
  PID:2168
- C:\Windows\System\DSqZulE.exe
  C:\Windows\System\DSqZulE.exe
  2⤵
  PID:2624
- C:\Windows\System\kPHWhxZ.exe
  C:\Windows\System\kPHWhxZ.exe
  2⤵
  PID:2500
- C:\Windows\System\lVgMuOB.exe
  C:\Windows\System\lVgMuOB.exe
  2⤵
  PID:3088
- C:\Windows\System\bgKPJFu.exe
  C:\Windows\System\bgKPJFu.exe
  2⤵
  PID:3180
- C:\Windows\System\VUdlqJz.exe
  C:\Windows\System\VUdlqJz.exe
  2⤵
  PID:1652
- C:\Windows\System\mrFhGRM.exe
  C:\Windows\System\mrFhGRM.exe
  2⤵
  PID:3444
- C:\Windows\System\klpQrlX.exe
  C:\Windows\System\klpQrlX.exe
  2⤵
  PID:580
- C:\Windows\System\gRRioZd.exe
  C:\Windows\System\gRRioZd.exe
  2⤵
  PID:3460
- C:\Windows\System\XDvcYHw.exe
  C:\Windows\System\XDvcYHw.exe
  2⤵
  PID:3484
- C:\Windows\System\bflnmnW.exe
  C:\Windows\System\bflnmnW.exe
  2⤵
  PID:964
- C:\Windows\System\xqyAXHQ.exe
  C:\Windows\System\xqyAXHQ.exe
  2⤵
  PID:392
- C:\Windows\System\bQtlaTX.exe
  C:\Windows\System\bQtlaTX.exe
  2⤵
  PID:1352
- C:\Windows\System\OIrMXQk.exe
  C:\Windows\System\OIrMXQk.exe
  2⤵
  PID:2420
- C:\Windows\System\evzePEv.exe
  C:\Windows\System\evzePEv.exe
  2⤵
  PID:2372
- C:\Windows\System\CRbcmkw.exe
  C:\Windows\System\CRbcmkw.exe
  2⤵
  PID:2176
- C:\Windows\System\smtVPDO.exe
  C:\Windows\System\smtVPDO.exe
  2⤵
  PID:984
- C:\Windows\System\KaJFbfZ.exe
  C:\Windows\System\KaJFbfZ.exe
  2⤵
  PID:2280
- C:\Windows\System\oKkWzsR.exe
  C:\Windows\System\oKkWzsR.exe
  2⤵
  PID:3528
- C:\Windows\System\EuPJfmn.exe
  C:\Windows\System\EuPJfmn.exe
  2⤵
  PID:1144
- C:\Windows\System\zqgtjNe.exe
  C:\Windows\System\zqgtjNe.exe
  2⤵
  PID:2784
- C:\Windows\System\sADBGim.exe
  C:\Windows\System\sADBGim.exe
  2⤵
  PID:3568
- C:\Windows\System\jRayQpF.exe
  C:\Windows\System\jRayQpF.exe
  2⤵
  PID:3628
- C:\Windows\System\PuNqtCS.exe
  C:\Windows\System\PuNqtCS.exe
  2⤵
  PID:3664
- C:\Windows\System\LnkICLK.exe
  C:\Windows\System\LnkICLK.exe
  2⤵
  PID:3692
- C:\Windows\System\nRiccvG.exe
  C:\Windows\System\nRiccvG.exe
  2⤵
  PID:3708
- C:\Windows\System\XAzFzPA.exe
  C:\Windows\System\XAzFzPA.exe
  2⤵
  PID:3744
- C:\Windows\System\crmruzf.exe
  C:\Windows\System\crmruzf.exe
  2⤵
  PID:3764
- C:\Windows\System\WLdSFmn.exe
  C:\Windows\System\WLdSFmn.exe
  2⤵
  PID:3768
- C:\Windows\System\WtlKQre.exe
  C:\Windows\System\WtlKQre.exe
  2⤵
  PID:3824
- C:\Windows\System\UwhygkI.exe
  C:\Windows\System\UwhygkI.exe
  2⤵
  PID:1232
- C:\Windows\System\hpfALkT.exe
  C:\Windows\System\hpfALkT.exe
  2⤵
  PID:3828
- C:\Windows\System\rVIfyLv.exe
  C:\Windows\System\rVIfyLv.exe
  2⤵
  PID:3904
- C:\Windows\System\FuZXpcw.exe
  C:\Windows\System\FuZXpcw.exe
  2⤵
  PID:3980
- C:\Windows\System\GlXVkVv.exe
  C:\Windows\System\GlXVkVv.exe
  2⤵
  PID:3920
- C:\Windows\System\yvKBVAS.exe
  C:\Windows\System\yvKBVAS.exe
  2⤵
  PID:4040
- C:\Windows\System\PDBCVPp.exe
  C:\Windows\System\PDBCVPp.exe
  2⤵
  PID:4080
- C:\Windows\System\qOexBWv.exe
  C:\Windows\System\qOexBWv.exe
  2⤵
  PID:3168
- C:\Windows\System\MoejVSx.exe
  C:\Windows\System\MoejVSx.exe
  2⤵
  PID:1060
- C:\Windows\System\cgIKAMM.exe
  C:\Windows\System\cgIKAMM.exe
  2⤵
  PID:3844
- C:\Windows\System\XkfYSKk.exe
  C:\Windows\System\XkfYSKk.exe
  2⤵
  PID:3288
- C:\Windows\System\CtfDtta.exe
  C:\Windows\System\CtfDtta.exe
  2⤵
  PID:3336
- C:\Windows\System\fMPOdWe.exe
  C:\Windows\System\fMPOdWe.exe
  2⤵
  PID:3376
- C:\Windows\System\NwGEcgr.exe
  C:\Windows\System\NwGEcgr.exe
  2⤵
  PID:3200
- C:\Windows\System\lYxLiUT.exe
  C:\Windows\System\lYxLiUT.exe
  2⤵
  PID:2092
- C:\Windows\System\NpdFeIh.exe
  C:\Windows\System\NpdFeIh.exe
  2⤵
  PID:2800
- C:\Windows\System\DdzwOIO.exe
  C:\Windows\System\DdzwOIO.exe
  2⤵
  PID:3120
- C:\Windows\System\PLowMPH.exe
  C:\Windows\System\PLowMPH.exe
  2⤵
  PID:3432
- C:\Windows\System\aYxOOIz.exe
  C:\Windows\System\aYxOOIz.exe
  2⤵
  PID:3492
- C:\Windows\System\WAIOyfc.exe
  C:\Windows\System\WAIOyfc.exe
  2⤵
  PID:2192
- C:\Windows\System\GOMyXyV.exe
  C:\Windows\System\GOMyXyV.exe
  2⤵
  PID:1956
- C:\Windows\System\nRwiRQd.exe
  C:\Windows\System\nRwiRQd.exe
  2⤵
  PID:1636
- C:\Windows\System\vMJBZmC.exe
  C:\Windows\System\vMJBZmC.exe
  2⤵
  PID:2060
- C:\Windows\System\GnVlDgy.exe
  C:\Windows\System\GnVlDgy.exe
  2⤵
  PID:3848
- C:\Windows\System\cpcNMUU.exe
  C:\Windows\System\cpcNMUU.exe
  2⤵
  PID:932
- C:\Windows\System\xAocxAG.exe
  C:\Windows\System\xAocxAG.exe
  2⤵
  PID:3552
- C:\Windows\System\ATRjEFe.exe
  C:\Windows\System\ATRjEFe.exe
  2⤵
  PID:3888
- C:\Windows\System\TQBObnu.exe
  C:\Windows\System\TQBObnu.exe
  2⤵
  PID:3608
- C:\Windows\System\ULXdlsd.exe
  C:\Windows\System\ULXdlsd.exe
  2⤵
  PID:3992
- C:\Windows\System\EwKCrAk.exe
  C:\Windows\System\EwKCrAk.exe
  2⤵
  PID:4064
- C:\Windows\System\GWMJviT.exe
  C:\Windows\System\GWMJviT.exe
  2⤵
  PID:2860
- C:\Windows\System\WGwKqWX.exe
  C:\Windows\System\WGwKqWX.exe
  2⤵
  PID:3204
- C:\Windows\System\FcQhtOc.exe
  C:\Windows\System\FcQhtOc.exe
  2⤵
  PID:3232
- C:\Windows\System\DrjSQcd.exe
  C:\Windows\System\DrjSQcd.exe
  2⤵
  PID:3352
- C:\Windows\System\qWyapux.exe
  C:\Windows\System\qWyapux.exe
  2⤵
  PID:3384
- C:\Windows\System\UiewRDQ.exe
  C:\Windows\System\UiewRDQ.exe
  2⤵
  PID:1580
- C:\Windows\System\kfnbllP.exe
  C:\Windows\System\kfnbllP.exe
  2⤵
  PID:3408
- C:\Windows\System\iQzwsUk.exe
  C:\Windows\System\iQzwsUk.exe
  2⤵
  PID:904
- C:\Windows\System\mjIFfDW.exe
  C:\Windows\System\mjIFfDW.exe
  2⤵
  PID:2564
- C:\Windows\System\ScfjBLd.exe
  C:\Windows\System\ScfjBLd.exe
  2⤵
  PID:3448
- C:\Windows\System\XUgLIiX.exe
  C:\Windows\System\XUgLIiX.exe
  2⤵
  PID:3476
- C:\Windows\System\PsngKlC.exe
  C:\Windows\System\PsngKlC.exe
  2⤵
  PID:1880
- C:\Windows\System\lvOeWgG.exe
  C:\Windows\System\lvOeWgG.exe
  2⤵
  PID:3652
- C:\Windows\System\HaKqDwa.exe
  C:\Windows\System\HaKqDwa.exe
  2⤵
  PID:3732
- C:\Windows\System\UuHhsnR.exe
  C:\Windows\System\UuHhsnR.exe
  2⤵
  PID:2384
- C:\Windows\System\Xyswczm.exe
  C:\Windows\System\Xyswczm.exe
  2⤵
  PID:3728
- C:\Windows\System\KNzJeZR.exe
  C:\Windows\System\KNzJeZR.exe
  2⤵
  PID:3812
- C:\Windows\System\gJgunVs.exe
  C:\Windows\System\gJgunVs.exe
  2⤵
  PID:3976
- C:\Windows\System\msBPGtm.exe
  C:\Windows\System\msBPGtm.exe
  2⤵
  PID:4052
- C:\Windows\System\EoygHba.exe
  C:\Windows\System\EoygHba.exe
  2⤵
  PID:3252
- C:\Windows\System\mOAFXFl.exe
  C:\Windows\System\mOAFXFl.exe
  2⤵
  PID:1396
- C:\Windows\System\mHQkfxi.exe
  C:\Windows\System\mHQkfxi.exe
  2⤵
  PID:3296
- C:\Windows\System\KTlDLay.exe
  C:\Windows\System\KTlDLay.exe
  2⤵
  PID:3328
- C:\Windows\System\aukKShu.exe
  C:\Windows\System\aukKShu.exe
  2⤵
  PID:3964
- C:\Windows\System\NxdUDDH.exe
  C:\Windows\System\NxdUDDH.exe
  2⤵
  PID:2612
- C:\Windows\System\FDJCXgq.exe
  C:\Windows\System\FDJCXgq.exe
  2⤵
  PID:2036
- C:\Windows\System\CGXonWt.exe
  C:\Windows\System\CGXonWt.exe
  2⤵
  PID:2700
- C:\Windows\System\nFplZxd.exe
  C:\Windows\System\nFplZxd.exe
  2⤵
  PID:3884
- C:\Windows\System\ohMnySc.exe
  C:\Windows\System\ohMnySc.exe
  2⤵
  PID:1708
- C:\Windows\System\vKgSVCa.exe
  C:\Windows\System\vKgSVCa.exe
  2⤵
  PID:3668
- C:\Windows\System\hRXgdBI.exe
  C:\Windows\System\hRXgdBI.exe
  2⤵
  PID:2480
- C:\Windows\System\ioBGObH.exe
  C:\Windows\System\ioBGObH.exe
  2⤵
  PID:3564
- C:\Windows\System\fzRdZEO.exe
  C:\Windows\System\fzRdZEO.exe
  2⤵
  PID:3804
- C:\Windows\System\NsmoRwG.exe
  C:\Windows\System\NsmoRwG.exe
  2⤵
  PID:1264
- C:\Windows\System\UeUsiKQ.exe
  C:\Windows\System\UeUsiKQ.exe
  2⤵
  PID:2300
- C:\Windows\System\sSmpnvI.exe
  C:\Windows\System\sSmpnvI.exe
  2⤵
  PID:4028
- C:\Windows\System\vXJUbfC.exe
  C:\Windows\System\vXJUbfC.exe
  2⤵
  PID:1676
- C:\Windows\System\MVJMUNI.exe
  C:\Windows\System\MVJMUNI.exe
  2⤵
  PID:3424
- C:\Windows\System\zBLxpiG.exe
  C:\Windows\System\zBLxpiG.exe
  2⤵
  PID:2148
- C:\Windows\System\AiCIFOr.exe
  C:\Windows\System\AiCIFOr.exe
  2⤵
  PID:2292
- C:\Windows\System\hZnyIUJ.exe
  C:\Windows\System\hZnyIUJ.exe
  2⤵
  PID:2044
- C:\Windows\System\RUrjvLh.exe
  C:\Windows\System\RUrjvLh.exe
  2⤵
  PID:3368
- C:\Windows\System\vjQSbSR.exe
  C:\Windows\System\vjQSbSR.exe
  2⤵
  PID:2476
- C:\Windows\System\btoqiut.exe
  C:\Windows\System\btoqiut.exe
  2⤵
  PID:3104
- C:\Windows\System\AykzFrC.exe
  C:\Windows\System\AykzFrC.exe
  2⤵
  PID:3508
- C:\Windows\System\vlkoKYX.exe
  C:\Windows\System\vlkoKYX.exe
  2⤵
  PID:1604
- C:\Windows\System\ihAIKVZ.exe
  C:\Windows\System\ihAIKVZ.exe
  2⤵
  PID:3852
- C:\Windows\System\VGHUYTI.exe
  C:\Windows\System\VGHUYTI.exe
  2⤵
  PID:3312
- C:\Windows\System\tysSHsh.exe
  C:\Windows\System\tysSHsh.exe
  2⤵
  PID:3900
- C:\Windows\System\XiCNoNO.exe
  C:\Windows\System\XiCNoNO.exe
  2⤵
  PID:2792
- C:\Windows\System\gybFvij.exe
  C:\Windows\System\gybFvij.exe
  2⤵
  PID:3784
- C:\Windows\System\oNpGJLR.exe
  C:\Windows\System\oNpGJLR.exe
  2⤵
  PID:3868
- C:\Windows\System\CKbyBRd.exe
  C:\Windows\System\CKbyBRd.exe
  2⤵
  PID:3472
- C:\Windows\System\xrDWehS.exe
  C:\Windows\System\xrDWehS.exe
  2⤵
  PID:1428
- C:\Windows\System\MyJasNs.exe
  C:\Windows\System\MyJasNs.exe
  2⤵
  PID:3612
- C:\Windows\System\VkVVpwW.exe
  C:\Windows\System\VkVVpwW.exe
  2⤵
  PID:3256
- C:\Windows\System\Eaelhcc.exe
  C:\Windows\System\Eaelhcc.exe
  2⤵
  PID:2776
- C:\Windows\System\hNuvzey.exe
  C:\Windows\System\hNuvzey.exe
  2⤵
  PID:3276
- C:\Windows\System\KYJYXZo.exe
  C:\Windows\System\KYJYXZo.exe
  2⤵
  PID:2232
- C:\Windows\System\qoWzrZj.exe
  C:\Windows\System\qoWzrZj.exe
  2⤵
  PID:2708
- C:\Windows\System\NspUsBa.exe
  C:\Windows\System\NspUsBa.exe
  2⤵
  PID:1540
- C:\Windows\System\LCFAKUx.exe
  C:\Windows\System\LCFAKUx.exe
  2⤵
  PID:3468
- C:\Windows\System\pWnVett.exe
  C:\Windows\System\pWnVett.exe
  2⤵
  PID:4104
- C:\Windows\System\kvvBWjg.exe
  C:\Windows\System\kvvBWjg.exe
  2⤵
  PID:4124
- C:\Windows\System\cjKzxuN.exe
  C:\Windows\System\cjKzxuN.exe
  2⤵
  PID:4148
- C:\Windows\System\xgTGftl.exe
  C:\Windows\System\xgTGftl.exe
  2⤵
  PID:4168
- C:\Windows\System\GqcGRyf.exe
  C:\Windows\System\GqcGRyf.exe
  2⤵
  PID:4188
- C:\Windows\System\RntZwDK.exe
  C:\Windows\System\RntZwDK.exe
  2⤵
  PID:4208
- C:\Windows\System\QSybYVg.exe
  C:\Windows\System\QSybYVg.exe
  2⤵
  PID:4224
- C:\Windows\System\fMtGwYY.exe
  C:\Windows\System\fMtGwYY.exe
  2⤵
  PID:4240
- C:\Windows\System\JKYBAfc.exe
  C:\Windows\System\JKYBAfc.exe
  2⤵
  PID:4260
- C:\Windows\System\rOTJGDW.exe
  C:\Windows\System\rOTJGDW.exe
  2⤵
  PID:4288
- C:\Windows\System\QUBDOnD.exe
  C:\Windows\System\QUBDOnD.exe
  2⤵
  PID:4308
- C:\Windows\System\TLdFKXG.exe
  C:\Windows\System\TLdFKXG.exe
  2⤵
  PID:4324
- C:\Windows\System\FiWcqZD.exe
  C:\Windows\System\FiWcqZD.exe
  2⤵
  PID:4344
- C:\Windows\System\ntkTSby.exe
  C:\Windows\System\ntkTSby.exe
  2⤵
  PID:4360
- C:\Windows\System\XVHHite.exe
  C:\Windows\System\XVHHite.exe
  2⤵
  PID:4376
- C:\Windows\System\VngaaUN.exe
  C:\Windows\System\VngaaUN.exe
  2⤵
  PID:4396
- C:\Windows\System\dYfsPJY.exe
  C:\Windows\System\dYfsPJY.exe
  2⤵
  PID:4412
- C:\Windows\System\JLYUXcO.exe
  C:\Windows\System\JLYUXcO.exe
  2⤵
  PID:4428
- C:\Windows\System\DfEHCAt.exe
  C:\Windows\System\DfEHCAt.exe
  2⤵
  PID:4444
- C:\Windows\System\aOBveWH.exe
  C:\Windows\System\aOBveWH.exe
  2⤵
  PID:4460
- C:\Windows\System\NqDzdph.exe
  C:\Windows\System\NqDzdph.exe
  2⤵
  PID:4476
- C:\Windows\System\NhveUKl.exe
  C:\Windows\System\NhveUKl.exe
  2⤵
  PID:4492
- C:\Windows\System\MeBGRAn.exe
  C:\Windows\System\MeBGRAn.exe
  2⤵
  PID:4508
- C:\Windows\System\DBZarfk.exe
  C:\Windows\System\DBZarfk.exe
  2⤵
  PID:4524
- C:\Windows\System\rHItpGj.exe
  C:\Windows\System\rHItpGj.exe
  2⤵
  PID:4560
- C:\Windows\System\pmujqyk.exe
  C:\Windows\System\pmujqyk.exe
  2⤵
  PID:4580
- C:\Windows\System\NaJNvJF.exe
  C:\Windows\System\NaJNvJF.exe
  2⤵
  PID:4596
- C:\Windows\System\ynYsrsi.exe
  C:\Windows\System\ynYsrsi.exe
  2⤵
  PID:4612
- C:\Windows\System\fgTEBXm.exe
  C:\Windows\System\fgTEBXm.exe
  2⤵
  PID:4628
- C:\Windows\System\NtAWhAh.exe
  C:\Windows\System\NtAWhAh.exe
  2⤵
  PID:4644
- C:\Windows\System\EaxenfC.exe
  C:\Windows\System\EaxenfC.exe
  2⤵
  PID:4660
- C:\Windows\System\koisfAL.exe
  C:\Windows\System\koisfAL.exe
  2⤵
  PID:4676
- C:\Windows\System\UqNwxlP.exe
  C:\Windows\System\UqNwxlP.exe
  2⤵
  PID:4704
- C:\Windows\System\ocsKzhm.exe
  C:\Windows\System\ocsKzhm.exe
  2⤵
  PID:4720
- C:\Windows\System\xFfyIne.exe
  C:\Windows\System\xFfyIne.exe
  2⤵
  PID:4736
- C:\Windows\System\kWJCfnw.exe
  C:\Windows\System\kWJCfnw.exe
  2⤵
  PID:4752
- C:\Windows\System\WtRBvAO.exe
  C:\Windows\System\WtRBvAO.exe
  2⤵
  PID:4768
- C:\Windows\System\lCQtDhj.exe
  C:\Windows\System\lCQtDhj.exe
  2⤵
  PID:4784
- C:\Windows\System\PhUuFVp.exe
  C:\Windows\System\PhUuFVp.exe
  2⤵
  PID:4800
- C:\Windows\System\euLPgmB.exe
  C:\Windows\System\euLPgmB.exe
  2⤵
  PID:4820
- C:\Windows\System\jkVZJth.exe
  C:\Windows\System\jkVZJth.exe
  2⤵
  PID:4836
- C:\Windows\System\dpjAXTf.exe
  C:\Windows\System\dpjAXTf.exe
  2⤵
  PID:4852
- C:\Windows\System\OkABDJf.exe
  C:\Windows\System\OkABDJf.exe
  2⤵
  PID:4868
- C:\Windows\System\MBkyLKx.exe
  C:\Windows\System\MBkyLKx.exe
  2⤵
  PID:4884
- C:\Windows\System\ZoZQNVt.exe
  C:\Windows\System\ZoZQNVt.exe
  2⤵
  PID:4900
- C:\Windows\System\hDLMQKv.exe
  C:\Windows\System\hDLMQKv.exe
  2⤵
  PID:4916
- C:\Windows\System\BQGXeps.exe
  C:\Windows\System\BQGXeps.exe
  2⤵
  PID:4932
- C:\Windows\System\uubgsGY.exe
  C:\Windows\System\uubgsGY.exe
  2⤵
  PID:4948
- C:\Windows\System\VxjrBWD.exe
  C:\Windows\System\VxjrBWD.exe
  2⤵
  PID:4964
- C:\Windows\System\VwBdijA.exe
  C:\Windows\System\VwBdijA.exe
  2⤵
  PID:4980
- C:\Windows\System\rFHIdVD.exe
  C:\Windows\System\rFHIdVD.exe
  2⤵
  PID:4996
- C:\Windows\System\NrlhAQL.exe
  C:\Windows\System\NrlhAQL.exe
  2⤵
  PID:5012
- C:\Windows\System\wBCBQMV.exe
  C:\Windows\System\wBCBQMV.exe
  2⤵
  PID:5028
- C:\Windows\System\ktSFqaJ.exe
  C:\Windows\System\ktSFqaJ.exe
  2⤵
  PID:5044
- C:\Windows\System\SISnWHb.exe
  C:\Windows\System\SISnWHb.exe
  2⤵
  PID:5060
- C:\Windows\System\hIcVaDI.exe
  C:\Windows\System\hIcVaDI.exe
  2⤵
  PID:5076
- C:\Windows\System\pyBSLVK.exe
  C:\Windows\System\pyBSLVK.exe
  2⤵
  PID:5092
- C:\Windows\System\sYLwapN.exe
  C:\Windows\System\sYLwapN.exe
  2⤵
  PID:5108
- C:\Windows\System\viZohVf.exe
  C:\Windows\System\viZohVf.exe
  2⤵
  PID:3260
- C:\Windows\System\YKPVGxK.exe
  C:\Windows\System\YKPVGxK.exe
  2⤵
  PID:4136
- C:\Windows\System\HppRamm.exe
  C:\Windows\System\HppRamm.exe
  2⤵
  PID:4144
- C:\Windows\System\NVGzBOe.exe
  C:\Windows\System\NVGzBOe.exe
  2⤵
  PID:3164
- C:\Windows\System\RtSZbbq.exe
  C:\Windows\System\RtSZbbq.exe
  2⤵
  PID:4156
- C:\Windows\System\aFIVyQR.exe
  C:\Windows\System\aFIVyQR.exe
  2⤵
  PID:4248
- C:\Windows\System\SIrBCQs.exe
  C:\Windows\System\SIrBCQs.exe
  2⤵
  PID:4160
- C:\Windows\System\QhJFCDT.exe
  C:\Windows\System\QhJFCDT.exe
  2⤵
  PID:4300
- C:\Windows\System\sNCPrWD.exe
  C:\Windows\System\sNCPrWD.exe
  2⤵
  PID:4368
- C:\Windows\System\YpCuHBJ.exe
  C:\Windows\System\YpCuHBJ.exe
  2⤵
  PID:4436
- C:\Windows\System\GmnWcFQ.exe
  C:\Windows\System\GmnWcFQ.exe
  2⤵
  PID:4500
- C:\Windows\System\JarmwhJ.exe
  C:\Windows\System\JarmwhJ.exe
  2⤵
  PID:4544
- C:\Windows\System\utPZape.exe
  C:\Windows\System\utPZape.exe
  2⤵
  PID:2580
- C:\Windows\System\cDHTLJe.exe
  C:\Windows\System\cDHTLJe.exe
  2⤵
  PID:4284
- C:\Windows\System\epTzYjE.exe
  C:\Windows\System\epTzYjE.exe
  2⤵
  PID:4540
- C:\Windows\System\pVtXtEc.exe
  C:\Windows\System\pVtXtEc.exe
  2⤵
  PID:4424
- C:\Windows\System\UWiflkt.exe
  C:\Windows\System\UWiflkt.exe
  2⤵
  PID:4588
- C:\Windows\System\EeVEhtO.exe
  C:\Windows\System\EeVEhtO.exe
  2⤵
  PID:4196
- C:\Windows\System\yNOjsBQ.exe
  C:\Windows\System\yNOjsBQ.exe
  2⤵
  PID:4576
- C:\Windows\System\WMgYiuq.exe
  C:\Windows\System\WMgYiuq.exe
  2⤵
  PID:4700
- C:\Windows\System\ALGFcgh.exe
  C:\Windows\System\ALGFcgh.exe
  2⤵
  PID:4656
- C:\Windows\System\pelRCkV.exe
  C:\Windows\System\pelRCkV.exe
  2⤵
  PID:4684
- C:\Windows\System\WnIPyUa.exe
  C:\Windows\System\WnIPyUa.exe
  2⤵
  PID:4792
- C:\Windows\System\rngBwLS.exe
  C:\Windows\System\rngBwLS.exe
  2⤵
  PID:4796
- C:\Windows\System\OjUtVqe.exe
  C:\Windows\System\OjUtVqe.exe
  2⤵
  PID:4896
- C:\Windows\System\oXcaviy.exe
  C:\Windows\System\oXcaviy.exe
  2⤵
  PID:4668
- C:\Windows\System\lpkiINx.exe
  C:\Windows\System\lpkiINx.exe
  2⤵
  PID:4928
- C:\Windows\System\EkLPFRV.exe
  C:\Windows\System\EkLPFRV.exe
  2⤵
  PID:4712
- C:\Windows\System\itivBJs.exe
  C:\Windows\System\itivBJs.exe
  2⤵
  PID:4992
- C:\Windows\System\HBqWvpP.exe
  C:\Windows\System\HBqWvpP.exe
  2⤵
  PID:3040
- C:\Windows\System\VTgQVzL.exe
  C:\Windows\System\VTgQVzL.exe
  2⤵
  PID:5084
- C:\Windows\System\LZBpxJd.exe
  C:\Windows\System\LZBpxJd.exe
  2⤵
  PID:3792
- C:\Windows\System\vVMVXyl.exe
  C:\Windows\System\vVMVXyl.exe
  2⤵
  PID:4120
- C:\Windows\System\XVoiAGR.exe
  C:\Windows\System\XVoiAGR.exe
  2⤵
  PID:4484
- C:\Windows\System\OgTzJPE.exe
  C:\Windows\System\OgTzJPE.exe
  2⤵
  PID:4548
- C:\Windows\System\hbKWZfm.exe
  C:\Windows\System\hbKWZfm.exe
  2⤵
  PID:1312
- C:\Windows\System\ouiantG.exe
  C:\Windows\System\ouiantG.exe
  2⤵
  PID:5004
- C:\Windows\System\UEHbACK.exe
  C:\Windows\System\UEHbACK.exe
  2⤵
  PID:4624
- C:\Windows\System\POowwvS.exe
  C:\Windows\System\POowwvS.exe
  2⤵
  PID:4864
- C:\Windows\System\OUtebFF.exe
  C:\Windows\System\OUtebFF.exe
  2⤵
  PID:2576
- C:\Windows\System\eQlCwRU.exe
  C:\Windows\System\eQlCwRU.exe
  2⤵
  PID:4388
- C:\Windows\System\zblkggn.exe
  C:\Windows\System\zblkggn.exe
  2⤵
  PID:4592
- C:\Windows\System\OCuNoip.exe
  C:\Windows\System\OCuNoip.exe
  2⤵
  PID:5008
- C:\Windows\System\kHJAvWG.exe
  C:\Windows\System\kHJAvWG.exe
  2⤵
  PID:4140
- C:\Windows\System\nikEqIz.exe
  C:\Windows\System\nikEqIz.exe
  2⤵
  PID:4572
- C:\Windows\System\WEFxTDP.exe
  C:\Windows\System\WEFxTDP.exe
  2⤵
  PID:4268
- C:\Windows\System\IjgBuOu.exe
  C:\Windows\System\IjgBuOu.exe
  2⤵
  PID:4776
- C:\Windows\System\SnFgnQC.exe
  C:\Windows\System\SnFgnQC.exe
  2⤵
  PID:4816
- C:\Windows\System\xlEqmRu.exe
  C:\Windows\System\xlEqmRu.exe
  2⤵
  PID:4880
- C:\Windows\System\IKuNtex.exe
  C:\Windows\System\IKuNtex.exe
  2⤵
  PID:4944
- C:\Windows\System\xCZJfZv.exe
  C:\Windows\System\xCZJfZv.exe
  2⤵
  PID:4408
- C:\Windows\System\JellqvX.exe
  C:\Windows\System\JellqvX.exe
  2⤵
  PID:4972
- C:\Windows\System\TmqLNos.exe
  C:\Windows\System\TmqLNos.exe
  2⤵
  PID:4356
- C:\Windows\System\HlWKhYj.exe
  C:\Windows\System\HlWKhYj.exe
  2⤵
  PID:4876
- C:\Windows\System\gJOvaUc.exe
  C:\Windows\System\gJOvaUc.exe
  2⤵
  PID:4976
- C:\Windows\System\CCcuChP.exe
  C:\Windows\System\CCcuChP.exe
  2⤵
  PID:5072
- C:\Windows\System\zlNVLlb.exe
  C:\Windows\System\zlNVLlb.exe
  2⤵
  PID:5100
- C:\Windows\System\nLouWAj.exe
  C:\Windows\System\nLouWAj.exe
  2⤵
  PID:4456
- C:\Windows\System\OVVXpio.exe
  C:\Windows\System\OVVXpio.exe
  2⤵
  PID:1712
- C:\Windows\System\JyWYIsC.exe
  C:\Windows\System\JyWYIsC.exe
  2⤵
  PID:4536
- C:\Windows\System\elmoSKX.exe
  C:\Windows\System\elmoSKX.exe
  2⤵
  PID:2552
- C:\Windows\System\gHkziZo.exe
  C:\Windows\System\gHkziZo.exe
  2⤵
  PID:2724
- C:\Windows\System\TilvYbs.exe
  C:\Windows\System\TilvYbs.exe
  2⤵
  PID:4652
- C:\Windows\System\ijChOVM.exe
  C:\Windows\System\ijChOVM.exe
  2⤵
  PID:4280
- C:\Windows\System\pMcFNmj.exe
  C:\Windows\System\pMcFNmj.exe
  2⤵
  PID:4352
- C:\Windows\System\geWPWlA.exe
  C:\Windows\System\geWPWlA.exe
  2⤵
  PID:4764
- C:\Windows\System\RcEhFil.exe
  C:\Windows\System\RcEhFil.exe
  2⤵
  PID:5068
- C:\Windows\System\qYOTneG.exe
  C:\Windows\System\qYOTneG.exe
  2⤵
  PID:4912
- C:\Windows\System\FtZocqo.exe
  C:\Windows\System\FtZocqo.exe
  2⤵
  PID:5124
- C:\Windows\System\yRbEJUq.exe
  C:\Windows\System\yRbEJUq.exe
  2⤵
  PID:5140
- C:\Windows\System\gKVhIFy.exe
  C:\Windows\System\gKVhIFy.exe
  2⤵
  PID:5156
- C:\Windows\System\cjkGJJo.exe
  C:\Windows\System\cjkGJJo.exe
  2⤵
  PID:5172
- C:\Windows\System\ZRJypiH.exe
  C:\Windows\System\ZRJypiH.exe
  2⤵
  PID:5188
- C:\Windows\System\zrrHtSF.exe
  C:\Windows\System\zrrHtSF.exe
  2⤵
  PID:5204
- C:\Windows\System\rYCFbNB.exe
  C:\Windows\System\rYCFbNB.exe
  2⤵
  PID:5220
- C:\Windows\System\HKMuYCR.exe
  C:\Windows\System\HKMuYCR.exe
  2⤵
  PID:5236
- C:\Windows\System\YkOXmcY.exe
  C:\Windows\System\YkOXmcY.exe
  2⤵
  PID:5252
- C:\Windows\System\zMAGbFB.exe
  C:\Windows\System\zMAGbFB.exe
  2⤵
  PID:5268
- C:\Windows\System\XsCmHRH.exe
  C:\Windows\System\XsCmHRH.exe
  2⤵
  PID:5360
- C:\Windows\System\qrAtibc.exe
  C:\Windows\System\qrAtibc.exe
  2⤵
  PID:5380
- C:\Windows\System\SGtSoME.exe
  C:\Windows\System\SGtSoME.exe
  2⤵
  PID:5400
- C:\Windows\System\GgCQCQW.exe
  C:\Windows\System\GgCQCQW.exe
  2⤵
  PID:5420
- C:\Windows\System\RCWZqke.exe
  C:\Windows\System\RCWZqke.exe
  2⤵
  PID:5456
- C:\Windows\System\GUgpuoU.exe
  C:\Windows\System\GUgpuoU.exe
  2⤵
  PID:5476
- C:\Windows\System\BsWwcBP.exe
  C:\Windows\System\BsWwcBP.exe
  2⤵
  PID:5492
- C:\Windows\System\rGmHxEi.exe
  C:\Windows\System\rGmHxEi.exe
  2⤵
  PID:5508
- C:\Windows\System\rYePmdb.exe
  C:\Windows\System\rYePmdb.exe
  2⤵
  PID:5528
- C:\Windows\System\VDerMYk.exe
  C:\Windows\System\VDerMYk.exe
  2⤵
  PID:5544
- C:\Windows\System\PsgAJEl.exe
  C:\Windows\System\PsgAJEl.exe
  2⤵
  PID:5560
- C:\Windows\System\WjslDDn.exe
  C:\Windows\System\WjslDDn.exe
  2⤵
  PID:5576
- C:\Windows\System\AWATIQf.exe
  C:\Windows\System\AWATIQf.exe
  2⤵
  PID:5592
- C:\Windows\System\wMbbqbC.exe
  C:\Windows\System\wMbbqbC.exe
  2⤵
  PID:5608
- C:\Windows\System\AcBIIzU.exe
  C:\Windows\System\AcBIIzU.exe
  2⤵
  PID:5624
- C:\Windows\System\YvScYLP.exe
  C:\Windows\System\YvScYLP.exe
  2⤵
  PID:5644
- C:\Windows\System\XzoHUam.exe
  C:\Windows\System\XzoHUam.exe
  2⤵
  PID:5660
- C:\Windows\System\WgJreRq.exe
  C:\Windows\System\WgJreRq.exe
  2⤵
  PID:5676
- C:\Windows\System\DOuvPbB.exe
  C:\Windows\System\DOuvPbB.exe
  2⤵
  PID:5692
- C:\Windows\System\lodhEir.exe
  C:\Windows\System\lodhEir.exe
  2⤵
  PID:5712
- C:\Windows\System\bCmwErY.exe
  C:\Windows\System\bCmwErY.exe
  2⤵
  PID:5728
- C:\Windows\System\PjPVlhI.exe
  C:\Windows\System\PjPVlhI.exe
  2⤵
  PID:5744
- C:\Windows\System\gaZmFlS.exe
  C:\Windows\System\gaZmFlS.exe
  2⤵
  PID:5760
- C:\Windows\System\NpPVagR.exe
  C:\Windows\System\NpPVagR.exe
  2⤵
  PID:5776
- C:\Windows\System\PWBttKn.exe
  C:\Windows\System\PWBttKn.exe
  2⤵
  PID:5792
- C:\Windows\System\ZITPZOO.exe
  C:\Windows\System\ZITPZOO.exe
  2⤵
  PID:5808
- C:\Windows\System\ZRGcsri.exe
  C:\Windows\System\ZRGcsri.exe
  2⤵
  PID:5824
- C:\Windows\System\CUaHOrI.exe
  C:\Windows\System\CUaHOrI.exe
  2⤵
  PID:5840
- C:\Windows\System\UhSLBjl.exe
  C:\Windows\System\UhSLBjl.exe
  2⤵
  PID:5856
- C:\Windows\System\yaKJfID.exe
  C:\Windows\System\yaKJfID.exe
  2⤵
  PID:5876
- C:\Windows\System\vjhvNdk.exe
  C:\Windows\System\vjhvNdk.exe
  2⤵
  PID:5892
- C:\Windows\System\ZkOFSrn.exe
  C:\Windows\System\ZkOFSrn.exe
  2⤵
  PID:5908
- C:\Windows\System\ZpAqKAn.exe
  C:\Windows\System\ZpAqKAn.exe
  2⤵
  PID:5924
- C:\Windows\System\kEAEpsY.exe
  C:\Windows\System\kEAEpsY.exe
  2⤵
  PID:5940
- C:\Windows\System\KEbOlVR.exe
  C:\Windows\System\KEbOlVR.exe
  2⤵
  PID:5960
- C:\Windows\System\jSSFpgY.exe
  C:\Windows\System\jSSFpgY.exe
  2⤵
  PID:5984
- C:\Windows\System\KqlYNvt.exe
  C:\Windows\System\KqlYNvt.exe
  2⤵
  PID:6000
- C:\Windows\System\SjekcrL.exe
  C:\Windows\System\SjekcrL.exe
  2⤵
  PID:6016
- C:\Windows\System\sPGrCyo.exe
  C:\Windows\System\sPGrCyo.exe
  2⤵
  PID:6032
- C:\Windows\System\SKkfDxP.exe
  C:\Windows\System\SKkfDxP.exe
  2⤵
  PID:6048
- C:\Windows\System\LVmjVPl.exe
  C:\Windows\System\LVmjVPl.exe
  2⤵
  PID:6064
- C:\Windows\System\SUcctwZ.exe
  C:\Windows\System\SUcctwZ.exe
  2⤵
  PID:6080
- C:\Windows\System\iEhABUE.exe
  C:\Windows\System\iEhABUE.exe
  2⤵
  PID:6100
- C:\Windows\System\lDMzuSS.exe
  C:\Windows\System\lDMzuSS.exe
  2⤵
  PID:6116
- C:\Windows\System\RLmnvHA.exe
  C:\Windows\System\RLmnvHA.exe
  2⤵
  PID:6132
- C:\Windows\System\NtqJliP.exe
  C:\Windows\System\NtqJliP.exe
  2⤵
  PID:4956
- C:\Windows\System\umHWPHL.exe
  C:\Windows\System\umHWPHL.exe
  2⤵
  PID:4960
- C:\Windows\System\InYTLex.exe
  C:\Windows\System\InYTLex.exe
  2⤵
  PID:4988
- C:\Windows\System\FuqsHPU.exe
  C:\Windows\System\FuqsHPU.exe
  2⤵
  PID:5184
- C:\Windows\System\ZtrNcVe.exe
  C:\Windows\System\ZtrNcVe.exe
  2⤵
  PID:5248
- C:\Windows\System\kneERzg.exe
  C:\Windows\System\kneERzg.exe
  2⤵
  PID:5132
- C:\Windows\System\vPWPpUK.exe
  C:\Windows\System\vPWPpUK.exe
  2⤵
  PID:5136
- C:\Windows\System\tYLMAKJ.exe
  C:\Windows\System\tYLMAKJ.exe
  2⤵
  PID:4184
- C:\Windows\System\NJRFBaC.exe
  C:\Windows\System\NJRFBaC.exe
  2⤵
  PID:5196
- C:\Windows\System\GpMuDWJ.exe
  C:\Windows\System\GpMuDWJ.exe
  2⤵
  PID:5284
- C:\Windows\System\JIYVJTQ.exe
  C:\Windows\System\JIYVJTQ.exe
  2⤵
  PID:5292
- C:\Windows\System\lEcnPbL.exe
  C:\Windows\System\lEcnPbL.exe
  2⤵
  PID:2672
- C:\Windows\System\wgNfCxJ.exe
  C:\Windows\System\wgNfCxJ.exe
  2⤵
  PID:5316
- C:\Windows\System\BXIAbaA.exe
  C:\Windows\System\BXIAbaA.exe
  2⤵
  PID:5332
- C:\Windows\System\SIQlMZg.exe
  C:\Windows\System\SIQlMZg.exe
  2⤵
  PID:5348
- C:\Windows\System\qXfWrEH.exe
  C:\Windows\System\qXfWrEH.exe
  2⤵
  PID:5396
- C:\Windows\System\kbkJlXW.exe
  C:\Windows\System\kbkJlXW.exe
  2⤵
  PID:5372
- C:\Windows\System\bPpTsjw.exe
  C:\Windows\System\bPpTsjw.exe
  2⤵
  PID:2304
- C:\Windows\System\EThHKNh.exe
  C:\Windows\System\EThHKNh.exe
  2⤵
  PID:5412
- C:\Windows\System\ImTuYIS.exe
  C:\Windows\System\ImTuYIS.exe
  2⤵
  PID:1960
- C:\Windows\System\wQPQRzs.exe
  C:\Windows\System\wQPQRzs.exe
  2⤵
  PID:5468
- C:\Windows\System\uwEDcYZ.exe
  C:\Windows\System\uwEDcYZ.exe
  2⤵
  PID:5572
- C:\Windows\System\vywRWck.exe
  C:\Windows\System\vywRWck.exe
  2⤵
  PID:5604
- C:\Windows\System\aZtJMTd.exe
  C:\Windows\System\aZtJMTd.exe
  2⤵
  PID:5444
- C:\Windows\System\VienDOD.exe
  C:\Windows\System\VienDOD.exe
  2⤵
  PID:5488
- C:\Windows\System\HZSXXLE.exe
  C:\Windows\System\HZSXXLE.exe
  2⤵
  PID:5440
- C:\Windows\System\XDBTJnp.exe
  C:\Windows\System\XDBTJnp.exe
  2⤵
  PID:5484
- C:\Windows\System\MulHMDj.exe
  C:\Windows\System\MulHMDj.exe
  2⤵
  PID:1036
- C:\Windows\System\wCENtii.exe
  C:\Windows\System\wCENtii.exe
  2⤵
  PID:5804
- C:\Windows\System\HLqDJJo.exe
  C:\Windows\System\HLqDJJo.exe
  2⤵
  PID:5868
- C:\Windows\System\QXVZspn.exe
  C:\Windows\System\QXVZspn.exe
  2⤵
  PID:5900
- C:\Windows\System\ZtLzbfi.exe
  C:\Windows\System\ZtLzbfi.exe
  2⤵
  PID:5752
- C:\Windows\System\XmWpoFN.exe
  C:\Windows\System\XmWpoFN.exe
  2⤵
  PID:2244
- C:\Windows\System\fekPgfU.exe
  C:\Windows\System\fekPgfU.exe
  2⤵
  PID:5820
- C:\Windows\System\kOtWAcM.exe
  C:\Windows\System\kOtWAcM.exe
  2⤵
  PID:5888
- C:\Windows\System\FamqQqY.exe
  C:\Windows\System\FamqQqY.exe
  2⤵
  PID:5992
- C:\Windows\System\ILyjdXV.exe
  C:\Windows\System\ILyjdXV.exe
  2⤵
  PID:6008
- C:\Windows\System\aMQgbQj.exe
  C:\Windows\System\aMQgbQj.exe
  2⤵
  PID:6072
- C:\Windows\System\myMoqXU.exe
  C:\Windows\System\myMoqXU.exe
  2⤵
  PID:6112
- C:\Windows\System\DRfIrLl.exe
  C:\Windows\System\DRfIrLl.exe
  2⤵
  PID:6124
- C:\Windows\System\cIbTNaA.exe
  C:\Windows\System\cIbTNaA.exe
  2⤵
  PID:6088
- C:\Windows\System\VKNExyJ.exe
  C:\Windows\System\VKNExyJ.exe
  2⤵
  PID:4608
- C:\Windows\System\NsSyjNG.exe
  C:\Windows\System\NsSyjNG.exe
  2⤵
  PID:5216
- C:\Windows\System\eFqSszE.exe
  C:\Windows\System\eFqSszE.exe
  2⤵
  PID:4320
- C:\Windows\System\bnelFwv.exe
  C:\Windows\System\bnelFwv.exe
  2⤵
  PID:448
- C:\Windows\System\ebGuEgO.exe
  C:\Windows\System\ebGuEgO.exe
  2⤵
  PID:5260
- C:\Windows\System\ZdornXc.exe
  C:\Windows\System\ZdornXc.exe
  2⤵
  PID:5340
- C:\Windows\System\JtJjzYW.exe
  C:\Windows\System\JtJjzYW.exe
  2⤵
  PID:2348
- C:\Windows\System\tGpRUtA.exe
  C:\Windows\System\tGpRUtA.exe
  2⤵
  PID:5672
- C:\Windows\System\LIzqKPE.exe
  C:\Windows\System\LIzqKPE.exe
  2⤵
  PID:5324
- C:\Windows\System\dyBkafj.exe
  C:\Windows\System\dyBkafj.exe
  2⤵
  PID:2544
- C:\Windows\System\iHFkwAX.exe
  C:\Windows\System\iHFkwAX.exe
  2⤵
  PID:4176
- C:\Windows\System\KGhSald.exe
  C:\Windows\System\KGhSald.exe
  2⤵
  PID:5328
- C:\Windows\System\ZctZYsi.exe
  C:\Windows\System\ZctZYsi.exe
  2⤵
  PID:5472
- C:\Windows\System\yWmmnIG.exe
  C:\Windows\System\yWmmnIG.exe
  2⤵
  PID:5652
- C:\Windows\System\KEHhPiB.exe
  C:\Windows\System\KEHhPiB.exe
  2⤵
  PID:2240
- C:\Windows\System\WuqqWSx.exe
  C:\Windows\System\WuqqWSx.exe
  2⤵
  PID:5588
- C:\Windows\System\CLrZWhb.exe
  C:\Windows\System\CLrZWhb.exe
  2⤵
  PID:5800
- C:\Windows\System\jlRagOc.exe
  C:\Windows\System\jlRagOc.exe
  2⤵
  PID:780
- C:\Windows\System\fYsXrpc.exe
  C:\Windows\System\fYsXrpc.exe
  2⤵
  PID:5684
- C:\Windows\System\mROrFJf.exe
  C:\Windows\System\mROrFJf.exe
  2⤵
  PID:5976
- C:\Windows\System\CnRSrvG.exe
  C:\Windows\System\CnRSrvG.exe
  2⤵
  PID:5980
- C:\Windows\System\LLuZcps.exe
  C:\Windows\System\LLuZcps.exe
  2⤵
  PID:5816
- C:\Windows\System\nbbHlQh.exe
  C:\Windows\System\nbbHlQh.exe
  2⤵
  PID:1208
- C:\Windows\System\HuUYXYy.exe
  C:\Windows\System\HuUYXYy.exe
  2⤵
  PID:6128
- C:\Windows\System\OKdhHKe.exe
  C:\Windows\System\OKdhHKe.exe
  2⤵
  PID:5540
- C:\Windows\System\LxeNDfq.exe
  C:\Windows\System\LxeNDfq.exe
  2⤵
  PID:2940
- C:\Windows\System\HtFepQs.exe
  C:\Windows\System\HtFepQs.exe
  2⤵
  PID:5228
- C:\Windows\System\kcBDcIf.exe
  C:\Windows\System\kcBDcIf.exe
  2⤵
  PID:5636
- C:\Windows\System\CkvfaYG.exe
  C:\Windows\System\CkvfaYG.exe
  2⤵
  PID:5392
- C:\Windows\System\SeLuusP.exe
  C:\Windows\System\SeLuusP.exe
  2⤵
  PID:5452
- C:\Windows\System\EuglkNS.exe
  C:\Windows\System\EuglkNS.exe
  2⤵
  PID:5600
- C:\Windows\System\DvPycyQ.exe
  C:\Windows\System\DvPycyQ.exe
  2⤵
  PID:5704
- C:\Windows\System\ClNWwdC.exe
  C:\Windows\System\ClNWwdC.exe
  2⤵
  PID:5620
- C:\Windows\System\erJFRCP.exe
  C:\Windows\System\erJFRCP.exe
  2⤵
  PID:5556
- C:\Windows\System\OVbcJLH.exe
  C:\Windows\System\OVbcJLH.exe
  2⤵
  PID:5904
- C:\Windows\System\ddiFdjK.exe
  C:\Windows\System\ddiFdjK.exe
  2⤵
  PID:2588
- C:\Windows\System\viutZpb.exe
  C:\Windows\System\viutZpb.exe
  2⤵
  PID:5864
- C:\Windows\System\WUDjWSZ.exe
  C:\Windows\System\WUDjWSZ.exe
  2⤵
  PID:6028
- C:\Windows\System\okICSrr.exe
  C:\Windows\System\okICSrr.exe
  2⤵
  PID:5956
- C:\Windows\System\OSTulYd.exe
  C:\Windows\System\OSTulYd.exe
  2⤵
  PID:2392
- C:\Windows\System\ZNuScAI.exe
  C:\Windows\System\ZNuScAI.exe
  2⤵
  PID:5264
- C:\Windows\System\XQgAWJy.exe
  C:\Windows\System\XQgAWJy.exe
  2⤵
  PID:5640
- C:\Windows\System\dgNmTMb.exe
  C:\Windows\System\dgNmTMb.exe
  2⤵
  PID:2316
- C:\Windows\System\ClUETdv.exe
  C:\Windows\System\ClUETdv.exe
  2⤵
  PID:1008
- C:\Windows\System\oLGPrzy.exe
  C:\Windows\System\oLGPrzy.exe
  2⤵
  PID:5152
- C:\Windows\System\hkHuPja.exe
  C:\Windows\System\hkHuPja.exe
  2⤵
  PID:1564
- C:\Windows\System\dOfInJW.exe
  C:\Windows\System\dOfInJW.exe
  2⤵
  PID:800
- C:\Windows\System\eKExzUT.exe
  C:\Windows\System\eKExzUT.exe
  2⤵
  PID:5788
- C:\Windows\System\xGcukrs.exe
  C:\Windows\System\xGcukrs.exe
  2⤵
  PID:5772
- C:\Windows\System\SbcaVCI.exe
  C:\Windows\System\SbcaVCI.exe
  2⤵
  PID:1344
- C:\Windows\System\qPhQBvi.exe
  C:\Windows\System\qPhQBvi.exe
  2⤵
  PID:6152
- C:\Windows\System\WlAAtqX.exe
  C:\Windows\System\WlAAtqX.exe
  2⤵
  PID:6168
- C:\Windows\System\MELYVKk.exe
  C:\Windows\System\MELYVKk.exe
  2⤵
  PID:6184
- C:\Windows\System\OiPhzaz.exe
  C:\Windows\System\OiPhzaz.exe
  2⤵
  PID:6200
- C:\Windows\System\oNROPJq.exe
  C:\Windows\System\oNROPJq.exe
  2⤵
  PID:6220
- C:\Windows\System\IaQmdbE.exe
  C:\Windows\System\IaQmdbE.exe
  2⤵
  PID:6240
- C:\Windows\System\FJpOvJK.exe
  C:\Windows\System\FJpOvJK.exe
  2⤵
  PID:6284
- C:\Windows\System\Kizutcj.exe
  C:\Windows\System\Kizutcj.exe
  2⤵
  PID:6300
- C:\Windows\System\ANNjOIR.exe
  C:\Windows\System\ANNjOIR.exe
  2⤵
  PID:6316
- C:\Windows\System\rNcOSeo.exe
  C:\Windows\System\rNcOSeo.exe
  2⤵
  PID:6332
- C:\Windows\System\XTQMIAu.exe
  C:\Windows\System\XTQMIAu.exe
  2⤵
  PID:6348
- C:\Windows\System\UoLtpKl.exe
  C:\Windows\System\UoLtpKl.exe
  2⤵
  PID:6364
- C:\Windows\System\MyYTGWy.exe
  C:\Windows\System\MyYTGWy.exe
  2⤵
  PID:6380
- C:\Windows\System\afPrVkY.exe
  C:\Windows\System\afPrVkY.exe
  2⤵
  PID:6396
- C:\Windows\System\eeXRzyz.exe
  C:\Windows\System\eeXRzyz.exe
  2⤵
  PID:6412
- C:\Windows\System\LdVyVKI.exe
  C:\Windows\System\LdVyVKI.exe
  2⤵
  PID:6428
- C:\Windows\System\mMMJJmU.exe
  C:\Windows\System\mMMJJmU.exe
  2⤵
  PID:7040
- C:\Windows\System\KuWbvYi.exe
  C:\Windows\System\KuWbvYi.exe
  2⤵
  PID:7056
- C:\Windows\System\lbmlsZv.exe
  C:\Windows\System\lbmlsZv.exe
  2⤵
  PID:7072
- C:\Windows\System\EBcYKUc.exe
  C:\Windows\System\EBcYKUc.exe
  2⤵
  PID:7088
- C:\Windows\System\jbHvBMU.exe
  C:\Windows\System\jbHvBMU.exe
  2⤵
  PID:7104
- C:\Windows\System\DcoIRxP.exe
  C:\Windows\System\DcoIRxP.exe
  2⤵
  PID:7120
- C:\Windows\System\AAqaNzn.exe
  C:\Windows\System\AAqaNzn.exe
  2⤵
  PID:7136
- C:\Windows\System\LZUOJnl.exe
  C:\Windows\System\LZUOJnl.exe
  2⤵
  PID:7152
- C:\Windows\System\kFsfEpe.exe
  C:\Windows\System\kFsfEpe.exe
  2⤵
  PID:564
- C:\Windows\System\YvGYcgV.exe
  C:\Windows\System\YvGYcgV.exe
  2⤵
  PID:1020
- C:\Windows\System\CHaGMzt.exe
  C:\Windows\System\CHaGMzt.exe
  2⤵
  PID:5552
- C:\Windows\System\aZUfURn.exe
  C:\Windows\System\aZUfURn.exe
  2⤵
  PID:6164
- C:\Windows\System\ojxiCgm.exe
  C:\Windows\System\ojxiCgm.exe
  2⤵
  PID:5884
- C:\Windows\System\UGRbhuP.exe
  C:\Windows\System\UGRbhuP.exe
  2⤵
  PID:6236
- C:\Windows\System\XoKzklZ.exe
  C:\Windows\System\XoKzklZ.exe
  2⤵
  PID:6212
- C:\Windows\System\LlhZiDa.exe
  C:\Windows\System\LlhZiDa.exe
  2⤵
  PID:6208
- C:\Windows\System\WrXdGMX.exe
  C:\Windows\System\WrXdGMX.exe
  2⤵
  PID:1012
- C:\Windows\System\DRYWgUb.exe
  C:\Windows\System\DRYWgUb.exe
  2⤵
  PID:6272
- C:\Windows\System\BpYGlql.exe
  C:\Windows\System\BpYGlql.exe
  2⤵
  PID:1572
- C:\Windows\System\mqcIxPB.exe
  C:\Windows\System\mqcIxPB.exe
  2⤵
  PID:756
- C:\Windows\System\HczFqMD.exe
  C:\Windows\System\HczFqMD.exe
  2⤵
  PID:6356
- C:\Windows\System\XJVDgSL.exe
  C:\Windows\System\XJVDgSL.exe
  2⤵
  PID:6420
- C:\Windows\System\fWZUUnw.exe
  C:\Windows\System\fWZUUnw.exe
  2⤵
  PID:6436
- C:\Windows\System\YJszMAB.exe
  C:\Windows\System\YJszMAB.exe
  2⤵
  PID:6376
- C:\Windows\System\OfAZsHv.exe
  C:\Windows\System\OfAZsHv.exe
  2⤵
  PID:6404
- C:\Windows\System\jKHhyIn.exe
  C:\Windows\System\jKHhyIn.exe
  2⤵
  PID:6448
- C:\Windows\System\hCToGUK.exe
  C:\Windows\System\hCToGUK.exe
  2⤵
  PID:6468
- C:\Windows\System\iORDNRX.exe
  C:\Windows\System\iORDNRX.exe
  2⤵
  PID:6484
- C:\Windows\System\wWMJrwp.exe
  C:\Windows\System\wWMJrwp.exe
  2⤵
  PID:6500
- C:\Windows\System\mnMhaBX.exe
  C:\Windows\System\mnMhaBX.exe
  2⤵
  PID:6516
- C:\Windows\System\PYPGHhG.exe
  C:\Windows\System\PYPGHhG.exe
  2⤵
  PID:6528
- C:\Windows\System\llZAZNU.exe
  C:\Windows\System\llZAZNU.exe
  2⤵
  PID:6548
- C:\Windows\System\EmMTpAT.exe
  C:\Windows\System\EmMTpAT.exe
  2⤵
  PID:6564
- C:\Windows\System\thpPuqB.exe
  C:\Windows\System\thpPuqB.exe
  2⤵
  PID:6580
- C:\Windows\System\MzeQTEK.exe
  C:\Windows\System\MzeQTEK.exe
  2⤵
  PID:6596
- C:\Windows\System\dEjiuhe.exe
  C:\Windows\System\dEjiuhe.exe
  2⤵
  PID:6612
- C:\Windows\System\HLjNWlc.exe
  C:\Windows\System\HLjNWlc.exe
  2⤵
  PID:6628
- C:\Windows\System\zbZOyMw.exe
  C:\Windows\System\zbZOyMw.exe
  2⤵
  PID:6644
- C:\Windows\System\kbPzKbT.exe
  C:\Windows\System\kbPzKbT.exe
  2⤵
  PID:6660
- C:\Windows\System\hOrDFxE.exe
  C:\Windows\System\hOrDFxE.exe
  2⤵
  PID:6676
- C:\Windows\System\ymfnELw.exe
  C:\Windows\System\ymfnELw.exe
  2⤵
  PID:6692
- C:\Windows\System\UqWcDFN.exe
  C:\Windows\System\UqWcDFN.exe
  2⤵
  PID:6700
- C:\Windows\System\AoLufSR.exe
  C:\Windows\System\AoLufSR.exe
  2⤵
  PID:6724
- C:\Windows\System\mCUHSni.exe
  C:\Windows\System\mCUHSni.exe
  2⤵
  PID:6740
- C:\Windows\System\WUpSRjv.exe
  C:\Windows\System\WUpSRjv.exe
  2⤵
  PID:6756
- C:\Windows\System\hHFpPBh.exe
  C:\Windows\System\hHFpPBh.exe
  2⤵
  PID:6772
- C:\Windows\System\CqrmWwk.exe
  C:\Windows\System\CqrmWwk.exe
  2⤵
  PID:6792
- C:\Windows\System\OYJvlZl.exe
  C:\Windows\System\OYJvlZl.exe
  2⤵
  PID:6804
- C:\Windows\System\noyinJs.exe
  C:\Windows\System\noyinJs.exe
  2⤵
  PID:6820
- C:\Windows\System\dHlESHH.exe
  C:\Windows\System\dHlESHH.exe
  2⤵
  PID:6836
- C:\Windows\System\AqwAWfu.exe
  C:\Windows\System\AqwAWfu.exe
  2⤵
  PID:6852
- C:\Windows\System\llyuJMq.exe
  C:\Windows\System\llyuJMq.exe
  2⤵
  PID:6868
- C:\Windows\System\tXLvTjD.exe
  C:\Windows\System\tXLvTjD.exe
  2⤵
  PID:6888
- C:\Windows\System\fjVeLwF.exe
  C:\Windows\System\fjVeLwF.exe
  2⤵
  PID:6900
- C:\Windows\System\UDPVfQc.exe
  C:\Windows\System\UDPVfQc.exe
  2⤵
  PID:6916
- C:\Windows\System\ORZEVVa.exe
  C:\Windows\System\ORZEVVa.exe
  2⤵
  PID:6932
- C:\Windows\System\unCsTUZ.exe
  C:\Windows\System\unCsTUZ.exe
  2⤵
  PID:6948
- C:\Windows\System\OaPTdPh.exe
  C:\Windows\System\OaPTdPh.exe
  2⤵
  PID:6964
- C:\Windows\System\hgwSUky.exe
  C:\Windows\System\hgwSUky.exe
  2⤵
  PID:6980
- C:\Windows\System\KxYpjak.exe
  C:\Windows\System\KxYpjak.exe
  2⤵
  PID:7008
- C:\Windows\System\UEkgiRB.exe
  C:\Windows\System\UEkgiRB.exe
  2⤵
  PID:7012
- C:\Windows\System\XkmpCVG.exe
  C:\Windows\System\XkmpCVG.exe
  2⤵
  PID:7032
- C:\Windows\System\fddETGx.exe
  C:\Windows\System\fddETGx.exe
  2⤵
  PID:7084
- C:\Windows\System\DfKgzuv.exe
  C:\Windows\System\DfKgzuv.exe
  2⤵
  PID:6044
- C:\Windows\System\JjovAaP.exe
  C:\Windows\System\JjovAaP.exe
  2⤵
  PID:6160
- C:\Windows\System\kALyvCF.exe
  C:\Windows\System\kALyvCF.exe
  2⤵
  PID:6180
- C:\Windows\System\SJwwJlo.exe
  C:\Windows\System\SJwwJlo.exe
  2⤵
  PID:6292
- C:\Windows\System\YNklvUS.exe
  C:\Windows\System\YNklvUS.exe
  2⤵
  PID:6308
- C:\Windows\System\MigYKMD.exe
  C:\Windows\System\MigYKMD.exe
  2⤵
  PID:6476
- C:\Windows\System\iYKFthT.exe
  C:\Windows\System\iYKFthT.exe
  2⤵
  PID:7068
- C:\Windows\System\kgeTeVW.exe
  C:\Windows\System\kgeTeVW.exe
  2⤵
  PID:6576
- C:\Windows\System\IWaqJmA.exe
  C:\Windows\System\IWaqJmA.exe
  2⤵
  PID:6636
- C:\Windows\System\teTuGJQ.exe
  C:\Windows\System\teTuGJQ.exe
  2⤵
  PID:6668
- C:\Windows\System\JfJChsx.exe
  C:\Windows\System\JfJChsx.exe
  2⤵
  PID:6556
- C:\Windows\System\taHuXCQ.exe
  C:\Windows\System\taHuXCQ.exe
  2⤵
  PID:7164
- C:\Windows\System\WxrVyYj.exe
  C:\Windows\System\WxrVyYj.exe
  2⤵
  PID:6624
- C:\Windows\System\ZYmhQWV.exe
  C:\Windows\System\ZYmhQWV.exe
  2⤵
  PID:6684
- C:\Windows\System\NQDGrhf.exe
  C:\Windows\System\NQDGrhf.exe
  2⤵
  PID:6496
- C:\Windows\System\REZtHPy.exe
  C:\Windows\System\REZtHPy.exe
  2⤵
  PID:7128
- C:\Windows\System\wbQNUEx.exe
  C:\Windows\System\wbQNUEx.exe
  2⤵
  PID:6196
- C:\Windows\System\KBvrQwJ.exe
  C:\Windows\System\KBvrQwJ.exe
  2⤵
  PID:6276
- C:\Windows\System\oqIKAcL.exe
  C:\Windows\System\oqIKAcL.exe
  2⤵
  PID:6424
- C:\Windows\System\aUCZDJp.exe
  C:\Windows\System\aUCZDJp.exe
  2⤵
  PID:6588
- C:\Windows\System\kBkrfBC.exe
  C:\Windows\System\kBkrfBC.exe
  2⤵
  PID:6764
- C:\Windows\System\CDKRoMn.exe
  C:\Windows\System\CDKRoMn.exe
  2⤵
  PID:6832
- C:\Windows\System\BBusqbo.exe
  C:\Windows\System\BBusqbo.exe
  2⤵
  PID:6860
- C:\Windows\System\badUIhl.exe
  C:\Windows\System\badUIhl.exe
  2⤵
  PID:6928
- C:\Windows\System\rOViBgu.exe
  C:\Windows\System\rOViBgu.exe
  2⤵
  PID:5244
- C:\Windows\System\clxQqDJ.exe
  C:\Windows\System\clxQqDJ.exe
  2⤵
  PID:7148
- C:\Windows\System\OPXoiWG.exe
  C:\Windows\System\OPXoiWG.exe
  2⤵
  PID:6228
- C:\Windows\System\fSrLzbS.exe
  C:\Windows\System\fSrLzbS.exe
  2⤵
  PID:6944
- C:\Windows\System\adcoWUC.exe
  C:\Windows\System\adcoWUC.exe
  2⤵
  PID:6604
- C:\Windows\System\jLIUbjA.exe
  C:\Windows\System\jLIUbjA.exe
  2⤵
  PID:6708
- C:\Windows\System\UQEnNQP.exe
  C:\Windows\System\UQEnNQP.exe
  2⤵
  PID:6912
- C:\Windows\System\MDarMWw.exe
  C:\Windows\System\MDarMWw.exe
  2⤵
  PID:6976
- C:\Windows\System\Wscedvl.exe
  C:\Windows\System\Wscedvl.exe
  2⤵
  PID:7004
- C:\Windows\System\SunqgbB.exe
  C:\Windows\System\SunqgbB.exe
  2⤵
  PID:2208
- C:\Windows\System\uGVGCKv.exe
  C:\Windows\System\uGVGCKv.exe
  2⤵
  PID:5584
- C:\Windows\System\yVKlZGe.exe
  C:\Windows\System\yVKlZGe.exe
  2⤵
  PID:6452
- C:\Windows\System\ZQcpglj.exe
  C:\Windows\System\ZQcpglj.exe
  2⤵
  PID:280
- C:\Windows\System\Fzaierl.exe
  C:\Windows\System\Fzaierl.exe
  2⤵
  PID:6444
- C:\Windows\System\ldWJfwV.exe
  C:\Windows\System\ldWJfwV.exe
  2⤵
  PID:6640
- C:\Windows\System\OpuAKwk.exe
  C:\Windows\System\OpuAKwk.exe
  2⤵
  PID:6736
- C:\Windows\System\wBMgNcM.exe
  C:\Windows\System\wBMgNcM.exe
  2⤵
  PID:6788
- C:\Windows\System\IDHwPrP.exe
  C:\Windows\System\IDHwPrP.exe
  2⤵
  PID:6960
- C:\Windows\System\KrqdoqW.exe
  C:\Windows\System\KrqdoqW.exe
  2⤵
  PID:7116
- C:\Windows\System\CunjCoB.exe
  C:\Windows\System\CunjCoB.exe
  2⤵
  PID:6504
- C:\Windows\System\MrliAgW.exe
  C:\Windows\System\MrliAgW.exe
  2⤵
  PID:6608
- C:\Windows\System\xjhOkti.exe
  C:\Windows\System\xjhOkti.exe
  2⤵
  PID:6752
- C:\Windows\System\GKpbQVz.exe
  C:\Windows\System\GKpbQVz.exe
  2⤵
  PID:6264
- C:\Windows\System\YaIzzne.exe
  C:\Windows\System\YaIzzne.exe
  2⤵
  PID:6260
- C:\Windows\System\RCCrhHD.exe
  C:\Windows\System\RCCrhHD.exe
  2⤵
  PID:6256
- C:\Windows\System\ZQsIQlV.exe
  C:\Windows\System\ZQsIQlV.exe
  2⤵
  PID:6268
- C:\Windows\System\ABzQOSu.exe
  C:\Windows\System\ABzQOSu.exe
  2⤵
  PID:6560
- C:\Windows\System\uqkCCnF.exe
  C:\Windows\System\uqkCCnF.exe
  2⤵
  PID:6784
- C:\Windows\System\AIakETo.exe
  C:\Windows\System\AIakETo.exe
  2⤵
  PID:6940
- C:\Windows\System\JPXTTdd.exe
  C:\Windows\System\JPXTTdd.exe
  2⤵
  PID:5936
- C:\Windows\System\VOBYxRH.exe
  C:\Windows\System\VOBYxRH.exe
  2⤵
  PID:2996
- C:\Windows\System\yQGhmNR.exe
  C:\Windows\System\yQGhmNR.exe
  2⤵
  PID:6716
- C:\Windows\System\AthhqxX.exe
  C:\Windows\System\AthhqxX.exe
  2⤵
  PID:3008
- C:\Windows\System\IJfheNJ.exe
  C:\Windows\System\IJfheNJ.exe
  2⤵
  PID:6828
- C:\Windows\System\RkIYWJu.exe
  C:\Windows\System\RkIYWJu.exe
  2⤵
  PID:6972
- C:\Windows\System\SrrXprj.exe
  C:\Windows\System\SrrXprj.exe
  2⤵
  PID:7184
- C:\Windows\System\jCNzoAD.exe
  C:\Windows\System\jCNzoAD.exe
  2⤵
  PID:7200
- C:\Windows\System\iIcguXp.exe
  C:\Windows\System\iIcguXp.exe
  2⤵
  PID:7216
- C:\Windows\System\GWPCLFw.exe
  C:\Windows\System\GWPCLFw.exe
  2⤵
  PID:7232
- C:\Windows\System\fDNvaVF.exe
  C:\Windows\System\fDNvaVF.exe
  2⤵
  PID:7248
- C:\Windows\System\RvzZpbj.exe
  C:\Windows\System\RvzZpbj.exe
  2⤵
  PID:7264
- C:\Windows\System\FRNDxYR.exe
  C:\Windows\System\FRNDxYR.exe
  2⤵
  PID:7280
- C:\Windows\System\fqaVVej.exe
  C:\Windows\System\fqaVVej.exe
  2⤵
  PID:7296
- C:\Windows\System\Ssmxhef.exe
  C:\Windows\System\Ssmxhef.exe
  2⤵
  PID:7312
- C:\Windows\System\vByvuVs.exe
  C:\Windows\System\vByvuVs.exe
  2⤵
  PID:7328
- C:\Windows\System\bDBZsMb.exe
  C:\Windows\System\bDBZsMb.exe
  2⤵
  PID:7344
- C:\Windows\System\UdftOtY.exe
  C:\Windows\System\UdftOtY.exe
  2⤵
  PID:7360
- C:\Windows\System\ZLTtiob.exe
  C:\Windows\System\ZLTtiob.exe
  2⤵
  PID:7376
- C:\Windows\System\XsUJdlk.exe
  C:\Windows\System\XsUJdlk.exe
  2⤵
  PID:7392
- C:\Windows\System\Xrciqxl.exe
  C:\Windows\System\Xrciqxl.exe
  2⤵
  PID:7408
- C:\Windows\System\wQJdEGj.exe
  C:\Windows\System\wQJdEGj.exe
  2⤵
  PID:7424
- C:\Windows\System\LfrNnFc.exe
  C:\Windows\System\LfrNnFc.exe
  2⤵
  PID:7440
- C:\Windows\System\mvTUHgP.exe
  C:\Windows\System\mvTUHgP.exe
  2⤵
  PID:7456
- C:\Windows\System\LGeiDrY.exe
  C:\Windows\System\LGeiDrY.exe
  2⤵
  PID:7472
- C:\Windows\System\ncdgyrY.exe
  C:\Windows\System\ncdgyrY.exe
  2⤵
  PID:7488
- C:\Windows\System\DPyhFDa.exe
  C:\Windows\System\DPyhFDa.exe
  2⤵
  PID:7504
- C:\Windows\System\gKLBrsi.exe
  C:\Windows\System\gKLBrsi.exe
  2⤵
  PID:7520
- C:\Windows\System\CssVjeu.exe
  C:\Windows\System\CssVjeu.exe
  2⤵
  PID:7536
- C:\Windows\System\JukGTSR.exe
  C:\Windows\System\JukGTSR.exe
  2⤵
  PID:7552
- C:\Windows\System\RZwvaPW.exe
  C:\Windows\System\RZwvaPW.exe
  2⤵
  PID:7568
- C:\Windows\System\fvJLMOd.exe
  C:\Windows\System\fvJLMOd.exe
  2⤵
  PID:7584
- C:\Windows\System\aAAwywQ.exe
  C:\Windows\System\aAAwywQ.exe
  2⤵
  PID:7600
- C:\Windows\System\VGpTEoe.exe
  C:\Windows\System\VGpTEoe.exe
  2⤵
  PID:7616
- C:\Windows\System\gZzVyJS.exe
  C:\Windows\System\gZzVyJS.exe
  2⤵
  PID:7632
- C:\Windows\System\sRBNOzL.exe
  C:\Windows\System\sRBNOzL.exe
  2⤵
  PID:7648
- C:\Windows\System\TvzgWhy.exe
  C:\Windows\System\TvzgWhy.exe
  2⤵
  PID:7664
- C:\Windows\System\pgcDxJZ.exe
  C:\Windows\System\pgcDxJZ.exe
  2⤵
  PID:7680
- C:\Windows\System\PMxezTs.exe
  C:\Windows\System\PMxezTs.exe
  2⤵
  PID:7696
- C:\Windows\System\WAMehtw.exe
  C:\Windows\System\WAMehtw.exe
  2⤵
  PID:7712
- C:\Windows\System\EODFKFZ.exe
  C:\Windows\System\EODFKFZ.exe
  2⤵
  PID:7728
- C:\Windows\System\QrbcfOA.exe
  C:\Windows\System\QrbcfOA.exe
  2⤵
  PID:7744
- C:\Windows\System\FpiMEBG.exe
  C:\Windows\System\FpiMEBG.exe
  2⤵
  PID:7760
- C:\Windows\System\xRmWVxg.exe
  C:\Windows\System\xRmWVxg.exe
  2⤵
  PID:7776
- C:\Windows\System\neqScIb.exe
  C:\Windows\System\neqScIb.exe
  2⤵
  PID:7792
- C:\Windows\System\LiiGPRt.exe
  C:\Windows\System\LiiGPRt.exe
  2⤵
  PID:7808
- C:\Windows\System\SBRaEUw.exe
  C:\Windows\System\SBRaEUw.exe
  2⤵
  PID:7824
- C:\Windows\System\UUiRZvO.exe
  C:\Windows\System\UUiRZvO.exe
  2⤵
  PID:7840
- C:\Windows\System\Blkyuwo.exe
  C:\Windows\System\Blkyuwo.exe
  2⤵
  PID:7856
- C:\Windows\System\ilfSAMy.exe
  C:\Windows\System\ilfSAMy.exe
  2⤵
  PID:7872
- C:\Windows\System\NuOlhqW.exe
  C:\Windows\System\NuOlhqW.exe
  2⤵
  PID:7888
- C:\Windows\System\mmlshqg.exe
  C:\Windows\System\mmlshqg.exe
  2⤵
  PID:7904
- C:\Windows\System\BcVGAUq.exe
  C:\Windows\System\BcVGAUq.exe
  2⤵
  PID:7920
- C:\Windows\System\YLOboVC.exe
  C:\Windows\System\YLOboVC.exe
  2⤵
  PID:7936
- C:\Windows\System\XOyXGna.exe
  C:\Windows\System\XOyXGna.exe
  2⤵
  PID:7952
- C:\Windows\System\GLsJYHJ.exe
  C:\Windows\System\GLsJYHJ.exe
  2⤵
  PID:7968
- C:\Windows\System\qVNNWyK.exe
  C:\Windows\System\qVNNWyK.exe
  2⤵
  PID:7984
- C:\Windows\System\iToJtqT.exe
  C:\Windows\System\iToJtqT.exe
  2⤵
  PID:8000
- C:\Windows\System\altBSHA.exe
  C:\Windows\System\altBSHA.exe
  2⤵
  PID:8016
- C:\Windows\System\yCmGhhy.exe
  C:\Windows\System\yCmGhhy.exe
  2⤵
  PID:8032
- C:\Windows\System\bskrHGa.exe
  C:\Windows\System\bskrHGa.exe
  2⤵
  PID:8048
- C:\Windows\System\WrqVcbc.exe
  C:\Windows\System\WrqVcbc.exe
  2⤵
  PID:8064
- C:\Windows\System\yEOPbvF.exe
  C:\Windows\System\yEOPbvF.exe
  2⤵
  PID:8080
- C:\Windows\System\iHgiygx.exe
  C:\Windows\System\iHgiygx.exe
  2⤵
  PID:8096
- C:\Windows\System\OYrBzXU.exe
  C:\Windows\System\OYrBzXU.exe
  2⤵
  PID:8112
- C:\Windows\System\kOIhbeS.exe
  C:\Windows\System\kOIhbeS.exe
  2⤵
  PID:8128
- C:\Windows\System\lJGmfUU.exe
  C:\Windows\System\lJGmfUU.exe
  2⤵
  PID:8148
- C:\Windows\System\czwprEF.exe
  C:\Windows\System\czwprEF.exe
  2⤵
  PID:8164
- C:\Windows\System\Lndongf.exe
  C:\Windows\System\Lndongf.exe
  2⤵
  PID:8180
- C:\Windows\System\odFOayK.exe
  C:\Windows\System\odFOayK.exe
  2⤵
  PID:7192
- C:\Windows\System\lktnGOJ.exe
  C:\Windows\System\lktnGOJ.exe
  2⤵
  PID:7256
- C:\Windows\System\VWUFSwF.exe
  C:\Windows\System\VWUFSwF.exe
  2⤵
  PID:7320
- C:\Windows\System\OCqrNJq.exe
  C:\Windows\System\OCqrNJq.exe
  2⤵
  PID:6656
- C:\Windows\System\aaYmTOU.exe
  C:\Windows\System\aaYmTOU.exe
  2⤵
  PID:7416
- C:\Windows\System\pylGCZQ.exe
  C:\Windows\System\pylGCZQ.exe
  2⤵
  PID:6996
- C:\Windows\System\aFCUIGY.exe
  C:\Windows\System\aFCUIGY.exe
  2⤵
  PID:7336
- C:\Windows\System\NfCnwTu.exe
  C:\Windows\System\NfCnwTu.exe
  2⤵
  PID:7512
- C:\Windows\System\mgBpubM.exe
  C:\Windows\System\mgBpubM.exe
  2⤵
  PID:7208
- C:\Windows\System\rZqkONg.exe
  C:\Windows\System\rZqkONg.exe
  2⤵
  PID:7272
- C:\Windows\System\vMwJsnV.exe
  C:\Windows\System\vMwJsnV.exe
  2⤵
  PID:7500
- C:\Windows\System\waQwiXt.exe
  C:\Windows\System\waQwiXt.exe
  2⤵
  PID:7560
- C:\Windows\System\sErXvda.exe
  C:\Windows\System\sErXvda.exe
  2⤵
  PID:7340
- C:\Windows\System\COSzfZo.exe
  C:\Windows\System\COSzfZo.exe
  2⤵
  PID:7436
- C:\Windows\System\nssGhnx.exe
  C:\Windows\System\nssGhnx.exe
  2⤵
  PID:7608
- C:\Windows\System\QQOiVIm.exe
  C:\Windows\System\QQOiVIm.exe
  2⤵
  PID:7640
- C:\Windows\System\icehRWJ.exe
  C:\Windows\System\icehRWJ.exe
  2⤵
  PID:7676
- C:\Windows\System\meZqXPG.exe
  C:\Windows\System\meZqXPG.exe
  2⤵
  PID:7704
- C:\Windows\System\WWwPCCl.exe
  C:\Windows\System\WWwPCCl.exe
  2⤵
  PID:7740
- C:\Windows\System\rKtfCYE.exe
  C:\Windows\System\rKtfCYE.exe
  2⤵
  PID:7772
- C:\Windows\System\bNaZRVq.exe
  C:\Windows\System\bNaZRVq.exe
  2⤵
  PID:7784
- C:\Windows\System\lLQMNsx.exe
  C:\Windows\System\lLQMNsx.exe
  2⤵
  PID:7756
- C:\Windows\System\GrIHBfT.exe
  C:\Windows\System\GrIHBfT.exe
  2⤵
  PID:7820
- C:\Windows\System\BJWtduO.exe
  C:\Windows\System\BJWtduO.exe
  2⤵
  PID:7852
- C:\Windows\System\RhCYoqX.exe
  C:\Windows\System\RhCYoqX.exe
  2⤵
  PID:7932
- C:\Windows\System\yvoPdsM.exe
  C:\Windows\System\yvoPdsM.exe
  2⤵
  PID:7944
- C:\Windows\System\emzMvIg.exe
  C:\Windows\System\emzMvIg.exe
  2⤵
  PID:7976
- C:\Windows\System\JiNusfR.exe
  C:\Windows\System\JiNusfR.exe
  2⤵
  PID:8024
- C:\Windows\System\EZoVeQC.exe
  C:\Windows\System\EZoVeQC.exe
  2⤵
  PID:8012
- C:\Windows\System\Vwymmyh.exe
  C:\Windows\System\Vwymmyh.exe
  2⤵
  PID:8072
- C:\Windows\System\sFsqXfJ.exe
  C:\Windows\System\sFsqXfJ.exe
  2⤵
  PID:8124
- C:\Windows\System\dxesMlq.exe
  C:\Windows\System\dxesMlq.exe
  2⤵
  PID:6984
- C:\Windows\System\AhzrVWy.exe
  C:\Windows\System\AhzrVWy.exe
  2⤵
  PID:8172
- C:\Windows\System\hzXbYGT.exe
  C:\Windows\System\hzXbYGT.exe
  2⤵
  PID:8104
- C:\Windows\System\iOtkObJ.exe
  C:\Windows\System\iOtkObJ.exe
  2⤵
  PID:7352
- C:\Windows\System\rnxhmzi.exe
  C:\Windows\System\rnxhmzi.exe
  2⤵
  PID:7452
- C:\Windows\System\SoWPqcL.exe
  C:\Windows\System\SoWPqcL.exe
  2⤵
  PID:7468
- C:\Windows\System\yYfytyv.exe
  C:\Windows\System\yYfytyv.exe
  2⤵
  PID:7548
- C:\Windows\System\XzDppDE.exe
  C:\Windows\System\XzDppDE.exe
  2⤵
  PID:7244
- C:\Windows\System\JaGOqaE.exe
  C:\Windows\System\JaGOqaE.exe
  2⤵
  PID:7576
- C:\Windows\System\MJcCetl.exe
  C:\Windows\System\MJcCetl.exe
  2⤵
  PID:7644
- C:\Windows\System\FzwhPOW.exe
  C:\Windows\System\FzwhPOW.exe
  2⤵
  PID:7656
- C:\Windows\System\cXNCXqs.exe
  C:\Windows\System\cXNCXqs.exe
  2⤵
  PID:7724
- C:\Windows\System\bpBgiFE.exe
  C:\Windows\System\bpBgiFE.exe
  2⤵
  PID:7836
- C:\Windows\System\ZbOypPN.exe
  C:\Windows\System\ZbOypPN.exe
  2⤵
  PID:7896
- C:\Windows\System\gjjslau.exe
  C:\Windows\System\gjjslau.exe
  2⤵
  PID:7948
- C:\Windows\System\ShNjFdK.exe
  C:\Windows\System\ShNjFdK.exe
  2⤵
  PID:8040
- C:\Windows\System\zAzZcbk.exe
  C:\Windows\System\zAzZcbk.exe
  2⤵
  PID:7240
- C:\Windows\System\aSHFuRp.exe
  C:\Windows\System\aSHFuRp.exe
  2⤵
  PID:7288
- C:\Windows\System\RsoyuEE.exe
  C:\Windows\System\RsoyuEE.exe
  2⤵
  PID:7672
- C:\Windows\System\McLAGEz.exe
  C:\Windows\System\McLAGEz.exe
  2⤵
  PID:8076
- C:\Windows\System\yUzTljD.exe
  C:\Windows\System\yUzTljD.exe
  2⤵
  PID:7224
- C:\Windows\System\TJywmGr.exe
  C:\Windows\System\TJywmGr.exe
  2⤵
  PID:7388
- C:\Windows\System\IQXPbOh.exe
  C:\Windows\System\IQXPbOh.exe
  2⤵
  PID:7368
- C:\Windows\System\NwtvObK.exe
  C:\Windows\System\NwtvObK.exe
  2⤵
  PID:7292
- C:\Windows\System\BEFSQwB.exe
  C:\Windows\System\BEFSQwB.exe
  2⤵
  PID:7804
- C:\Windows\System\CMvmkuC.exe
  C:\Windows\System\CMvmkuC.exe
  2⤵
  PID:7736
- C:\Windows\System\UnYvTbZ.exe
  C:\Windows\System\UnYvTbZ.exe
  2⤵
  PID:6992
- C:\Windows\System\xxKBKzt.exe
  C:\Windows\System\xxKBKzt.exe
  2⤵
  PID:7448
- C:\Windows\System\ijuDnYQ.exe
  C:\Windows\System\ijuDnYQ.exe
  2⤵
  PID:7832
- C:\Windows\System\dMeExiK.exe
  C:\Windows\System\dMeExiK.exe
  2⤵
  PID:7544
- C:\Windows\System\kawkSUD.exe
  C:\Windows\System\kawkSUD.exe
  2⤵
  PID:8140
- C:\Windows\System\rKbggzc.exe
  C:\Windows\System\rKbggzc.exe
  2⤵
  PID:8120
- C:\Windows\System\SIpKixx.exe
  C:\Windows\System\SIpKixx.exe
  2⤵
  PID:7692
- C:\Windows\System\UhkAfvJ.exe
  C:\Windows\System\UhkAfvJ.exe
  2⤵
  PID:8200
- C:\Windows\System\iyOpLVF.exe
  C:\Windows\System\iyOpLVF.exe
  2⤵
  PID:8220
- C:\Windows\System\nXcYexR.exe
  C:\Windows\System\nXcYexR.exe
  2⤵
  PID:8236
- C:\Windows\System\AtrEJLo.exe
  C:\Windows\System\AtrEJLo.exe
  2⤵
  PID:8252
- C:\Windows\System\BgYJUZF.exe
  C:\Windows\System\BgYJUZF.exe
  2⤵
  PID:8268
- C:\Windows\System\ODzPVmb.exe
  C:\Windows\System\ODzPVmb.exe
  2⤵
  PID:8284
- C:\Windows\System\EAJiGSW.exe
  C:\Windows\System\EAJiGSW.exe
  2⤵
  PID:8304
- C:\Windows\System\tEhYaEf.exe
  C:\Windows\System\tEhYaEf.exe
  2⤵
  PID:8320
- C:\Windows\System\NhWKcSQ.exe
  C:\Windows\System\NhWKcSQ.exe
  2⤵
  PID:8336
- C:\Windows\System\TMmHKxt.exe
  C:\Windows\System\TMmHKxt.exe
  2⤵
  PID:8352
- C:\Windows\System\XXQEvDd.exe
  C:\Windows\System\XXQEvDd.exe
  2⤵
  PID:8368
- C:\Windows\System\fezulin.exe
  C:\Windows\System\fezulin.exe
  2⤵
  PID:8384
- C:\Windows\System\SESVEgS.exe
  C:\Windows\System\SESVEgS.exe
  2⤵
  PID:8404
- C:\Windows\System\bpFFXUH.exe
  C:\Windows\System\bpFFXUH.exe
  2⤵
  PID:8420
- C:\Windows\System\mGXnhqP.exe
  C:\Windows\System\mGXnhqP.exe
  2⤵
  PID:8376
- C:\Windows\System\KwsrVQZ.exe
  C:\Windows\System\KwsrVQZ.exe
  2⤵
  PID:8460
- C:\Windows\System\sTEmYrC.exe
  C:\Windows\System\sTEmYrC.exe
  2⤵
  PID:8476
- C:\Windows\System\cPTqPAE.exe
  C:\Windows\System\cPTqPAE.exe
  2⤵
  PID:8492
- C:\Windows\System\CUizrWL.exe
  C:\Windows\System\CUizrWL.exe
  2⤵
  PID:8516
- C:\Windows\System\CEPtxRa.exe
  C:\Windows\System\CEPtxRa.exe
  2⤵
  PID:8540
- C:\Windows\System\WMJMgPB.exe
  C:\Windows\System\WMJMgPB.exe
  2⤵
  PID:8572
- C:\Windows\System\MlnxnPb.exe
  C:\Windows\System\MlnxnPb.exe
  2⤵
  PID:8588
- C:\Windows\System\KWVkrrO.exe
  C:\Windows\System\KWVkrrO.exe
  2⤵
  PID:8620
- C:\Windows\System\NbBIRMx.exe
  C:\Windows\System\NbBIRMx.exe
  2⤵
  PID:8636
- C:\Windows\System\rxRlnHI.exe
  C:\Windows\System\rxRlnHI.exe
  2⤵
  PID:8652
- C:\Windows\System\FLQuTGk.exe
  C:\Windows\System\FLQuTGk.exe
  2⤵
  PID:8668
- C:\Windows\System\xraJIzN.exe
  C:\Windows\System\xraJIzN.exe
  2⤵
  PID:8684
- C:\Windows\System\lxdjOeM.exe
  C:\Windows\System\lxdjOeM.exe
  2⤵
  PID:8704
- C:\Windows\System\IqOKYgq.exe
  C:\Windows\System\IqOKYgq.exe
  2⤵
  PID:8740
- C:\Windows\System\OzpMkFs.exe
  C:\Windows\System\OzpMkFs.exe
  2⤵
  PID:8412
- C:\Windows\System\ZYuCgeh.exe
  C:\Windows\System\ZYuCgeh.exe
  2⤵
  PID:8912
- C:\Windows\System\QuOGgTp.exe
  C:\Windows\System\QuOGgTp.exe
  2⤵
  PID:7992
- C:\Windows\System\rxGcQpP.exe
  C:\Windows\System\rxGcQpP.exe
  2⤵
  PID:8724
- C:\Windows\System\BAbORsz.exe
  C:\Windows\System\BAbORsz.exe
  2⤵
  PID:9004
- C:\Windows\System\WskHWjh.exe
  C:\Windows\System\WskHWjh.exe
  2⤵
  PID:8980
- C:\Windows\System\gZOoaRZ.exe
  C:\Windows\System\gZOoaRZ.exe
  2⤵
  PID:9040
- C:\Windows\System\WmDNJWi.exe
  C:\Windows\System\WmDNJWi.exe
  2⤵
  PID:9080
- C:\Windows\System\nNpZRNn.exe
  C:\Windows\System\nNpZRNn.exe
  2⤵
  PID:9112
- C:\Windows\System\aTwCOoV.exe
  C:\Windows\System\aTwCOoV.exe
  2⤵
  PID:9144
- C:\Windows\System\LeEXzic.exe
  C:\Windows\System\LeEXzic.exe
  2⤵
  PID:9188
- C:\Windows\System\RMjrIqV.exe
  C:\Windows\System\RMjrIqV.exe
  2⤵
  PID:7528
- C:\Windows\System\GXNeJrS.exe
  C:\Windows\System\GXNeJrS.exe
  2⤵
  PID:8784
- C:\Windows\System\IOKvDLi.exe
  C:\Windows\System\IOKvDLi.exe
  2⤵
  PID:8804
- C:\Windows\System\DuRJuya.exe
  C:\Windows\System\DuRJuya.exe
  2⤵
  PID:8312
- C:\Windows\System\yCxQyat.exe
  C:\Windows\System\yCxQyat.exe
  2⤵
  PID:8928
- C:\Windows\System\TvdPcbJ.exe
  C:\Windows\System\TvdPcbJ.exe
  2⤵
  PID:8972
- C:\Windows\System\saEJpat.exe
  C:\Windows\System\saEJpat.exe
  2⤵
  PID:9084
- C:\Windows\System\Bouchwt.exe
  C:\Windows\System\Bouchwt.exe
  2⤵
  PID:9176
- C:\Windows\System\oWqMGXL.exe
  C:\Windows\System\oWqMGXL.exe
  2⤵
  PID:8764
- C:\Windows\System\ynGfqKD.exe
  C:\Windows\System\ynGfqKD.exe
  2⤵
  PID:8788
- C:\Windows\System\HjUAmDE.exe
  C:\Windows\System\HjUAmDE.exe
  2⤵
  PID:8824
- C:\Windows\System\MsBDMTV.exe
  C:\Windows\System\MsBDMTV.exe
  2⤵
  PID:8836
- C:\Windows\System\jIvTTFx.exe
  C:\Windows\System\jIvTTFx.exe
  2⤵
  PID:8316
- C:\Windows\System\XXPyamx.exe
  C:\Windows\System\XXPyamx.exe
  2⤵
  PID:8872
- C:\Windows\System\SkvAaIv.exe
  C:\Windows\System\SkvAaIv.exe
  2⤵
  PID:8896
- C:\Windows\System\XfSXfoo.exe
  C:\Windows\System\XfSXfoo.exe
  2⤵
  PID:8948
- C:\Windows\System\VVIlWSi.exe
  C:\Windows\System\VVIlWSi.exe
  2⤵
  PID:9064
- C:\Windows\System\EotBcOE.exe
  C:\Windows\System\EotBcOE.exe
  2⤵
  PID:9100
- C:\Windows\System\gKyAsEA.exe
  C:\Windows\System\gKyAsEA.exe
  2⤵
  PID:9128
- C:\Windows\System\bIAizou.exe
  C:\Windows\System\bIAizou.exe
  2⤵
  PID:9156
- C:\Windows\System\FAUefOn.exe
  C:\Windows\System\FAUefOn.exe
  2⤵
  PID:9204
- C:\Windows\System\XeKmseB.exe
  C:\Windows\System\XeKmseB.exe
  2⤵
  PID:8248
- C:\Windows\System\TrVxiak.exe
  C:\Windows\System\TrVxiak.exe
  2⤵
  PID:8260
- C:\Windows\System\lhyinfu.exe
  C:\Windows\System\lhyinfu.exe
  2⤵
  PID:8332
- C:\Windows\System\DFsvvXH.exe
  C:\Windows\System\DFsvvXH.exe
  2⤵
  PID:8392
- C:\Windows\System\SieOMbV.exe
  C:\Windows\System\SieOMbV.exe
  2⤵
  PID:8428
- C:\Windows\System\iahDZoF.exe
  C:\Windows\System\iahDZoF.exe
  2⤵
  PID:8440
- C:\Windows\System\kKoUVpk.exe
  C:\Windows\System\kKoUVpk.exe
  2⤵
  PID:8468
- C:\Windows\System\nPjSZxX.exe
  C:\Windows\System\nPjSZxX.exe
  2⤵
  PID:8524
- C:\Windows\System\ndGIpSV.exe
  C:\Windows\System\ndGIpSV.exe
  2⤵
  PID:8508
- C:\Windows\System\NdrDtRe.exe
  C:\Windows\System\NdrDtRe.exe
  2⤵
  PID:8556
- C:\Windows\System\ZCtBZbG.exe
  C:\Windows\System\ZCtBZbG.exe
  2⤵
  PID:8560
- C:\Windows\System\wmUbpCk.exe
  C:\Windows\System\wmUbpCk.exe
  2⤵
  PID:8600
- C:\Windows\System\xQBwHIX.exe
  C:\Windows\System\xQBwHIX.exe
  2⤵
  PID:8608
- C:\Windows\System\biVERlM.exe
  C:\Windows\System\biVERlM.exe
  2⤵
  PID:8660
- C:\Windows\System\cYgSXJb.exe
  C:\Windows\System\cYgSXJb.exe
  2⤵
  PID:8416
- C:\Windows\System\mygUiSy.exe
  C:\Windows\System\mygUiSy.exe
  2⤵
  PID:8920
- C:\Windows\System\YrikJwC.exe
  C:\Windows\System\YrikJwC.exe
  2⤵
  PID:8700
- C:\Windows\System\nZmNNjv.exe
  C:\Windows\System\nZmNNjv.exe
  2⤵
  PID:9032
- C:\Windows\System\EIQxkdU.exe
  C:\Windows\System\EIQxkdU.exe
  2⤵
  PID:8720
- C:\Windows\System\PCDjlSG.exe
  C:\Windows\System\PCDjlSG.exe
  2⤵
  PID:8916
- C:\Windows\System\ApEgjRk.exe
  C:\Windows\System\ApEgjRk.exe
  2⤵
  PID:8992
- C:\Windows\System\WmZkafn.exe
  C:\Windows\System\WmZkafn.exe
  2⤵
  PID:1256
- C:\Windows\System\fIJbAJg.exe
  C:\Windows\System\fIJbAJg.exe
  2⤵
  PID:8932
- C:\Windows\System\SxEuvMq.exe
  C:\Windows\System\SxEuvMq.exe
  2⤵
  PID:9104
- C:\Windows\System\aUjqQkN.exe
  C:\Windows\System\aUjqQkN.exe
  2⤵
  PID:8852
- C:\Windows\System\wSYjmSG.exe
  C:\Windows\System\wSYjmSG.exe
  2⤵
  PID:8964
- C:\Windows\System\mwddEPb.exe
  C:\Windows\System\mwddEPb.exe
  2⤵
  PID:9212
- C:\Windows\System\IjFYhSg.exe
  C:\Windows\System\IjFYhSg.exe
  2⤵
  PID:8276
- C:\Windows\System\CZmMCbl.exe
  C:\Windows\System\CZmMCbl.exe
  2⤵
  PID:8888
- C:\Windows\System\cVCXvMa.exe
  C:\Windows\System\cVCXvMa.exe
  2⤵
  PID:9056
- C:\Windows\System\UvlqhAk.exe
  C:\Windows\System\UvlqhAk.exe
  2⤵
  PID:9180
- C:\Windows\System\TpzJbXU.exe
  C:\Windows\System\TpzJbXU.exe
  2⤵
  PID:8232
- C:\Windows\System\PpOiYqp.exe
  C:\Windows\System\PpOiYqp.exe
  2⤵
  PID:8904
- C:\Windows\System\hnYwNQN.exe
  C:\Windows\System\hnYwNQN.exe
  2⤵
  PID:8472
- C:\Windows\System\TTPzmWE.exe
  C:\Windows\System\TTPzmWE.exe
  2⤵
  PID:9076
- C:\Windows\System\rdeRBFK.exe
  C:\Windows\System\rdeRBFK.exe
  2⤵
  PID:8300
- C:\Windows\System\wLfIeuo.exe
  C:\Windows\System\wLfIeuo.exe
  2⤵
  PID:8008
- C:\Windows\System\GKjfsdF.exe
  C:\Windows\System\GKjfsdF.exe
  2⤵
  PID:9092
- C:\Windows\System\DRaRqeR.exe
  C:\Windows\System\DRaRqeR.exe
  2⤵
  PID:8504
- C:\Windows\System\YKEVALv.exe
  C:\Windows\System\YKEVALv.exe
  2⤵
  PID:8060
- C:\Windows\System\NfhITJf.exe
  C:\Windows\System\NfhITJf.exe
  2⤵
  PID:9096
- C:\Windows\System\sdbCylz.exe
  C:\Windows\System\sdbCylz.exe
  2⤵
  PID:9028
- C:\Windows\System\SgWJuvn.exe
  C:\Windows\System\SgWJuvn.exe
  2⤵
  PID:9124
- C:\Windows\System\Lfjdkdk.exe
  C:\Windows\System\Lfjdkdk.exe
  2⤵
  PID:8760
- C:\Windows\System\oQFqgUf.exe
  C:\Windows\System\oQFqgUf.exe
  2⤵
  PID:9160
- C:\Windows\System\IobhCaq.exe
  C:\Windows\System\IobhCaq.exe
  2⤵
  PID:9048
- C:\Windows\System\BUQxTHY.exe
  C:\Windows\System\BUQxTHY.exe
  2⤵
  PID:8832
- C:\Windows\System\dTTFLtS.exe
  C:\Windows\System\dTTFLtS.exe
  2⤵
  PID:8816
- C:\Windows\System\ubJalyz.exe
  C:\Windows\System\ubJalyz.exe
  2⤵
  PID:8584
- C:\Windows\System\wgutWEF.exe
  C:\Windows\System\wgutWEF.exe
  2⤵
  PID:8756
- C:\Windows\System\zkjAdTa.exe
  C:\Windows\System\zkjAdTa.exe
  2⤵
  PID:8772
- C:\Windows\System\bRaXFDF.exe
  C:\Windows\System\bRaXFDF.exe
  2⤵
  PID:7916
- C:\Windows\System\hAmnirX.exe
  C:\Windows\System\hAmnirX.exe
  2⤵
  PID:8400
- C:\Windows\System\hnixcHw.exe
  C:\Windows\System\hnixcHw.exe
  2⤵
  PID:8644
- C:\Windows\System\XuaOnzk.exe
  C:\Windows\System\XuaOnzk.exe
  2⤵
  PID:8924
- C:\Windows\System\huQUgUk.exe
  C:\Windows\System\huQUgUk.exe
  2⤵
  PID:8712
- C:\Windows\System\BtcdsHQ.exe
  C:\Windows\System\BtcdsHQ.exe
  2⤵
  PID:9072
- C:\Windows\System\RdIGnId.exe
  C:\Windows\System\RdIGnId.exe
  2⤵
  PID:9008
- C:\Windows\System\dqtPACm.exe
  C:\Windows\System\dqtPACm.exe
  2⤵
  PID:9000
- C:\Windows\System\YuXbCPW.exe
  C:\Windows\System\YuXbCPW.exe
  2⤵
  PID:8844
- C:\Windows\System\vuimlUH.exe
  C:\Windows\System\vuimlUH.exe
  2⤵
  PID:8728
- C:\Windows\System\vPbgIiv.exe
  C:\Windows\System\vPbgIiv.exe
  2⤵
  PID:8860
- C:\Windows\System\reJtrdw.exe
  C:\Windows\System\reJtrdw.exe
  2⤵
  PID:8864
- C:\Windows\System\XFEzWhV.exe
  C:\Windows\System\XFEzWhV.exe
  2⤵
  PID:8580
- C:\Windows\System\ueOZDVX.exe
  C:\Windows\System\ueOZDVX.exe
  2⤵
  PID:9224
- C:\Windows\System\OJmFvtB.exe
  C:\Windows\System\OJmFvtB.exe
  2⤵
  PID:9240
- C:\Windows\System\MerimLS.exe
  C:\Windows\System\MerimLS.exe
  2⤵
  PID:9256
- C:\Windows\System\rJtKJUp.exe
  C:\Windows\System\rJtKJUp.exe
  2⤵
  PID:9272
- C:\Windows\System\TfKZlxH.exe
  C:\Windows\System\TfKZlxH.exe
  2⤵
  PID:9288
- C:\Windows\System\YODXCsQ.exe
  C:\Windows\System\YODXCsQ.exe
  2⤵
  PID:9304
- C:\Windows\System\CBsGeyI.exe
  C:\Windows\System\CBsGeyI.exe
  2⤵
  PID:9320
- C:\Windows\System\qwFeOoi.exe
  C:\Windows\System\qwFeOoi.exe
  2⤵
  PID:9336
- C:\Windows\System\ESGJYuW.exe
  C:\Windows\System\ESGJYuW.exe
  2⤵
  PID:9352
- C:\Windows\System\LcIarXe.exe
  C:\Windows\System\LcIarXe.exe
  2⤵
  PID:9368
- C:\Windows\System\FmPfnvB.exe
  C:\Windows\System\FmPfnvB.exe
  2⤵
  PID:9384
- C:\Windows\System\kHjVQES.exe
  C:\Windows\System\kHjVQES.exe
  2⤵
  PID:9420
- C:\Windows\System\ZqDncGP.exe
  C:\Windows\System\ZqDncGP.exe
  2⤵
  PID:9440
- C:\Windows\System\PAfowpy.exe
  C:\Windows\System\PAfowpy.exe
  2⤵
  PID:9456
- C:\Windows\System\rfRplnY.exe
  C:\Windows\System\rfRplnY.exe
  2⤵
  PID:9472
- C:\Windows\System\oiljbls.exe
  C:\Windows\System\oiljbls.exe
  2⤵
  PID:9596
- C:\Windows\System\lJgEQmQ.exe
  C:\Windows\System\lJgEQmQ.exe
  2⤵
  PID:9624
- C:\Windows\System\XeMbmFP.exe
  C:\Windows\System\XeMbmFP.exe
  2⤵
  PID:9640
- C:\Windows\System\GodXttS.exe
  C:\Windows\System\GodXttS.exe
  2⤵
  PID:9656
- C:\Windows\System\RRHxxCx.exe
  C:\Windows\System\RRHxxCx.exe
  2⤵
  PID:9692
- C:\Windows\System\mVcybmB.exe
  C:\Windows\System\mVcybmB.exe
  2⤵
  PID:9712
- C:\Windows\System\HrGJvuP.exe
  C:\Windows\System\HrGJvuP.exe
  2⤵
  PID:9732
- C:\Windows\System\yRxbrlQ.exe
  C:\Windows\System\yRxbrlQ.exe
  2⤵
  PID:9756
- C:\Windows\System\xjOyaBP.exe
  C:\Windows\System\xjOyaBP.exe
  2⤵
  PID:9772
- C:\Windows\System\ICIkWOe.exe
  C:\Windows\System\ICIkWOe.exe
  2⤵
  PID:9788
- C:\Windows\System\EsnFcUC.exe
  C:\Windows\System\EsnFcUC.exe
  2⤵
  PID:9808
- C:\Windows\System\OFDegrU.exe
  C:\Windows\System\OFDegrU.exe
  2⤵
  PID:9840
- C:\Windows\System\ReOfcKE.exe
  C:\Windows\System\ReOfcKE.exe
  2⤵
  PID:9892
- C:\Windows\System\CcgQtvG.exe
  C:\Windows\System\CcgQtvG.exe
  2⤵
  PID:9908
- C:\Windows\System\bmMNMPO.exe
  C:\Windows\System\bmMNMPO.exe
  2⤵
  PID:9924
- C:\Windows\System\pGoDbum.exe
  C:\Windows\System\pGoDbum.exe
  2⤵
  PID:9940
- C:\Windows\System\YhPPRHv.exe
  C:\Windows\System\YhPPRHv.exe
  2⤵
  PID:9956
- C:\Windows\System\kGVhHoO.exe
  C:\Windows\System\kGVhHoO.exe
  2⤵
  PID:9972
- C:\Windows\System\jpEhXfn.exe
  C:\Windows\System\jpEhXfn.exe
  2⤵
  PID:9988
- C:\Windows\System\SPGqCyZ.exe
  C:\Windows\System\SPGqCyZ.exe
  2⤵
  PID:10024
- C:\Windows\System\aFcLMrt.exe
  C:\Windows\System\aFcLMrt.exe
  2⤵
  PID:10100
- C:\Windows\System\UvChAoi.exe
  C:\Windows\System\UvChAoi.exe
  2⤵
  PID:10116
- C:\Windows\System\TboPfkw.exe
  C:\Windows\System\TboPfkw.exe
  2⤵
  PID:10172
- C:\Windows\System\JiBErnC.exe
  C:\Windows\System\JiBErnC.exe
  2⤵
  PID:10188
- C:\Windows\System\AYkkLwZ.exe
  C:\Windows\System\AYkkLwZ.exe
  2⤵
  PID:10208
- C:\Windows\System\KQlwLSV.exe
  C:\Windows\System\KQlwLSV.exe
  2⤵
  PID:9264
- C:\Windows\System\LkWEfty.exe
  C:\Windows\System\LkWEfty.exe
  2⤵
  PID:8452
- C:\Windows\System\oPuPyup.exe
  C:\Windows\System\oPuPyup.exe
  2⤵
  PID:8800
- C:\Windows\System\ARVjCGy.exe
  C:\Windows\System\ARVjCGy.exe
  2⤵
  PID:9252
- C:\Windows\System\dKZlTgx.exe
  C:\Windows\System\dKZlTgx.exe
  2⤵
  PID:9360
- C:\Windows\System\QSqsnKW.exe
  C:\Windows\System\QSqsnKW.exe
  2⤵
  PID:9348
- C:\Windows\System\SdXrzDP.exe
  C:\Windows\System\SdXrzDP.exe
  2⤵
  PID:9436
- C:\Windows\System\zOghRXE.exe
  C:\Windows\System\zOghRXE.exe
  2⤵
  PID:9492
- C:\Windows\System\tnZCIzZ.exe
  C:\Windows\System\tnZCIzZ.exe
  2⤵
  PID:9512
- C:\Windows\System\icLnOhi.exe
  C:\Windows\System\icLnOhi.exe
  2⤵
  PID:9416
- C:\Windows\System\pDMVjTF.exe
  C:\Windows\System\pDMVjTF.exe
  2⤵
  PID:9468
- C:\Windows\System\qvTblUe.exe
  C:\Windows\System\qvTblUe.exe
  2⤵
  PID:9636
- C:\Windows\System\GjWdukF.exe
  C:\Windows\System\GjWdukF.exe
  2⤵
  PID:9620
- C:\Windows\System\HeFOIQE.exe
  C:\Windows\System\HeFOIQE.exe
  2⤵
  PID:9688
- C:\Windows\System\lmSrnnU.exe
  C:\Windows\System\lmSrnnU.exe
  2⤵
  PID:9708
- C:\Windows\System\MdPkdnM.exe
  C:\Windows\System\MdPkdnM.exe
  2⤵
  PID:9752
- C:\Windows\System\oTFtDCu.exe
  C:\Windows\System\oTFtDCu.exe
  2⤵
  PID:9780
- C:\Windows\System\mzxrzNZ.exe
  C:\Windows\System\mzxrzNZ.exe
  2⤵
  PID:9848
- C:\Windows\System\oQdZDmP.exe
  C:\Windows\System\oQdZDmP.exe
  2⤵
  PID:9920
- C:\Windows\System\XanfJmN.exe
  C:\Windows\System\XanfJmN.exe
  2⤵
  PID:9864
- C:\Windows\System\XqFxKjz.exe
  C:\Windows\System\XqFxKjz.exe
  2⤵
  PID:9932
- C:\Windows\System\egNtvNk.exe
  C:\Windows\System\egNtvNk.exe
  2⤵
  PID:10000
- C:\Windows\System\Bulecho.exe
  C:\Windows\System\Bulecho.exe
  2⤵
  PID:10020
- C:\Windows\System\zwMecgt.exe
  C:\Windows\System\zwMecgt.exe
  2⤵
  PID:10092
- C:\Windows\System\OuTUUyb.exe
  C:\Windows\System\OuTUUyb.exe
  2⤵
  PID:10124
- C:\Windows\System\fZCTcTP.exe
  C:\Windows\System\fZCTcTP.exe
  2⤵
  PID:10144
- C:\Windows\System\ruWnrkp.exe
  C:\Windows\System\ruWnrkp.exe
  2⤵
  PID:10196
- C:\Windows\System\SJfrJHl.exe
  C:\Windows\System\SJfrJHl.exe
  2⤵
  PID:9652
- C:\Windows\System\emsDivN.exe
  C:\Windows\System\emsDivN.exe
  2⤵
  PID:9728
- C:\Windows\System\rFOLwqH.exe
  C:\Windows\System\rFOLwqH.exe
  2⤵
  PID:9796
- C:\Windows\System\ilWXCqG.exe
  C:\Windows\System\ilWXCqG.exe
  2⤵
  PID:9888
- C:\Windows\System\fenEwzn.exe
  C:\Windows\System\fenEwzn.exe
  2⤵
  PID:9868
- C:\Windows\System\ybnnZJG.exe
  C:\Windows\System\ybnnZJG.exe
  2⤵
  PID:9996
- C:\Windows\System\AoQcKaA.exe
  C:\Windows\System\AoQcKaA.exe
  2⤵
  PID:10016
- C:\Windows\System\CHhtDtD.exe
  C:\Windows\System\CHhtDtD.exe
  2⤵
  PID:10228
- C:\Windows\System\vjLfVIA.exe
  C:\Windows\System\vjLfVIA.exe
  2⤵
  PID:9396
- C:\Windows\System\HtEFRJz.exe
  C:\Windows\System\HtEFRJz.exe
  2⤵
  PID:9312
- C:\Windows\System\POvNqOT.exe
  C:\Windows\System\POvNqOT.exe
  2⤵
  PID:8292
- C:\Windows\System\VJhDotS.exe
  C:\Windows\System\VJhDotS.exe
  2⤵
  PID:9608
- C:\Windows\System\xvCwZjm.exe
  C:\Windows\System\xvCwZjm.exe
  2⤵
  PID:9676
- C:\Windows\System\jaThmdJ.exe
  C:\Windows\System\jaThmdJ.exe
  2⤵
  PID:9832
- C:\Windows\System\slRTWit.exe
  C:\Windows\System\slRTWit.exe
  2⤵
  PID:9952
- C:\Windows\System\UXMqMJb.exe
  C:\Windows\System\UXMqMJb.exe
  2⤵
  PID:10012
- C:\Windows\System\MPYTGYX.exe
  C:\Windows\System\MPYTGYX.exe
  2⤵
  PID:10048
- C:\Windows\System\GyUxvnr.exe
  C:\Windows\System\GyUxvnr.exe
  2⤵
  PID:10080
- C:\Windows\System\bkPenSK.exe
  C:\Windows\System\bkPenSK.exe
  2⤵
  PID:10132
- C:\Windows\System\rrVeeFV.exe
  C:\Windows\System\rrVeeFV.exe
  2⤵
  PID:10152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADOYNAI.exe

Filesize
3.0MB

MD5
8c9f6f76ecc376f556c0f2b14c065e3c

SHA1
654191923ed7cccaba7757b8db689d14305e5a9f

SHA256
203fbac96ee4fe4f8388028c877d3dcd1dd538f6617e6a820f89003104755143

SHA512
95757475071f65993470f9b52d1dd30ef8cb568650bb3000d14d52050960876b23ac049c441623bda8139e1cd2baf8fd6b8e4b80cf208041301d77ab6897b6aa

Download Submit
C:\Windows\system\CqPACAs.exe

Filesize
3.0MB

MD5
4d0a8969197b76ddc50c390f72f1794c

SHA1
9e81a73f33506f614a05c5cf2b6b1c77d71a161b

SHA256
d3cb13dffe4c6c418a25671293f7a4ada1f565e4942b6c98c6fdce58d1a7de65

SHA512
9ec391a675c6338ce13a2f4e9429f3c02ca2e9723977ca839b1e7fba845a1158d9f006d0ee8cd25f7d8a0a86dd112889a87f5b7f20f1d6ee21da642ee82173c2

Download Submit
C:\Windows\system\KaQnxfW.exe

Filesize
2.9MB

MD5
fe1ea4a5381e518f5c3ff6feb790dc09

SHA1
9a7db1809408908d7ec4ab6d0704d476f9843782

SHA256
ab07483436db4868b88c1336760915fb636b2ade68f5c06cd28526ca172ef4b1

SHA512
5dbf1fb64f6ff1cf9e654925e75275fc3501a51bbdd416957a04f8feacea817d0b2f29af14554899ea4b829014423f4718a85f3c9f90a8deb55ced8593eb4276

Download Submit
C:\Windows\system\NjqlSOk.exe

Filesize
2.9MB

MD5
0df4f625f496e38cbe83fe4e8826f324

SHA1
299156a1c78779ec8984e4086aa369ef372c2e49

SHA256
b8a52101b4ccff6c035d4a9ca407e40e5077d408f1aff66b9651614b0e5f1743

SHA512
e02e1233c52a402b6667e67371a0adf1fe6c507569caa6e7f2fa738f1753c788cb13363908bb47842e625cfe6ada83cce8294251db5b1d93d26dad2c7936ada5

Download Submit
C:\Windows\system\QigTQYg.exe

Filesize
3.0MB

MD5
fe0b23309718c207dba54c00b69e5f59

SHA1
62b5c2eb7534b4ace001a039e0ad6fa1854e63a5

SHA256
2da3f201198df10572fbb614ce7c3abf2d7ec0147feac34c424aeffa7c1ba251

SHA512
5d612214a5fbda98906a3c6843ff62e9584c58190c9660764baa2a85f7778f98374432199b30c4984544d1bd6b3e91b0f4a2ebeac7c66868317467804369e634

Download Submit
C:\Windows\system\SdYDhqE.exe

Filesize
3.0MB

MD5
0629a368bf556d819e4e7f3c9854cef9

SHA1
f67f6fc942498ab5c141760d4329800822dee055

SHA256
e43162c97557b6f82e40e66199d363f496b7fbab9c6a992a47f241a939ab0f04

SHA512
aa85fafbf751369a1602108c2eca61c1fe0da9925db4d472d9a67855f49d4da74361189a9f93f1e4f29f956555e2c963703e95a27c90a0b922a57b4f9492d31c

Download Submit
C:\Windows\system\TPrxZDJ.exe

Filesize
2.9MB

MD5
0b65b4d17239adda7b8a231afef5a939

SHA1
356ece63216fd54731d304a81b65c2853dcbba93

SHA256
36dd773d85915f3315e5c3980a0fba79dded22dc83ac8bb957544e309645d14f

SHA512
af65336b7bd48f8d493b99b750c3470bd247e25deeaee0237cb82d786457bff2a83a69edc79731de667839ee71b826ce19ddb6d5ba5d0de2ada5093bd1cf7108

Download Submit
C:\Windows\system\TVYDLha.exe

Filesize
3.0MB

MD5
992e9cab9d7d8aad7d8a9fa0246cb647

SHA1
82fba7cc5ebdc20c9e2bb5d76a8311b14cf5a096

SHA256
563314964c659f82b396b2d8a571041a8584679e19db2cc857e2688d3c50112d

SHA512
ad04bb64684fe6e66e0f52ce0107e26094a7e6b5811f6caec8dfddee717b174663b821ba5e0bfdf4b5ae12d9e05ac479a614273fc8f88ce5fc3f08c34d69f31c

Download Submit
C:\Windows\system\ZVTzXoJ.exe

Filesize
2.9MB

MD5
a19d1102c7349fd67c89fe82ea1d1eb4

SHA1
86f5fc3916ad1d61b9020a7557c948100d8401ae

SHA256
224591123719d4a5226818a92fc8adb2c16d95f9f7dfb7f587ff6c05ad6ff3f1

SHA512
ee11f8b1f8e74b49e8dd60f5195bcad9f978c82ff723709abeb7ca80a4115c549eb3284137c941de1c32901001e4ca44eb198caf6e02600ea4cba41a618cc035

Download Submit
C:\Windows\system\ZnbAYZb.exe

Filesize
2.9MB

MD5
cf22bb6a9d40e9f8b5f498d8ed2d013a

SHA1
1065dcf79044e677122424bc5376c0273d4227bf

SHA256
e175c4a93dec85806ce54f9b2bf68ca29c0ff31cb10063970ca7b017e1e6d9e9

SHA512
0aaea8d81a4a3bed3033e6a68ad6019618b51bb9805a5b0df89177cff9068471137a0833a3f4fde966530ded71fe70a16f46b423047d546627e2e6c6752b5110

Download Submit
C:\Windows\system\aDWpcDG.exe

Filesize
3.0MB

MD5
d74b5a895c13957c26fc11a32d11df08

SHA1
b0ffe938ec3494e2eba60e69be21e43be1827372

SHA256
79907502e5c0af02b9dc845562326a1f3644714543ceb8c3dbb320681dec6b15

SHA512
0dc2ae3a62bd7339299af10fedbe190a9aa71517139e5db34ec33f9ab7a02036450394d1eac336f6b284b849b336bbc0f798fc77f00f08291524debfa6627a14

Download Submit
C:\Windows\system\aJsuveF.exe

Filesize
3.0MB

MD5
5e0303094dadd745bbad6d5b36b968ff

SHA1
365eeb172da8cbd2643bcbf6e8653a647cab191d

SHA256
55c5428dc949331af5034feb8d96ee4591ce7ab91b5de9065eaf36dfb8d38c6a

SHA512
2523369c8a23ac0e475ae0f4235bb77dbdae89772ebfb6f36610e470903f15628acbba280050bb46a395f1174567a5c0a81e150ff756eac40cf286de21c5bc50

Download Submit
C:\Windows\system\bceFOpa.exe

Filesize
2.9MB

MD5
cb8b3f8620ab24ac48e8dfa6e66322a9

SHA1
1255ceabc81a6956c5054e48493e3eef5541b0f4

SHA256
2385ff9486084f3e49a638577938610caa46d9fd8bc2bcff5bd49112301c2cf9

SHA512
9d05fe6bc4ca920ac7afd5a3153f9e571a0d1949434eeb1182ee82beb6ce65ed9324740c116ec2b70faffe809e9671c27b9f8734ce265f252fb7b5715d447a7a

Download Submit
C:\Windows\system\bskYIvs.exe

Filesize
2.9MB

MD5
bcdd3ce834c5252481132d48e32a15a7

SHA1
377456ffe1fc80cc45a6f267a06361f2917bae0d

SHA256
5cf2c69569b96189d5fda34cf347c7edea6666de5fbbdea8ecfb5a214798d146

SHA512
a2438928c0ef04ad1c78869ad5292e4dfcf21a0a4f61f84cc9bffe06424bb4716599d9a348aabda86396b344c43652aae22ad9b311d360a12776ab6200358350

Download Submit
C:\Windows\system\cOpPKno.exe

Filesize
2.9MB

MD5
a8ca31e5a5d3492f61b29084e018e292

SHA1
97e224a6eef6984ac42c85aa30be3181469446db

SHA256
5946a82905310bbe8e66bd2e2dc25847df60f5db2adeefc6d4bb90e7381db485

SHA512
5a282894ebc3e1840534fd06c3aa25ad5a1732c0fea3c9af4c600a6fe46dde8bcf409091f7ece6944258a1388cef13e8108295fb9fa8c7c81662e20816128ad8

Download Submit
C:\Windows\system\gvuXzOF.exe

Filesize
3.0MB

MD5
342bc4bf75db904c271e0a3185cdd837

SHA1
1f65aba379d046894759205ae3c7edfdc4429dd2

SHA256
96cb6417d2ade50ea970edc87f83a4d64820b8d95f50931f1d106bd035fb031f

SHA512
8111ef3e2590293fbcce7122ab868ca08689705da3d16cd6922de7cef1724ce23a6282728f85c10153c5c12c4cb7a20c80eaaf8ef526ec9ed63bacc565c0b182

Download Submit
C:\Windows\system\jmjdKvd.exe

Filesize
2.9MB

MD5
c8801658cc7138a03c80e4bc67a4ced7

SHA1
e7c1f22bb1fd73c38028324285b96aa05b8b4e2b

SHA256
2e05faacb12677dfa4962bfb3d22b515fd456ae4f90c38f8f5d7585c467a9b28

SHA512
def111ffe874be4d50379757fbaaab04dd48cba45bec22747869d9060ea9488af06ad3de043fdafde89319e28a1e4eecd980f7dfa594f551366fae015084d94f

Download Submit
C:\Windows\system\jzXLPwg.exe

Filesize
2.9MB

MD5
3a5543addd379c8a1ab010230249a480

SHA1
5682517484132acecaf853c5f64d7cb997b21233

SHA256
c26cf5e686d7cd5cc74a4da1313aaea8e8af9eaa00d1feec3d5821816915d766

SHA512
be1917d32f2e8585c41a32ac553d0b0c5a5213cefc6c22c4a8d18b051d97eb292291c1c4ec5ab1a24714a1d1dfad78b9bd9069b70ee9f08d6f04064aea2ac112

Download Submit
C:\Windows\system\kzdabqL.exe

Filesize
2.9MB

MD5
bbeb15242be497177d9d19d33b58a759

SHA1
3393a04a944a4d9b9bd2a11bf8a853f091ba1ab1

SHA256
d769b446b4c92f7f0a2752fa1d3066da190609446a39e22ddaf0fbc838e213df

SHA512
4ba0788cf8a06d3005efdec43fae349851f5d15936466aeb806862b0aa9b938a4ffed72b3d982dc20498dc843ff37eaed156082cf95d84de81d99a3ad92418cd

Download Submit
C:\Windows\system\qxXJCWg.exe

Filesize
2.9MB

MD5
6a543e08c803bd688bc320a9ed51997a

SHA1
591bd87df71dd05fa8f0160afc70eebd2c4872b8

SHA256
da31ffa3dbe681e80894e980be20fea32ef68646243d231dba2e41585fef52bf

SHA512
ecb8028cb49597dd24525ce19d70ebd0d024793c58c1f041fc009231b64e66f1cb52b740200519c94c0b870fcd5e35182ec1962b1f5d2117943a2b012231788d

Download Submit
C:\Windows\system\ruFlqrm.exe

Filesize
2.9MB

MD5
d971d2c72a23f94da216daa032b8845e

SHA1
4770485cfa8e37626b1fca932691506f195c792a

SHA256
074139114730b71deb3772412c2941c3c9493c928dfbf1d48f4402d7f0936a51

SHA512
4c0457cfbed12b2a7a9c870ea205de7ecedbedd17b1f374cad2011e82450fba511ad2f41cbc4359f8dd99c698893ee9948e9337c9e89d0e85e78d75384ce6fe8

Download Submit
C:\Windows\system\vhgUeDw.exe

Filesize
3.0MB

MD5
ce6cd58fe18c705138ffeaea824007e5

SHA1
68a31d84989fe8b8deb26f9c3dd5ce2b2d03933d

SHA256
b3b25b98ef2d17655dd0aa73204065e8b81054cacbbe51135afc14e7669699e4

SHA512
d8f5fe6dcfac0686f9a897c72f1a5b49de64dc8471445d2e01bf84899d791d584404f2224d37045ecfb7b48d92383502156602dfcc86ea0ed656706b9a30c60f

Download Submit
C:\Windows\system\xPdqIoH.exe

Filesize
3.0MB

MD5
12b49a0a55934c6a42192c38bea147db

SHA1
7ccc762457c81233f5478d1e6d523c3ad31378ac

SHA256
7d373325c67be900c3b25ec58cf020e56a7a22e462def2bb569b9dc1f1607a83

SHA512
9f5e674ae6a41b7f4b6b312d34c2003badbd334fd1c950789de8286b3bb2b77f304c059c59a8adb235e3f5fd9062f80fb1fa378564b182b077cae958a51556fe

Download Submit
C:\Windows\system\zQNKTXu.exe

Filesize
2.9MB

MD5
fbab7dc58af5545dc6d57ee58e3e2c15

SHA1
c62df83bcfb036e31f6bc5c60949322eb2a05db8

SHA256
b3b6c88db681dc773d90d5292dfb71f9c7c54c24e39c17593ca081db6406d8b2

SHA512
5ac745207549235f22a5b7e9bb26417749d0757d8b14b6de106539bbc028e799493455192bb5bd972daf4119767e85d311dda5f810f4569ae8df2f91ea2cd324

Download Submit
\Windows\system\CmHDdKn.exe

Filesize
2.9MB

MD5
bef11b8e2e3735c1c5f736b1f7236d8f

SHA1
9fe1b7d7cf8e89add5e7a2552404ab5297726275

SHA256
d6b14ffd61e3907a99673147db5647bcc552271bd15458d9e7d1bb752ebc7d2e

SHA512
7f977fc79e5ff8e7be4d427870fa6360ffa29430db94266d75bbaaf269230e714ec748f1470c4534663844090d5ba110947ad45e50576e5b3b1908c6629262c7

Download Submit
\Windows\system\JbhChrf.exe

Filesize
2.9MB

MD5
d241653c51a84583aff8b5b5a67f5bab

SHA1
cc3dc18739aa6fe9d3c203cede05a57c605272fe

SHA256
4204937a7624ab2022eb387899bcfbb4ee3f31647e69b3be31dec5fe56edf91f

SHA512
ef4dcdd4cf0ad37547ec834d16dc53fb64e5814e284a7b08e84ea27b880c4a65aadd07e81c05551882ac7fa6c0d9f4e2c8250b6a60d595fd187476bf0e5c107b

Download Submit
\Windows\system\TQLtYoI.exe

Filesize
3.0MB

MD5
0297da2116400265cb87a0d635cd6c50

SHA1
3e914d695790eace15a8db8b2d94ba1ca52b2f90

SHA256
29999b7f04cdc647200e881fae90a5b55e27e195facbcc0c7de1acd450be141e

SHA512
146de1c1bd8cdcf698b7cf887354a33bdc2e7158488cd8ee4a5c26e23ed7e0ecb7a76e9c3b51d37d160a70874bb4e40a33bb081cedca530d8a0b94b562a05b36

Download Submit
\Windows\system\bGyaPkT.exe

Filesize
3.0MB

MD5
d4aa42ec22ca58b81622be2b3f0367b1

SHA1
9baf1c8b58158c608f3546f90c3ae208a9f6b2e6

SHA256
1100aceff28111e915bcd657ce1de0991ce9b7cc6f700dad64b432ba3922844f

SHA512
050dd9b15d59b4571a6e264d697e6f4a46d1441d4969df99b37a699526a1080368955d72c2f59813941ddc892fb21972ec533e023c363e5d98ef3b4485d9ccc7

Download Submit
\Windows\system\buLEprW.exe

Filesize
3.0MB

MD5
dd61ed4939bf8c22d60fd760603a2355

SHA1
2fdc9f9a3d54bed7c3395abe2d64eb5d364b9fd4

SHA256
c610c410985ad0b7ad49fa9182897f829e28df759cf111388fdac9ef214b205d

SHA512
c9f9d27b68c14573e368a0934f814d06b9dcf5a350a22c7940203984b992662234f0f228c202d01be473474b480dcc26cc65d30b648336707b5bc85d955e69cf

Download Submit
\Windows\system\fXETaip.exe

Filesize
3.0MB

MD5
a65b30fa73ccaa86c356d83901fbfd83

SHA1
5458417c0533f66e90139dceeaa9760b3f0ff155

SHA256
106a02e63a32c033033d9842de962e1d58436bd79c78b095e9a0ca6518291cae

SHA512
9e6d4cb2cde6a01345c53c2dcd73525c86ed1dc18f7d979c879336d1da36dbdb27eedb519275b8672042d172bcc5cdbbbc68907100d1b812eebf37185decaf6c

Download Submit
\Windows\system\iPSToFO.exe

Filesize
3.0MB

MD5
e99247cd948fc3f57dfa9f79b64a4f52

SHA1
71f0062fafcbf21a807c3d9e5f90d3caeb453c01

SHA256
c096430157cf48e6f5a8a6df744dd59b431b20f07c1e5acc865bcf27e9366376

SHA512
d990b3cb9748612ba9aa81471fbfe6029155be7a307b6b76b5516e903de900a98e0e9cd6f7bafbb3bac67ff544ca3291e8527ff6508e34be0d2382bb67eba5d9

Download Submit
\Windows\system\iSFNmLG.exe

Filesize
2.9MB

MD5
155818d144c6f9697a063d075cbc4897

SHA1
df2cc9a4f48cfbf31c5f38a1a7909cc0d62dbded

SHA256
e58d0dde0eacded2ce2f939e4e99f2608ce92e66eea51d2d51b88af62eaf026f

SHA512
ee2ba4e5fc102c51852a3f5a5c55589452d25df177a0b35bf58fa644209f930301bbac2d19c0b63b2ff5fe0d9906aa2b3c69dbd99a8a9ca10d06e7c6b4aef67e

Download Submit
\Windows\system\mYjZYsA.exe

Filesize
3.0MB

MD5
baf3e30352a898794263e1d752f70691

SHA1
4104a07d94d541c175cbe1521e4079e1c18c2d8d

SHA256
d385cda78b63648c33c6be2c3a817729f7e6a830841635a957092866343ca8e8

SHA512
23d6c6f734ee038fb54730f2853b4c618e96cd5ff322fa935abb80ec7130151506567c4be525efe148be50ebc301aed1dafc69862d65a2fbd7ec75134654ec45

Download Submit
\Windows\system\oUiGTIK.exe

Filesize
3.0MB

MD5
2840be45ebd34d0d0158b06c93574d3c

SHA1
e31d7161e18223c3fe83446762670b00fff08349

SHA256
3938447a09d34075821346169f9f8cd0d6e96650a3a39427b070d08b540e1e84

SHA512
ac750577f2c0105f3f06370a711212b591d532c5f267909ed3c9e5c0849d0ac169db4d222cf22e20149d35a74c464ff5c4905292428a3561094350791d7c34bc

Download Submit
\Windows\system\pctlTAS.exe

Filesize
3.0MB

MD5
5710aa0c193d62c188cf1f46953031c1

SHA1
4438c837a99e49e1200ec565b2d719014f2aad21

SHA256
ab8aaa2d343d5bdc8621dfdd70757264cc30d72318ca2825b046efe72c1a578a

SHA512
13432c1de801ff91955e597ac08a6f2adb2c118eb545e9687db38c1dc1c20e57d781590952dd4c65978f6c70e1ec24ccbfb7f0506abcf619208296c7e221c30e

Download Submit
\Windows\system\yODNjSd.exe

Filesize
3.0MB

MD5
1635e917bf3ca9e3749954bf042d3f6b

SHA1
50a4c3077f55c65a84f6b5dffa662600a46e163d

SHA256
e9fbdde55af8265f95ecb46b231bfda05535a330235ac6d2707a687a1b7eb37d

SHA512
e3240d37dc1898b0be9acc4d486cbcc075cc583a9cd9bb47c3de5e334bd057511588dcf4844baa967cd7afa5b0f9ba0e131bbd37fc2fadb4d55fdcd4c721b66e

Download Submit
memory/1588-65-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/1588-388-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/1588-114-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/1588-98-0x000007FEF5F20000-0x000007FEF68BD000-memory.dmp

Filesize
9.6MB

Download
memory/1588-33-0x000007FEF61DE000-0x000007FEF61DF000-memory.dmp

Filesize
4KB

Download
memory/2004-122-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2004-5255-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2004-6570-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2136-108-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2136-5239-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2136-6560-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/2400-124-0x000000013FFE0000-0x00000001403D6000-memory.dmp

Filesize
4.0MB

Download
memory/2456-106-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2456-5235-0x000000013FB00000-0x000000013FEF6000-memory.dmp

Filesize
4.0MB

Download
memory/2464-99-0x000000013F110000-0x000000013F506000-memory.dmp

Filesize
4.0MB

Download
memory/2472-5247-0x000000013FBC0000-0x000000013FFB6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-112-0x000000013FBC0000-0x000000013FFB6000-memory.dmp

Filesize
4.0MB

Download
memory/2664-5257-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2664-126-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2664-6572-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2712-104-0x000000013F510000-0x000000013F906000-memory.dmp

Filesize
4.0MB

Download
memory/2772-27-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2780-23-0x000000013FC80000-0x0000000140076000-memory.dmp

Filesize
4.0MB

Download
memory/2972-9-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/3048-110-0x000000013FB20000-0x000000013FF16000-memory.dmp

Filesize
4.0MB

Download
memory/3064-111-0x000000013FBC0000-0x000000013FFB6000-memory.dmp

Filesize
4.0MB

Download
memory/3064-18-0x000000013FC80000-0x0000000140076000-memory.dmp

Filesize
4.0MB

Download
memory/3064-113-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/3064-123-0x000000013FFE0000-0x00000001403D6000-memory.dmp

Filesize
4.0MB

Download
memory/3064-24-0x0000000003220000-0x0000000003616000-memory.dmp

Filesize
4.0MB

Download
memory/3064-29-0x000000013F110000-0x000000013F506000-memory.dmp

Filesize
4.0MB

Download
memory/3064-1-0x000000013F750000-0x000000013FB46000-memory.dmp

Filesize
4.0MB

Download
memory/3064-5232-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/3064-2310-0x000000013F750000-0x000000013FB46000-memory.dmp

Filesize
4.0MB

Download
memory/3064-105-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/3064-5242-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/3064-125-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/3064-109-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/3064-107-0x000000013FBE0000-0x000000013FFD6000-memory.dmp

Filesize
4.0MB

Download
memory/3064-7-0x000000013FC20000-0x0000000140016000-memory.dmp

Filesize
4.0MB

Download
memory/3064-127-0x0000000003790000-0x0000000003B86000-memory.dmp

Filesize
4.0MB

Download
memory/3064-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download